tileserver-gl-light 5.4.1-pre.0 → 5.5.0-pre.1

package/src/serve_data.js

@@ -12,7 +12,8 @@ import { SphericalMercator } from '@mapbox/sphericalmercator';
 import {
   fixTileJSONCenter,
   getTileUrls,
-  isValidHttpUrl,
+  isS3Url,
+  isValidRemoteUrl,
   fetchTileData,
 } from './utils.js';
 import { getPMtilesInfo, openPMtiles } from './pmtiles_adapter.js';
@@ -68,6 +69,7 @@ export const serve_data = {
           String(req.params.format).replace(/\n|\r/g, ''),
         );
       }
+      // eslint-disable-next-line security/detect-object-injection -- req.params.id is route parameter, validated by Express
       const item = repo[req.params.id];
       if (!item) {
         return res.sendStatus(404);
@@ -146,6 +148,7 @@ export const serve_data = {
           features: [],
         };
         for (const layerName in tile.layers) {
+          // eslint-disable-next-line security/detect-object-injection -- layerName from VectorTile library internal data structure
           const layer = tile.layers[layerName];
           for (let i = 0; i < layer.length; i++) {
             const feature = layer.feature(i);
@@ -190,6 +193,7 @@ export const serve_data = {
             String(req.params.y).replace(/\n|\r/g, ''),
           );
         }
+        // eslint-disable-next-line security/detect-object-injection -- req.params.id is route parameter, validated by Express
         const item = repo?.[req.params.id];
         if (!item) return res.sendStatus(404);
         if (!item.source) return res.status(404).send('Missing source');
@@ -300,6 +304,7 @@ export const serve_data = {
           String(req.params.id).replace(/\n|\r/g, ''),
         );
       }
+      // eslint-disable-next-line security/detect-object-injection -- req.params.id is route parameter, validated by Express
       const item = repo[req.params.id];
       if (!item) {
         return res.sendStatus(404);
@@ -331,25 +336,26 @@ export const serve_data = {
    * @param {object} programOpts - An object containing the program options
    * @param {string} programOpts.publicUrl Public URL for the data.
    * @param {boolean} programOpts.verbose Whether verbose logging should be used.
-   * @param {Function} dataResolver Function to resolve data.
    * @returns {Promise<void>}
    */
   add: async function (options, repo, params, id, programOpts) {
-    const { publicUrl } = programOpts;
+    const { publicUrl, verbose } = programOpts;
     let inputFile;
     let inputType;
     if (params.pmtiles) {
       inputType = 'pmtiles';
-      if (isValidHttpUrl(params.pmtiles)) {
+      // PMTiles supports HTTP, HTTPS, and S3 URLs
+      if (isValidRemoteUrl(params.pmtiles)) {
         inputFile = params.pmtiles;
       } else {
         inputFile = path.resolve(options.paths.pmtiles, params.pmtiles);
       }
     } else if (params.mbtiles) {
       inputType = 'mbtiles';
-      if (isValidHttpUrl(params.mbtiles)) {
+      // MBTiles does not support remote URLs
+      if (isValidRemoteUrl(params.mbtiles)) {
         console.log(
-          `ERROR: MBTiles does not support web based files. "${params.mbtiles}" is not a valid data file.`,
+          `ERROR: MBTiles does not support remote files. "${params.mbtiles}" is not a valid data file.`,
         );
         process.exit(1);
       } else {
@@ -357,11 +363,17 @@ export const serve_data = {
       }
     }
 
+    if (verbose && verbose >= 1) {
+      console.log(`[INFO] Loading data source '${id}' from: ${inputFile}`);
+    }
+
     let tileJSON = {
       tiles: params.domains || options.domains,
     };
 
