Open GlynAndersonSlalom opened 1 year ago
Hi @GlynAndersonSlalom, thank you for the report.
I see the import statements, but can you please post a full minimal reproduction case that you're using for your Lightening web component, so we can try to replicate what you're seeing? Thank you!
Gavin, I'll get this to you as soon as possible, but that could be a couple weeks as the developer of the component just went on PTO for a while. Thanks for the quick response!
esriLeafletVectorReproduce.zip
@gavinr Hey Gavin, I've attached an example that you should be able to use to reproduce. Steps needed:
The specific error I receive is 'L.esri.Vector.vectorBasemapLayer is not a function'. Once either of the workarounds are implemented, this goes away and draws the features defined in the layer.
As Glyn mentioned, my workarounds have been:
Let me know if you have any questions or issues implementing these steps and thanks for looking into this!
Describe the bug
Esri Leaflet Vector appears to be incompatible with Salesforce Lightning Locker Service. We are able to use Esri Leaflet in a Lightning Web Component (LWC) to render maps in Lightning Experience (the internal SF UI) and Experience Cloud (the external-facing "portal" UI), but when we add the Esri Leaflet Vector plugin, it triggers Locker Service, a security feature which protects against cross-site scripting. We've whitelisted multiple domains (including .leafletjs.com and .arcgis.com) but the problem persists. I've also looked through the Leaflet source code for domains that might need to be whitelisted.
We've worked around the problem by embedding our LWC into an Aura component configured to run using Salesforce API version 39.0, which pre-dates Locker Service. This is a short-term workaround, as Salesforce has already deprecated version up through 30.0 and will continue to deprecate API versions (the current version is 57.0).
The ask here is either to ensure there is no cross-site scripting in the Vector code, or to document any domains that need to be whitelisted to avoid this issue.
Reproduction
To reproduce, create a Lightning Web Component that imports the Esri Leaflet Vector plugin:
and embed it in a Lightning App Builder page or Experience Builder page with Content Security Policy set to Strict.
Logs
No response
System Info
Additional Information
No response