@mapbox/mapbox-gl-style-spec 14.24.1 → 14.25.0

package/util/unbundle_jsonlint.ts

@@ -14,8 +14,9 @@ export function deepUnbundle(value: unknown): unknown {
         const unbundledValue: {
             [key: string]: unknown;
         } = {};
-        for (const key in value) {
-            unbundledValue[key] = deepUnbundle(value[key]);
+        const valueRec = value as Record<string, unknown>;
+        for (const key in valueRec) {
+            unbundledValue[key] = deepUnbundle(valueRec[key]);
         }
         return unbundledValue;
     }

package/validate/validate.ts

@@ -2,6 +2,7 @@ import {unbundle, deepUnbundle} from '../util/unbundle_jsonlint';
 import {isExpression} from '../expression/index';
 import {isFunction} from '../function/index';
 import validateImport from './validate_import';
+import validateOption from './validate_option';
 import validateFunction from './validate_function';
 import validateExpression from './validate_expression';
 import validateObject from './validate_object';
@@ -54,6 +55,7 @@ const VALIDATORS: Record<string, (...args: unknown[]) => ValidationError[]> = {
     'projection': validateProjection,
     'import': validateImport,
     'iconset': validateIconset,
+    'option': validateOption,
 };
 
 export type ValidatorOptions = {

package/validate/validate_appearance.ts

@@ -90,7 +90,7 @@ function validateCondition(options: AppearanceValidatorOptions): Array<Validatio
     errors.push(...validateExpression({
         key: options.key,
         value: condition,
-        valueSpec: (latest['appearance'] as Record<string, unknown>)['condition'] as StylePropertySpecification,
+        valueSpec: (latest['appearance'] as Record<string, unknown>)['condition'],
         expressionContext: 'appearance'
     }));
 

package/validate/validate_color.ts

@@ -1,6 +1,7 @@
 import ValidationError from '../error/validation_error';
 import {getType, isString} from '../util/get_type';
-import {parseCSSColor} from 'csscolorparser';
+import {unbundle} from '../util/unbundle_jsonlint';
+import Color from '../util/color';
 
 type ColorValidatorOptions = {
     key: string;
@@ -12,7 +13,9 @@ export default function validateColor({key, value}: ColorValidatorOptions): Vali
         return [new ValidationError(key, value, `color expected, ${getType(value)} found`)];
     }
 
-    if (parseCSSColor(value) === null) {
+    // `value` may be a jsonlint-lines-primitives `String` wrapper; unbundle to a
+    // primitive so `Color.parse`'s `typeof input === 'string'` check passes.
+    if (Color.parse(unbundle(value) as string) === undefined) {
         return [new ValidationError(key, value, `color expected, "${value}" found`)];
     }
 

package/validate/validate_expression.ts

@@ -50,7 +50,7 @@ export default function validateExpression(options: ExpressionValidatorOptions):
 
     if (options.expressionContext === 'appearance') {
         // eslint-disable-next-line @typescript-eslint/no-unsafe-argument
-        return checkDisallowedParameters(expressionObj, options);
+        return checkDisallowedAppearancesParameters(expressionObj, options);
     }
 
     if (options.expressionContext && options.expressionContext.indexOf('cluster') === 0) {
@@ -103,32 +103,40 @@ export function disallowedFilterParameters(e: Expression, options: any): Validat
     return errors;
 }
 
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-function checkDisallowedParameters(e: Expression, options: any): ValidationError[] {
-    const allowedParameters = new Set<string>();
+const FEATURE_OPERATORS = new Set(['get', 'has', 'properties', 'geometry-type', 'id']);
+const APPEARANCES_DISALLOWED_PARAMETERS = new Set([
+    'zoom', 'pitch', 'distance-from-center',
+    'feature', 'feature-state',
+    'measure-light',
+    'heatmap-density', 'line-progress',
+    'raster-value', 'raster-particle-speed', 'sky-radial-progress',
+]);
 
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+function checkDisallowedAppearancesParameters(e: Expression, options: any): ValidationError[] {
     // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access
     if (options.valueSpec && options.valueSpec.expression) {
         // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access
         for (const param of options.valueSpec.expression.parameters) {
             // eslint-disable-next-line @typescript-eslint/no-unsafe-argument
-            allowedParameters.add(param);
+            APPEARANCES_DISALLOWED_PARAMETERS.delete(param);
         }
     }
 