-    if (!isValidHttpUrl(inputFile)) {
+    // Only check file stats for local files, not remote URLs
+    if (!isValidRemoteUrl(inputFile)) {
+      // eslint-disable-next-line security/detect-non-literal-fs-filename -- inputFile is from config file, validated above
       const inputFileStats = await fsp.stat(inputFile);
       if (!inputFileStats.isFile() || inputFileStats.size === 0) {
         throw Error(`Not valid input file: "${inputFile}"`);
@@ -377,9 +389,15 @@ export const serve_data = {
     tileJSON['sparse'] = params['sparse'];
 
     if (inputType === 'pmtiles') {
-      source = openPMtiles(inputFile);
+      source = openPMtiles(
+        inputFile,
+        params.s3Profile,
+        params.requestPayer,
+        params.s3Region,
+        verbose,
+      );
       sourceType = 'pmtiles';
-      const metadata = await getPMtilesInfo(source);
+      const metadata = await getPMtilesInfo(source, inputFile);
       Object.assign(tileJSON, metadata);
     } else if (inputType === 'mbtiles') {
       sourceType = 'mbtiles';
@@ -401,6 +419,7 @@ export const serve_data = {
       tileJSON = options.dataDecoratorFunc(id, 'tilejson', tileJSON);
     }
 
+    // eslint-disable-next-line security/detect-object-injection -- id is from config file data source names
     repo[id] = {
       tileJSON,
       publicUrl,

package/src/serve_rendered.js

@@ -32,6 +32,7 @@ import {
   listFonts,
   getTileUrls,
   isValidHttpUrl,
+  isValidRemoteUrl,
   fixTileJSONCenter,
   fetchTileData,
   readFile,
@@ -61,8 +62,8 @@ const staticTypeRegex = new RegExp(
 );
 
 const PATH_PATTERN =
+  // eslint-disable-next-line security/detect-unsafe-regex -- Simple path pattern validation, no nested quantifiers
   /^((fill|stroke|width)\:[^\|]+\|)*(enc:.+|-?\d+(\.\d*)?,-?\d+(\.\d*)?(\|-?\d+(\.\d*)?,-?\d+(\.\d*)?)+)/;
-const httpTester = /^https?:\/\//i;
 
 const mercator = new SphericalMercator();
 
@@ -94,7 +95,7 @@ const cachedEmptyResponses = {
  * Create an appropriate mlgl response for http errors.
  * @param {string} format The format (a sharp format or 'pbf').
  * @param {string} color The background color (or empty string for transparent).
- * @param {Function} callback The mlgl callback.
+ * @param {(err: Error|null, data: object|null) => void} callback The mlgl callback.
  * @returns {void}
  */
 function createEmptyResponse(format, color, callback) {
@@ -111,6 +112,7 @@ function createEmptyResponse(format, color, callback) {
   }
 
