Extra Mitigation Curation

Content Injection via TileJSON attribute If you use `L.mapbox.map` or `L.mapbox.tileLayer` to load untrusted `TileJSON` content from a non-Mapbox URL, it is possible for a malicious user with control over the `TileJSON` content to inject script content into the `attribution` value of the `TileJSON` which will be executed in the context of the page using Mapbox.js.