-    if (allowedParameters.size === 0) {
+    if (APPEARANCES_DISALLOWED_PARAMETERS.size === 0) {
         return [];
     }
     const errors: ValidationError[] = [];
 
     if (e instanceof CompoundExpression) {
-        if (!allowedParameters.has(e.name)) {
+        const param = FEATURE_OPERATORS.has(e.name) ? 'feature' : e.name;
+        if (APPEARANCES_DISALLOWED_PARAMETERS.has(param)) {
             // eslint-disable-next-line @typescript-eslint/no-unsafe-argument, @typescript-eslint/no-unsafe-member-access
             return [new ValidationError(options.key, options.value, `["${e.name}"] is not an allowed parameter`)];
         }
     }
     e.eachChild((arg) => {
-        errors.push(...checkDisallowedParameters(arg, options));
+        errors.push(...checkDisallowedAppearancesParameters(arg, options));
     });
 
     return errors;

package/validate/validate_function.ts

@@ -99,7 +99,7 @@ export default function validateFunction(options: FunctionValidatorOptions): Val
         errors = errors.concat(validateArray({
             key: options.key,
             value,
-            valueSpec: options.valueSpec as Extract<StylePropertySpecification, {type: 'array'}>,
+            valueSpec: options.valueSpec,
             style: options.style,
             styleSpec: options.styleSpec,
             arrayElementValidator: validateFunctionStop
@@ -207,7 +207,8 @@ export default function validateFunction(options: FunctionValidatorOptions): Val
         }
 
         if (functionType === 'categorical' && type === 'number' && (typeof value !== 'number' || !isFinite(value) || Math.floor(value) !== value)) {
-            return [new ValidationError(options.key, reportValue, `integer expected, found ${String(value as number)}`)];
+            // eslint-disable-next-line @typescript-eslint/no-base-to-string -- value narrowed to number|string|boolean by the check above
+            return [new ValidationError(options.key, reportValue, `integer expected, found ${String(value)}`)];
         }
 
         if (functionType !== 'categorical' && type === 'number' && typeof value === 'number' && typeof previousStopDomainValue === 'number' && previousStopDomainValue !== undefined && value < previousStopDomainValue) {

package/validate/validate_iconset.ts

@@ -45,7 +45,7 @@ export default function validateIconset(options: IconsetValidatorOptions): Valid
     }));
 
     if (isSourceIconset(type, iconset)) {
-        const source = style.sources && style.sources[iconset.source];
+        const source = style.sources && Object.hasOwn(style.sources, iconset.source) ? style.sources[iconset.source] : undefined;
         const sourceType = source && unbundle(source.type) as string;
         if (!source) {
             errors.push(new ValidationError(key, iconset.source, `source "${iconset.source}" not found`));

package/validate/validate_import.ts

@@ -42,6 +42,13 @@ export default function validateImport(options: ImportValidatorOptions): Validat
         errors.push(new ValidationError(key, importSpec, `import id can't be an empty string`));
     }
 
+    // Reject reserved prototype-pollution key — the import id is used as a scope
+    // string that becomes a dictionary key in several runtime caches.
+    if (unbundle(importSpec.id) === '__proto__') {
+        const key = `${options.key}.id`;
+        errors.push(new ValidationError(key, importSpec, `import id can't be "__proto__"`));
+    }
+
     if (data) {
         const key = `${options.key}.data`;
         errors = errors.concat(validateStyle(data, styleSpec, {key}));

package/validate/validate_layer.ts

@@ -77,7 +77,10 @@ export default function validateLayer(options: LayerValidatorOptions): Validatio
         } else if (!isString(layer.source)) {
             errors.push(new ValidationError(`${key}.source`, layer.source, '"source" must be a string'));
         } else {
-            const source = style.sources && style.sources[layer.source];
+            // Object.hasOwn: a bare lookup like `style.sources[layer.source]` would
+            // find inherited keys from Object.prototype (e.g. "constructor", "toString")
+            // and treat them as valid sources.
+            const source = style.sources && Object.hasOwn(style.sources, layer.source) ? style.sources[layer.source] : undefined;
             const sourceType = source && unbundle(source.type);
             if (!source) {
                 errors.push(new ValidationError(key, layer.source, `source "${layer.source}" not found`));

package/validate/validate_object.ts

@@ -41,18 +41,30 @@ export default function validateObject(options: ObjectValidatorOptions): Validat
 
     let errors: ValidationError[] = [];
     for (const objectKey in object) {
+        // Skip inherited keys: a hostile style JSON parsed with JSON.parse can
+        // have an own "__proto__" key, but downstream consumers may have mutated
+        // the prototype of `object` upstream. We never want to validate
+        // inherited properties as if they were user-supplied.
+        if (!Object.hasOwn(object, objectKey)) continue;
+
         const elementSpecKey = objectKey.split('.')[0]; // treat 'paint.*' as 'paint'
+        // Object.hasOwn: a bare lookup like `elementSpecs[objectKey]` would
+        // find inherited keys from Object.prototype (e.g. "__proto__",
+        // "constructor", "toString") when the user-supplied key matches one,
+        // returning a non-spec value that then fails as a validator.
+        const hasSpec = Object.hasOwn(elementSpecs, elementSpecKey);
+        const hasWildcardSpec = Object.hasOwn(elementSpecs, '*');
         // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
-        const elementSpec = elementSpecs[elementSpecKey] || elementSpecs['*'];
+        const elementSpec = hasSpec ? elementSpecs[elementSpecKey] : (hasWildcardSpec ? elementSpecs['*'] : undefined);
 
         let validateElement: ((options: ObjectElementValidatorOptions, object?: unknown) => ValidationError[]) | undefined;
-        if (elementValidators[elementSpecKey]) {
+        if (Object.hasOwn(elementValidators, elementSpecKey)) {
             validateElement = elementValidators[elementSpecKey];
-        } else if (elementSpecs[elementSpecKey]) {
+        } else if (hasSpec) {
             validateElement = validateSpec;
-        } else if (elementValidators['*']) {
+        } else if (Object.hasOwn(elementValidators, '*')) {
             validateElement = elementValidators['*'];
-        } else if (elementSpecs['*']) {
+        } else if (hasWildcardSpec) {
             validateElement = validateSpec;
         }
 