   const cacheKey = `${format},${color}`;
+  // eslint-disable-next-line security/detect-object-injection -- cacheKey is constructed from validated format and color
   const data = cachedEmptyResponses[cacheKey];
   if (data) {
     callback(null, { data: data });
@@ -136,6 +138,7 @@ function createEmptyResponse(format, color, callback) {
           callback(err, null);
           return;
         }
+        // eslint-disable-next-line security/detect-object-injection -- cacheKey is constructed from validated format and color
         cachedEmptyResponses[cacheKey] = buffer;
         callback(null, { data: buffer });
       });
@@ -148,8 +151,7 @@ function createEmptyResponse(format, color, callback) {
 /**
  * Parses coordinate pair provided to pair of floats and ensures the resulting
  * pair is a longitude/latitude combination depending on lnglat query parameter.
- * @param {Array<string>} coordinatePair Coordinate pair.
- * @param coordinates
+ * @param {Array<string>} coordinates Coordinate pair.
  * @param {object} query Request query parameters.
  * @returns {Array<number>|null} Parsed coordinate pair as [longitude, latitude] or null if invalid
  */
@@ -175,7 +177,7 @@ function parseCoordinatePair(coordinates, query) {
  * Parses a coordinate pair from query arguments and optionally transforms it.
  * @param {Array<string>} coordinatePair Coordinate pair.
  * @param {object} query Request query parameters.
- * @param {Function} transformer Optional transform function.
+ * @param {((coords: Array<number>) => Array<number>)|null} transformer Optional transform function.
  * @returns {Array<number>|null} Transformed coordinate pair or null if invalid.
  */
 function parseCoordinates(coordinatePair, query, transformer) {
@@ -192,7 +194,7 @@ function parseCoordinates(coordinatePair, query, transformer) {
 /**
  * Parses paths provided via query into a list of path objects.
  * @param {object} query Request query parameters.
- * @param {Function} transformer Optional transform function.
+ * @param {((coords: Array<number>) => Array<number>)|null} transformer Optional transform function.
  * @returns {Array<Array<Array<number>>>} Array of paths.
  */
 function extractPathsFromQuery(query, transformer) {
@@ -290,7 +292,7 @@ function parseMarkerOptions(optionsList, marker) {
  * Parses markers provided via query into a list of marker objects.
  * @param {object} query Request query parameters.
  * @param {object} options Configuration options.
- * @param {Function} transformer Optional transform function.
+ * @param {((coords: Array<number>) => Array<number>)|null} transformer Optional transform function.
  * @returns {Array<object>} An array of marker objects.
  */
 function extractMarkersFromQuery(query, options, transformer) {
@@ -327,8 +329,7 @@ function extractMarkersFromQuery(query, options, transformer) {
     let iconURI = markerParts[1];
     // Check if icon is served via http otherwise marker icons are expected to
     // be provided as filepaths relative to configured icon path
-    const isRemoteURL =
-      iconURI.startsWith('http://') || iconURI.startsWith('https://');
+    const isRemoteURL = isValidHttpUrl(iconURI);
     const isDataURL = iconURI.startsWith('data:');
     if (!(isRemoteURL || isDataURL)) {
       // Sanitize URI with sanitize-filename
@@ -461,8 +462,10 @@ async function respondImage(
   const tileMargin = Math.max(options.tileMargin || 0, 0);
   let pool;
   if (mode === 'tile' && tileMargin === 0) {
+    // eslint-disable-next-line security/detect-object-injection -- scale is validated by allowedScales
     pool = item.map.renderers[scale];
   } else {
+    // eslint-disable-next-line security/detect-object-injection -- scale is validated by allowedScales
     pool = item.map.renderersStatic[scale];
   }
 
@@ -564,8 +567,10 @@ async function respondImage(
           'WARNING: The formatQuality option is deprecated and has been replaced with formatOptions. Please see the documentation. The values from formatQuality will be used if a quality setting is not provided via formatOptions.',
         );
       }
+      // eslint-disable-next-line security/detect-object-injection -- format is validated above
       const formatQuality = formatQualities[format];
 
+      // eslint-disable-next-line security/detect-object-injection -- format is validated above
       const formatOptions = (options.formatOptions || {})[format] || {};
 
       if (format === 'png') {
@@ -615,9 +620,9 @@ async function respondImage(
  * @param {string} req.params.scale - The scale parameter.
  * @param {string} req.params.format - The format of the image.
  * @param {object} res - Express response object.
- * @param {Function} next - Express next middleware function.
+ * @param {object} next - Express next middleware function.
  * @param {number} maxScaleFactor - The maximum scale factor allowed.
- * @param defailtTileSize
+ * @param {number} defailtTileSize - Default tile size.
  * @returns {Promise<void>}
  */
 async function handleTileRequest(
@@ -638,6 +643,7 @@ async function handleTileRequest(
     scale: scaleParam,
     format,
   } = req.params;
+  // eslint-disable-next-line security/detect-object-injection -- id is route parameter, validated by Express
   const item = repo[id];
   if (!item) {
     return res.sendStatus(404);
@@ -695,16 +701,15 @@ async function handleTileRequest(
  * @param {object} options - Configuration options for the server.
  * @param {object} repo - The repository object holding style data.
  * @param {object} req - Express request object.
- * @param {object} res - Express response object.
+ * @param {string} req.params.id - The id of the style.
  * @param {string} req.params.p2 - The raw or static parameter.
  * @param {string} req.params.p3 - The staticType parameter.
- * @param {string} req.params.p4 - The width parameter.
- * @param {string} req.params.p5 - The height parameter.
+ * @param {string} req.params.p4 - The widthAndHeight parameter.
  * @param {string} req.params.scale - The scale parameter.
  * @param {string} req.params.format - The format of the image.
- * @param {Function} next - Express next middleware function.
+ * @param {object} res - Express response object.
+ * @param {object} next - Express next middleware function.
  * @param {number} maxScaleFactor - The maximum scale factor allowed.
- * @param verbose
  * @returns {Promise<void>}
  */
 async function handleStaticRequest(
@@ -723,6 +728,7 @@ async function handleStaticRequest(
     scale: scaleParam,
     format,
   } = req.params;
+  // eslint-disable-next-line security/detect-object-injection -- id is route parameter, validated by Express
   const item = repo[id];
 
