Validate import api for potential prototype pollution

GitOrigin-RevId: 326092937e4e1e8a163c1d2a7ae660ea6692a21d

Author: dcoj

src/style-spec/validate/validate_import.ts

@@ -43,11 +43,11 @@ export default function validateImport(options: ImportValidatorOptions): Validat
         errors.push(new ValidationError(key, importSpec, `import id can't be an empty string`));
     }
 
-    // Reject reserved prototype-pollution key — the import id is used as a scope
-    // string that becomes a dictionary key in several runtime caches.
-    if (unbundle(importSpec.id) === '__proto__') {
+    // Reject reserved prototype-pollution keys
+    const importId = unbundle(importSpec.id);
+    if (importId === '__proto__' || importId === 'constructor' || importId === 'prototype') {
         const key = `${options.key}.id`;
-        errors.push(new ValidationError(key, importSpec, `import id can't be "__proto__"`));
+        errors.push(new ValidationError(key, importSpec, `import id can't be "${String(importId)}"`));
     }
 
     if (data) {

src/style/style.ts

@@ -4634,6 +4634,12 @@ class Style extends Evented<MapEvents> {
     addImport(importSpec: ImportSpecification, beforeId?: string | null): Promise<void> {
         this._checkLoaded();
 
+        const reservedImportIds = new Set(['__proto__', 'constructor', 'prototype']);
+        if (reservedImportIds.has(importSpec.id)) {
+            this.fire(new ErrorEvent(new Error(`Import id can't be "${importSpec.id}".`)));
+            return;
+        }
+
         const imports = this.stylesheet.imports = this.stylesheet.imports || [];
 
         const index = imports.findIndex(({id}) => id === importSpec.id);

src/style/style_changes.ts

@@ -27,13 +27,13 @@ class StyleChanges {
     constructor() {
         this._changed = false;
 
-        this._updatedLayers = {};
-        this._removedLayers = {};
+        this._updatedLayers = Object.create(null) as typeof this._updatedLayers;
+        this._removedLayers = Object.create(null) as typeof this._removedLayers;
 
-        this._updatedSourceCaches = {};
+        this._updatedSourceCaches = Object.create(null) as typeof this._updatedSourceCaches;
         this._updatedPaintProps = new Set();
 
-        this._updatedImages = {};
+        this._updatedImages = Object.create(null) as typeof this._updatedImages;
     }
 
     isDirty(): boolean {
@@ -173,13 +173,13 @@ class StyleChanges {
     reset() {
         this._changed = false;
 
-        this._updatedLayers = {};
-        this._removedLayers = {};
+        this._updatedLayers = Object.create(null) as typeof this._updatedLayers;
+        this._removedLayers = Object.create(null) as typeof this._removedLayers;
 
-        this._updatedSourceCaches = {};
+        this._updatedSourceCaches = Object.create(null) as typeof this._updatedSourceCaches;
         this._updatedPaintProps.clear();
 
-        this._updatedImages = {};
+        this._updatedImages = Object.create(null) as typeof this._updatedImages;
     }
 }
 

src/ui/map.ts

@@ -2467,6 +2467,12 @@ export class Map extends Camera {
             return false;
         }
 
+        // Disallow reserved prototype property names
+        if (id === '__proto__' || id === 'constructor' || id === 'prototype') {
+            this.fire(new ErrorEvent(new Error(`IDs can't be "${id}".`)));
+            return false;
+        }
+
         return true;
     }
 
@@ -3175,6 +3181,10 @@ export class Map extends Camera {
      * }, 'basemap');
      */
     addImport(importSpecification: ImportSpecification, beforeId?: string | null): this {
+        if (!this._isValidId(importSpecification.id)) {
+            return this;
+        }
+
         this.style.addImport(importSpecification, beforeId)
             // eslint-disable-next-line @typescript-eslint/no-unsafe-argument
             .catch((e) => this.fire(new ErrorEvent(new Error('Failed to add import', e))));

test/unit/style/style_imports.test.ts

@@ -779,6 +779,42 @@ describe('Style#addImport', () => {
             'streets-v2'
         ]);
     });
+
+    test('rejects "__proto__" import id to prevent prototype pollution', async () => {
+        const {style} = newStubStyle();
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-argument
+        style.loadJSON(createStyleJSON());
+        await waitFor(style, 'style.load');
+
+        const errorSpy = vi.fn();
+        style.on('error', errorSpy);
+
+        // addImport fires an error event and returns early without mutating state
+        style.addImport({id: '__proto__', url: '/style.json'});
+
+        expect(errorSpy).toHaveBeenCalledOnce();
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access
+        expect(errorSpy.mock.calls[0][0].error.message).toMatch('__proto__');
+        // Must not have added the import and must not have polluted Object.prototype
+        expect(style.stylesheet.imports ?? []).toHaveLength(0);
+        expect(Object.hasOwn({}, 0)).toBe(false);
+    });
+
+    test('rejects "constructor" and "prototype" import ids to prevent prototype pollution', async () => {
+        const {style} = newStubStyle();
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-argument
+        style.loadJSON(createStyleJSON());
+        await waitFor(style, 'style.load');
+
+        const errorSpy = vi.fn();
+        style.on('error', errorSpy);
+
+        style.addImport({id: 'constructor', url: '/style.json'});
+        style.addImport({id: 'prototype', url: '/style.json'});
+
+        expect(errorSpy).toHaveBeenCalledTimes(2);
+        expect(style.stylesheet.imports ?? []).toHaveLength(0);
+    });
 });
 
 describe('Style#updateImport', () => {