bisgroves

Can you attach a link? I think your example kml was truncated.

Thank you. Were you able to trigger a XXE injection using the current code? Filed an investigation ticket to look into the usage of xerces.

Thank you for your follow up. The crash mechanism you provided exploits the XMLPullParser within the code. Specifically the code found in com.atakmap.map.layer.raster.mobac.MobacMapSourceFactory.parseCustomMapSource This path code does not make use...

Are you still seeing this deadlock in the latest playstore release?

The old plugin structure is still supported via a more concise mechanism and will still ship with ATAK during the 5.X period if not longer.

Correct, the changes you might need will be minor.

We currently have hit technical roadblocks our interactions with git hub that make this non-trivial. That being said, I believe that there are efforts in progress to move forward. More...

Sadly its not that easy but really comes down to a technical issue with how we use github.

That is all true - the technical issue increased the syncing burden.

Can you verify if this is still a problem with 4.10 on the playstore?