   let parsedWidth = null;
@@ -918,6 +924,7 @@ export const serve_rendered = {
      * Handles requests for tile images.
      * @param {object} req - Express request object.
      * @param {object} res - Express response object.
+     * @param {object} next - Express next middleware function.
      * @param {string} req.params.id - The id of the style.
      * @param {string} [req.params.p1] - The tile size or static parameter, if available.
      * @param {string} req.params.p2 - The z, static, or raw parameter.
@@ -985,11 +992,13 @@ export const serve_rendered = {
      * Handles requests for rendered tilejson endpoint.
      * @param {object} req - Express request object.
      * @param {object} res - Express response object.
+     * @param {object} next - Express next middleware function.
      * @param {string} req.params.id - The id of the tilejson
      * @param {string} [req.params.tileSize] - The size of the tile, if specified.
      * @returns {void}
      */
     app.get('{/:tileSize}/:id.json', (req, res, next) => {
+      // eslint-disable-next-line security/detect-object-injection -- req.params.id is route parameter, validated by Express
       const item = repo[req.params.id];
       if (!item) {
         return res.sendStatus(404);
@@ -1029,7 +1038,7 @@ export const serve_rendered = {
    * @param {string} id ID of the item.
    * @param {object} programOpts - An object containing the program options
    * @param {object} style pre-fetched/read StyleJSON object.
-   * @param {Function} dataResolver Function to resolve data.
+   * @param {(dataId: string) => object} dataResolver Function to resolve data.
    * @returns {Promise<void>}
    */
   add: async function (
@@ -1063,8 +1072,8 @@ export const serve_rendered = {
       /**
        * Creates a renderer
        * @param {number} ratio Pixel ratio
-       * @param {Function} createCallback Function that returns the renderer when created
-       *  @returns {void}
+       * @param {(err: Error|null, renderer: object) => void} createCallback Function that returns the renderer when created
+       * @returns {void}
        */
       const createRenderer = (ratio, createCallback) => {
         const renderer = new mlgl.Map({
@@ -1072,10 +1081,11 @@ export const serve_rendered = {
           ratio,
           request: async (req, callback) => {
             const protocol = req.url.split(':')[0];
-            if (verbose) {
+            if (verbose && verbose >= 3) {
               console.log('Handling request:', req);
             }
             if (protocol === 'sprites') {
+              // eslint-disable-next-line security/detect-object-injection -- protocol is 'sprites', validated above
               const dir = options.paths[protocol];
               const file = decodeURIComponent(req.url).substring(
                 protocol.length + 3,
@@ -1095,6 +1105,7 @@ export const serve_rendered = {
               try {
                 const concatenated = await getFontsPbf(
                   null,
+                  // eslint-disable-next-line security/detect-object-injection -- protocol is 'fonts', validated above
                   options.paths[protocol],
                   fontstack,
                   range,
@@ -1107,8 +1118,11 @@ export const serve_rendered = {
             } else if (protocol === 'mbtiles' || protocol === 'pmtiles') {
               const parts = req.url.split('/');
               const sourceId = parts[2];
+              // eslint-disable-next-line security/detect-object-injection -- sourceId from internal style source names
               const source = map.sources[sourceId];
+              // eslint-disable-next-line security/detect-object-injection -- sourceId from internal style source names
               const sourceType = map.sourceTypes[sourceId];
+              // eslint-disable-next-line security/detect-object-injection -- sourceId from internal style source names
               const sourceInfo = styleJSON.sources[sourceId];
 
