fix: prevent path traversal in style and tileset tool URL construction

[zmofei]

Summary

Five MCP tools concatenated user-supplied path parameters directly into Mapbox API URLs without input validation or URL encoding. Because Node.js fetch uses the WHATWG URL parser, ../ sequences in a styleId or tilesetId input were normalized client-side before the request was sent — allowing the request to reach unintended API endpoints.

This PR applies a two-layer defense, hardens output schema validation across all affected tools, and adds two additional security fixes discovered during review.

Changes

Input validation — allowlist regex on all path parameters

• Add src/tools/shared/styleId.schema.ts — shared Zod schema with regex /^[a-z0-9][a-z0-9-]*[a-z0-9]$/, which accepts both user-owned style IDs and built-in Mapbox style names (standard, streets-v12, navigation-day-v1, etc.) while rejecting path separators, dots, percent-encoded sequences, and null bytes
• Apply styleIdSchema to DeleteStyleTool, PreviewStyleTool, RetrieveStyleTool, and UpdateStyleTool input schemas via the shared module
• Add format validation to TilequeryTool tilesetId input: /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/ (enforces owner.tileset-name format)

URL encoding — encodeURIComponent at every construction site

Wrap both username (extracted from JWT) and styleId/tilesetId in encodeURIComponent at every URL construction site across all five tools. This encodes / → %2F, preventing any remaining path segments from being interpreted as directory traversal by the URL parser.

Affected files: DeleteStyleTool.ts, PreviewStyleTool.ts (URL + resource URI), RetrieveStyleTool.ts, TilequeryTool.ts, UpdateStyleTool.ts

Output schema validation — hard-fail on mismatch

Replace the previous silent fallback behavior (returning raw unvalidated API responses) with explicit isError: true responses when the API response does not match the declared output schema. This prevents unintended API responses from being forwarded to callers.

Applied to: RetrieveStyleTool, UpdateStyleTool, TilequeryTool, ListStylesTool, ListTokensTool, CreateTokenTool

Remove now-unused BaseTool.validateOutput() method.

Cross-origin Link header rejection (ListTokensTool)

ListTokensTool auto-paginates by following the Link: rel=next response header. Without origin validation, a malicious or compromised response could redirect pagination to an attacker-controlled host and exfiltrate the access token via the appended access_token query parameter.

Added origin validation: next-page URLs whose origin does not match the configured API endpoint are rejected with a warning log. Pagination stops rather than following a cross-origin redirect.

Token redaction from logs and error messages

Added redactToken() utility that strips access_token=... query parameter values from strings before they reach log output or MCP client error responses. Network errors (DNS failure, timeout) from Node.js include the full request URL in their message — without redaction, the access token would be forwarded to callers in error responses.

Applied to: catch-block error messages in MapboxApiBasedTool.run(), debug-level URL log in ListTokensTool.

Tests

• Add test/security/path-traversal.test.ts with 52 tests covering schema rejection, valid ID acceptance, URL encoding, and response schema mismatch behavior
• Add cross-origin Link header rejection test in ListTokensTool.test.ts
• Fix test assertions for Prettier 3.8.x import formatting, Zod v4 error codes, and @mcp-ui/server v6.1.0 mimeType changes

Test plan

• npm test passes (576/576)
• npx tsc --noEmit — zero errors
• npx vitest run test/security/path-traversal.test.ts — 52/52 pass