@@ -73,13 +85,14 @@ export default function validateObject(options: ObjectValidatorOptions): Validat
     }
 
     for (const elementSpecKey in elementSpecs) {
+        if (!Object.hasOwn(elementSpecs, elementSpecKey)) continue;
         // Don't check `required` when there's a custom validator for that property.
-        if (elementValidators[elementSpecKey]) {
+        if (Object.hasOwn(elementValidators, elementSpecKey)) {
             continue;
         }
 
         const elementSpec = elementSpecs[elementSpecKey] as {required?: boolean; default?: unknown};
-        if (elementSpec.required && elementSpec['default'] === undefined && object[elementSpecKey] === undefined) {
+        if (elementSpec.required && elementSpec['default'] === undefined && (!Object.hasOwn(object, elementSpecKey) || object[elementSpecKey] === undefined)) {
             errors.push(new ValidationError(key, object, `missing required property "${elementSpecKey}"`));
         }
     }

package/validate/validate_option.ts

@@ -0,0 +1,37 @@
+import validateSpec from './validate';
+import validateObject from './validate_object';
+import {unbundle} from '../util/unbundle_jsonlint';
+import {isObject} from '../util/get_type';
+
+import type ValidationError from '../error/validation_error';
+import type {ValidatorOptions} from './validate';
+
+// Validator for a single config option (one entry in `schema`). Wraps the
+// generic object validator to inherit the option's declared `type` when
+// validating its `default`, so expressions in the default are checked against
+// the option's expected type instead of `*` (any).
+export default function validateOption(options: ValidatorOptions): ValidationError[] {
+    const styleSpec = options.styleSpec;
+    const optionValue = options.value as {type?: unknown; array?: unknown} | null | undefined;
+    // Don't propagate the declared type for array options: `getExpectedType`
+    // doesn't model the schema's `array: true` flag, so forcing a scalar type
+    // here would reject an array-of-T default that previously validated fine.
+    const isArrayOption = isObject(optionValue) && unbundle(optionValue.array) === true;
+    const declaredType = !isArrayOption && isObject(optionValue) ? unbundle(optionValue.type) : undefined;
+
+    return validateObject(Object.assign({}, options, {
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
+        valueSpec: styleSpec.option,
+        objectElementValidators: declaredType ? {
+            // Only propagate the declared type when the default is an
+            // expression (array-form). Primitive defaults keep the previous
+            // permissive validation, mirroring the runtime parser's narrowing
+            // in style.ts/parser.cpp.
+            default: (elementOptions: ValidatorOptions): ValidationError[] => (Array.isArray(elementOptions.value) ?
+                validateSpec(Object.assign({}, elementOptions, {
+                    valueSpec: Object.assign({}, elementOptions.valueSpec, {type: declaredType}),
+                })) :
+                validateSpec(elementOptions)),
+        } : undefined,
+    }));
+}

package/validate/validate_terrain.ts

@@ -74,7 +74,7 @@ export default function validateTerrain(options: TerrainValidatorOptions): Valid
     } else if (!isString(terrain.source)) {
         errors.push(new ValidationError(`${key}.source`, terrain.source, `source must be a string`));
     } else {
-        const source = style.sources && style.sources[terrain.source];
+        const source = style.sources && Object.hasOwn(style.sources, terrain.source) ? style.sources[terrain.source] : undefined;
         const sourceType = source && unbundle(source.type) as string;
         if (!source) {
             errors.push(new ValidationError(`${key}.source`, terrain.source, `source "${terrain.source}" not found`));

package/validate_style.ts

@@ -11,8 +11,8 @@ import type {StyleSpecification} from './types';
  *
  * @private
  * @alias validate
- * @param {Object|String|Buffer} style The style to be validated. If a `String`
- *     or `Buffer` is provided, the returned errors will contain line numbers.
+ * @param {Object|String|Uint8Array} style The style to be validated. If a `String`
+ *     or `Uint8Array` is provided, the returned errors will contain line numbers.
  * @param {Object} [styleSpec] The style specification to validate against.
  *     If omitted, the spec version is inferred from the stylesheet.
  * @returns {Array<ValidationError|ParsingError>}
@@ -22,7 +22,7 @@ import type {StyleSpecification} from './types';
  *   var errors = validate(style);
  */
 
-export default function validateStyle(style: StyleSpecification | string | Buffer, styleSpec: StyleReference = v8): ValidationErrors {
+export default function validateStyle(style: StyleSpecification | string | Uint8Array, styleSpec: StyleReference = v8): ValidationErrors {
     let s = style;
 
     try {