v4.0.2

.gitignore

@@ -3,3 +3,4 @@ dist
 *.log
 node_modules
 index.d.ts
+tile-cache

bench/bench-tiles.js

@@ -1,18 +1,23 @@
 
-import runStats from 'tile-stats-runner';
-import {readTile, writeTile} from './vector_tile.js';
+import {createHash} from 'crypto';
+import {mkdirSync, existsSync, readFileSync, writeFileSync} from 'fs';
+import {join, dirname} from 'path';
+import {fileURLToPath} from 'url';
+import {readTile, writeTile} from '../test/fixtures/vector_tile.js';
 import Pbf from '../index.js';
 
-const ids = 'mapbox.mapbox-streets-v7';
-const token = 'pk.eyJ1IjoicmVkdWNlciIsImEiOiJrS3k2czVJIn0.CjwU0V9fO4FAf3ukyV4eqQ';
-const url = `https://b.tiles.mapbox.com/v4/${ids}/{z}/{x}/{y}.vector.pbf?access_token=${  token}`;
+const token = process.env.ACCESS_TOKEN;
+if (!token) throw new Error('Missing ACCESS_TOKEN environment variable (Mapbox access token).');
+
+const tilesetId = 'mapbox.mapbox-streets-v8';
+const url = `https://api.mapbox.com/v4/${tilesetId}/{z}/{x}/{y}.mvt?access_token=${token}`;
 
 let readTime = 0;
 let writeTime = 0;
 let size = 0;
 let numTiles = 0;
 
-runStats(url, processTile, showStats, {
+await runStats(url, processTile, showStats, {
     width: 2880,
     height: 1800,
     minZoom: 0,
@@ -21,6 +26,7 @@ runStats(url, processTile, showStats, {
 });
 
 function processTile(body) {
+    if (!body) return;
     size += body.length;
     numTiles++;
 
@@ -53,3 +59,71 @@ function clock(start) {
     return t[0] * 1e3 + t[1] * 1e-6;
 }
 
+async function runStats(urlTemplate, onTile, onDone, options) {
+    const cacheRoot = join(dirname(fileURLToPath(import.meta.url)), 'tile-cache');
+    const cachePath = join(cacheRoot, createHash('sha1').update(urlTemplate).digest('hex').slice(0, 8));
+    mkdirSync(cachePath, {recursive: true});
+
+    const tilePromises = [];
+
+    for (let z = options.minZoom; z <= options.maxZoom; z++) {
+        const p = pointToTileFraction(options.center[0], options.center[1], z);
+        const z2 = 2 ** z;
+
+        const minX = Math.max(Math.floor(p[0] - 0.5 * options.width / 512), 0);
+        const minY = Math.max(Math.floor(p[1] - 0.5 * options.height / 512), 0);
+        const maxX = Math.min(Math.floor(p[0] + 0.5 * options.width / 512), z2 - 1);
+        const maxY = Math.min(Math.floor(p[1] + 0.5 * options.height / 512), z2 - 1);
+
+        for (let x = minX; x <= maxX; x++) {
+            for (let y = minY; y <= maxY; y++) {
+                tilePromises.push(loadTile(z, x, y, urlTemplate, cachePath));
+            }
+        }
+    }
+
+    const tiles = await Promise.all(tilePromises);
+    for (const tile of tiles) onTile(tile);
+
+    process.stderr.write('\n');
+    onDone();
+}
+
+async function loadTile(z, x, y, urlTemplate, cachePath) {
+    const tilePath = join(cachePath, `${z}-${x}-${y}`);
+
+    if (existsSync(tilePath)) {
+        process.stderr.write('.');
+        return readFileSync(tilePath);
+    }
+
+    const tileUrl = urlTemplate
+        .replace('{x}', x)
+        .replace('{y}', y)
+        .replace('{z}', z);
+
+    const response = await fetch(tileUrl);
+
+    if (response.status === 200) {
+        const data = Buffer.from(await response.arrayBuffer());
+        writeFileSync(tilePath, data);
+        process.stderr.write('+');
+        return data;
+    }
+    if (response.status === 404) {
+        process.stderr.write('_');
+        return null;
+    }
+
+    throw new Error(`${response.status} ${tileUrl}`);
+}
+
+function pointToTileFraction(lon, lat, z) {
+    const sin = Math.sin(lat * Math.PI / 180);
+    const z2 = 2 ** z;
+    let x = z2 * (lon / 360 + 0.5);
+    const y = z2 * (0.5 - 0.25 * Math.log((1 + sin) / (1 - sin)) / Math.PI);
+    x = x % z2;
+    if (x < 0) x += z2;
+    return [x, y, z];
+}

compile.js

@@ -1,3 +1,4 @@
+/* eslint @stylistic/indent: 0 */
 
 import {readFileSync} from 'fs';
 
@@ -265,13 +266,24 @@ function getMapMessage(field) {
     };
 }
 
+// Protobuf identifier per spec: starts with a letter or underscore, followed by letters, digits, or underscores.
+// Validated to prevent code injection via untrusted .proto schemas, since names are interpolated into generated JS.
+const identifierRegex = /^[A-Za-z_][A-Za-z0-9_]*$/;
+
+function validateIdentifier(name) {
+    if (typeof name !== 'string' || !identifierRegex.test(name)) {
+        throw new Error(`Invalid protobuf identifier: ${JSON.stringify(name)}`);
+    }
+}
+
 function buildContext(proto, parent) {
     const obj = Object.create(parent);
     obj._proto = proto;
     obj._children = [];
     obj._defaults = {};
 
     if (parent) {
+        validateIdentifier(proto.name);
         parent[proto.name] = obj;
 
         if (parent._name) {
@@ -281,6 +293,18 @@ function buildContext(proto, parent) {
         }
     }
 
+    if (proto.fields) {
+        for (const field of proto.fields) {
+            validateIdentifier(field.name);
+            if (field.oneof) validateIdentifier(field.oneof);
+        }
+    }
+    if (proto.values) {
+        for (const valueName of Object.keys(proto.values)) {
+            validateIdentifier(valueName);
+        }
+    }
+
     for (let i = 0; proto.enums && i < proto.enums.length; i++) {
         obj._children.push(buildContext(proto.enums[i], obj));
     }

eslint.config.js

@@ -13,9 +13,9 @@ export default [
         files: ['test/fixtures/*.js'],
         rules: {
             camelcase: 0,
-            '@stylistic/js/quotes': 0,
-            '@stylistic/js/semi': 0,
-            '@stylistic/js/brace-style': 0,
+            '@stylistic/quotes': 0,
+            '@stylistic/semi': 0,
+            '@stylistic/brace-style': 0,
             'no-unused-vars': 0
         }
     }