               const z = parts[3] | 0;
@@ -1223,6 +1237,7 @@ export const serve_rendered = {
 
                   const parts = url.parse(req.url);
                   const extension = path.extname(parts.pathname).toLowerCase();
+                  // eslint-disable-next-line security/detect-object-injection -- extension is from path.extname, limited set
                   const format = extensionToFormat[extension] || '';
                   createEmptyResponse(format, '', callback);
                 }
@@ -1231,6 +1246,7 @@ export const serve_rendered = {
               const name = decodeURI(req.url).substring(protocol.length + 3);
               const file = path.join(options.paths['files'], name);
               if (await existsP(file)) {
+                // eslint-disable-next-line security/detect-non-literal-fs-filename -- file path constructed from configured base path and URL-decoded filename
                 const inputFileStats = await fsp.stat(file);
                 if (!inputFileStats.isFile() || inputFileStats.size === 0) {
                   throw Error(
@@ -1274,7 +1290,8 @@ export const serve_rendered = {
         styleJSON.sprite = [{ id: 'default', url: styleJSON.sprite }];
       }
       styleJSON.sprite.forEach((spriteItem) => {
-        if (!httpTester.test(spriteItem.url)) {
+        // Sprites should only be HTTP/HTTPS, not S3
+        if (!isValidHttpUrl(spriteItem.url)) {
           spriteItem.url =
             'sprites://' +
             spriteItem.url
@@ -1290,7 +1307,8 @@ export const serve_rendered = {
       });
     }
 
-    if (styleJSON.glyphs && !httpTester.test(styleJSON.glyphs)) {
+    // Glyphs should only be HTTP/HTTPS, not S3
+    if (styleJSON.glyphs && !isValidHttpUrl(styleJSON.glyphs)) {
       styleJSON.glyphs = `fonts://${styleJSON.glyphs}`;
     }
 
@@ -1339,6 +1357,7 @@ export const serve_rendered = {
                   `Note: This property will still work with MapLibre GL JS vector maps.`,
               );
             }
+            // eslint-disable-next-line security/detect-object-injection -- prop is from hillshadePropertiesToRemove array, validated property names
             delete layer.paint[prop];
           }
         }
@@ -1386,11 +1405,13 @@ export const serve_rendered = {
       staticAttributionText:
         params.staticAttributionText || options.staticAttributionText,
     };
+    // eslint-disable-next-line security/detect-object-injection -- id is from config file style names
     repo[id] = repoobj;
 
     for (const name of Object.keys(styleJSON.sources)) {
       let sourceType;
       let sparse;
+      // eslint-disable-next-line security/detect-object-injection -- name is from style sources object keys
       let source = styleJSON.sources[name];
       let url = source.url;
       if (
@@ -1405,23 +1426,32 @@ export const serve_rendered = {
           dataId = dataId.slice(1, -1);
         }
 
+        // eslint-disable-next-line security/detect-object-injection -- dataId is from style source URL, used for mapping lookup
         const mapsTo = (params.mapping || {})[dataId];
         if (mapsTo) {
           dataId = mapsTo;
         }
 
         let inputFile;
+        let s3Profile;
+        let requestPayer;
+        let s3Region;
         const dataInfo = dataResolver(dataId);
         if (dataInfo.inputFile) {
           inputFile = dataInfo.inputFile;
           sourceType = dataInfo.fileType;
           sparse = dataInfo.sparse;
+          s3Profile = dataInfo.s3Profile;
+          requestPayer = dataInfo.requestPayer;
+          s3Region = dataInfo.s3Region;
         } else {
           console.error(`ERROR: data "${inputFile}" not found!`);
           process.exit(1);
         }
 
-        if (!isValidHttpUrl(inputFile)) {
+        // PMTiles supports remote URLs (HTTP and S3), skip file check for those
+        if (!isValidRemoteUrl(inputFile)) {
+          // eslint-disable-next-line security/detect-non-literal-fs-filename -- inputFile is from dataResolver, which validates against config
           const inputFileStats = await fsp.stat(inputFile);
           if (!inputFileStats.isFile() || inputFileStats.size === 0) {
             throw Error(`Not valid PMTiles file: "${inputFile}"`);
@@ -1429,9 +1459,18 @@ export const serve_rendered = {
         }
 
