Allow an "attribution" property on sources

[lucaswoj]

We should allow an attribution property on sources to specify custom attribution.

"geojson-marker": {
  "type": "geojson",
  "attribution": "© John Doe",
  "data": {
    "type": "Feature",
    "geometry": {
      "type": "Point",
      "coordinates": [-77.0323, 38.9131]
    },
    "properties": {
      "title": "Mapbox DC",
      "marker-symbol": "monument"
    }
  }
}

cc @mourner @jfirebaugh @yhahn @tmcw

ref mapbox/mapbox-gl-js#1485

[lucaswoj]

We will need to be careful about XSS attacks using the attribution. Instead of allowing HTML, we could hit the most common use case (a link to a page explaining the attribution) by supporting attribution and attributionHref properties.

[tristen]

Ahh it would be nice if this was flexible which a attribution and attributionHref value would limit. like:

Data layer by x and y.

Would it make sense for this to be an attribution plugin control (so opt-in) that sanitizes HTML?

[jfirebaugh]

Based on our experience with sanitization in Mapbox.js, it's something that we should avoid at all costs.

If you want totally custom attribution, you can always add your own <div> and CSS.

[1ec5]

We will need to be careful about XSS attacks using the attribution.

How would this be any different than using attribution in a TileJSON file or an inline raster source as an attack vector? It seems like this is an orthogonal concern that would be addressed by something like mapbox/tilejson-spec#20. In the meantime, I think we should give all sources the same attribution mechanism.

[lucaswoj]

Merged into mapbox/mapbox-gl-js#1485