         if (sourceType === 'pmtiles') {
-          map.sources[name] = openPMtiles(inputFile);
+          // eslint-disable-next-line security/detect-object-injection -- name is from style sources object keys
+          map.sources[name] = openPMtiles(
+            inputFile,
+            s3Profile,
+            requestPayer,
+            s3Region,
+            verbose,
+          );
+          // eslint-disable-next-line security/detect-object-injection -- name is from style sources object keys
           map.sourceTypes[name] = 'pmtiles';
-          const metadata = await getPMtilesInfo(map.sources[name]);
+          // eslint-disable-next-line security/detect-object-injection -- name is from style sources object keys
+          const metadata = await getPMtilesInfo(map.sources[name], inputFile);
 
           if (!repoobj.dataProjWGStoInternalWGS && metadata.proj4) {
             // how to do this for multiple sources with different proj4 defs?
@@ -1464,13 +1503,17 @@ export const serve_rendered = {
             }
           }
         } else {
+          // MBTiles does not support remote URLs
+          // eslint-disable-next-line security/detect-non-literal-fs-filename -- inputFile is from dataResolver, which validates against config
           const inputFileStats = await fsp.stat(inputFile);
           if (!inputFileStats.isFile() || inputFileStats.size === 0) {
             throw Error(`Not valid MBTiles file: "${inputFile}"`);
           }
           const mbw = await openMbTilesWrapper(inputFile);
           const info = await mbw.getInfo();
+          // eslint-disable-next-line security/detect-object-injection -- name is from style sources object keys
           map.sources[name] = mbw.getMbTiles();
+          // eslint-disable-next-line security/detect-object-injection -- name is from style sources object keys
           map.sourceTypes[name] = 'mbtiles';
 
           if (!repoobj.dataProjWGStoInternalWGS && info.proj4) {
@@ -1517,9 +1560,13 @@ export const serve_rendered = {
     for (let s = 1; s <= maxScaleFactor; s++) {
       const i = Math.min(minPoolSizes.length - 1, s - 1);
       const j = Math.min(maxPoolSizes.length - 1, s - 1);
+      // eslint-disable-next-line security/detect-object-injection -- i and j are calculated indices bounded by array length
       const minPoolSize = minPoolSizes[i];
+      // eslint-disable-next-line security/detect-object-injection -- i and j are calculated indices bounded by array length
       const maxPoolSize = Math.max(minPoolSize, maxPoolSizes[j]);
+      // eslint-disable-next-line security/detect-object-injection -- s is loop counter from 1 to maxScaleFactor
       map.renderers[s] = createPool(s, 'tile', minPoolSize, maxPoolSize);
+      // eslint-disable-next-line security/detect-object-injection -- s is loop counter from 1 to maxScaleFactor
       map.renderersStatic[s] = createPool(
         s,
         'static',
@@ -1535,6 +1582,7 @@ export const serve_rendered = {
    * @returns {void}
    */
   remove: function (repo, id) {
+    // eslint-disable-next-line security/detect-object-injection -- id is function parameter for removal
     const item = repo[id];
     if (item) {
       item.map.renderers.forEach((pool) => {
@@ -1544,6 +1592,7 @@ export const serve_rendered = {
         pool.close();
       });
     }
+    // eslint-disable-next-line security/detect-object-injection -- id is function parameter for removal
     delete repo[id];
   },
   /**
@@ -1553,6 +1602,7 @@ export const serve_rendered = {
    */
   clear: function (repo) {
     Object.keys(repo).forEach((id) => {
+      // eslint-disable-next-line security/detect-object-injection -- id is from Object.keys() iteration
       const item = repo[id];
       if (item) {
         item.map.renderers.forEach((pool) => {
@@ -1562,14 +1612,15 @@ export const serve_rendered = {
           pool.close();
         });
       }
+      // eslint-disable-next-line security/detect-object-injection -- id is from Object.keys() iteration
       delete repo[id];
     });
   },
   /**
    * Get the elevation of terrain tile data by rendering it to a canvas image
-   * @param {object} data The background color (or empty string for transparent).
+   * @param {Buffer} data The terrain tile data buffer.
    * @param {object} param Required parameters (coordinates e.g.)
-   * @returns {object}
+   * @returns {Promise<object>} Promise resolving to elevation data
    */
   getTerrainElevation: async function (data, param) {
     return await new Promise(async (resolve, reject) => {

package/src/serve_style.js

@@ -1,7 +1,6 @@
 'use strict';
 
 import path from 'path';
-import fs from 'node:fs';
 
 import clone from 'clone';
 import express from 'express';
@@ -12,10 +11,9 @@ import {
   allowedSpriteFormats,
   fixUrl,
   readFile,
+  isValidHttpUrl,
 } from './utils.js';
 
-const httpTester = /^https?:\/\//i;
-
 export const serve_style = {
   /**
    * Initializes the serve_style module.
@@ -44,12 +42,14 @@ export const serve_style = {
         );
       }
       try {
+        // eslint-disable-next-line security/detect-object-injection -- id is route parameter from URL
         const item = repo[id];
         if (!item) {
           return res.sendStatus(404);
         }
         const styleJSON_ = clone(item.styleJSON);
         for (const name of Object.keys(styleJSON_.sources)) {
+          // eslint-disable-next-line security/detect-object-injection -- name is from Object.keys of style sources
           const source = styleJSON_.sources[name];
           source.url = fixUrl(req, source.url, item.publicUrl);
           if (typeof source.data == 'string') {
@@ -104,6 +104,7 @@ export const serve_style = {
             sanitizedFormat,
           );
         }
+        // eslint-disable-next-line security/detect-object-injection -- id is route parameter from URL
         const item = repo[id];
         const validatedFormat = allowedSpriteFormats(format);
         if (!item || !validatedFormat) {
@@ -187,6 +188,7 @@ export const serve_style = {
    * @returns {void}
    */
   remove: function (repo, id) {
+    // eslint-disable-next-line security/detect-object-injection -- id is function parameter for removal
     delete repo[id];
   },
   /**
@@ -197,8 +199,8 @@ export const serve_style = {
    * @param {string} id ID of the style.
    * @param {object} programOpts - An object containing the program options
    * @param {object} style pre-fetched/read StyleJSON object.
-   * @param {Function} reportTiles Function for reporting tile sources.
-   * @param {Function} reportFont Function for reporting font usage
+   * @param {(dataId: string, protocol: string) => string|undefined} reportTiles Function for reporting tile sources.
+   * @param {(font: string) => void} reportFont Function for reporting font usage
    * @returns {boolean} true if add is successful
    */
   add: function (
@@ -225,6 +227,7 @@ export const serve_style = {
     }
 
     for (const name of Object.keys(styleJSON.sources)) {
+      // eslint-disable-next-line security/detect-object-injection -- name is from Object.keys of style sources
       const source = styleJSON.sources[name];
       let url = source.url;
       if (
@@ -238,6 +241,7 @@ export const serve_style = {
           dataId = dataId.slice(1, -1);
         }
 
+        // eslint-disable-next-line security/detect-object-injection -- dataId is from style source URL, used for mapping lookup
         const mapsTo = (params.mapping || {})[dataId];
         if (mapsTo) {
           dataId = mapsTo;
@@ -276,7 +280,7 @@ export const serve_style = {
     let spritePaths = [];
     if (styleJSON.sprite) {
       if (!Array.isArray(styleJSON.sprite)) {
-        if (!httpTester.test(styleJSON.sprite)) {
+        if (!isValidHttpUrl(styleJSON.sprite)) {
           let spritePath = path.join(
             options.paths.sprites,
             styleJSON.sprite
@@ -291,7 +295,7 @@ export const serve_style = {
         }
       } else {
         for (let spriteItem of styleJSON.sprite) {
-          if (!httpTester.test(spriteItem.url)) {
+          if (!isValidHttpUrl(spriteItem.url)) {
             let spritePath = path.join(
               options.paths.sprites,
               spriteItem.url
@@ -308,10 +312,11 @@ export const serve_style = {
       }
     }
 
-    if (styleJSON.glyphs && !httpTester.test(styleJSON.glyphs)) {
+    if (styleJSON.glyphs && !isValidHttpUrl(styleJSON.glyphs)) {
       styleJSON.glyphs = 'local://fonts/{fontstack}/{range}.pbf';
     }
 
+    // eslint-disable-next-line security/detect-object-injection -- id is from config file style names
     repo[id] = {
       styleJSON,
       spritePaths,