🔒 Validate tile overlay URL templates to require HTTP/HTTPS schemes

darwin/mapkit_flutter/Sources/mapkit_flutter/MapView/MapKitViewHost.swift

@@ -205,6 +205,9 @@ public class MapKitViewHost: NSObject, @preconcurrency MapKitHostApi {
     #endif
 
     func addTileOverlay(overlay overlayData: PlatformTileOverlay) throws {
+        guard overlayData.urlTemplate.hasPrefix("https://") || overlayData.urlTemplate.hasPrefix("http://") else {
+            throw mapKitError("invalid-url-template", "Tile overlay urlTemplate must use https:// or http:// scheme.")
+        }
         let overlay = FlutterTileOverlay(fromPlatform: overlayData)
         if !overlay.id.isEmpty, tileOverlays[overlay.id] != nil {
             try removeTileOverlay(tileOverlayId: overlay.id)

lib/src/mk_tile_overlay.dart

@@ -67,16 +67,22 @@ final class MKTileOverlay {
   /// Creates a new Platform object.
   ///
   /// See: https://developer.apple.com/documentation/mapkit
-  PlatformTileOverlay toPlatform() => PlatformTileOverlay(
-    id: id.value,
-    urlTemplate: urlTemplate,
-    minimumZ: minimumZ,
-    maximumZ: maximumZ,
-    tileSize: tileSize,
-    canReplaceMapContent: canReplaceMapContent,
-    alpha: alpha,
-    level: level,
-  );
+  PlatformTileOverlay toPlatform() {
+    if (!urlTemplate.startsWith('https://') &&
+        !urlTemplate.startsWith('http://')) {
+      throw ArgumentError('urlTemplate must use https:// or http:// scheme');
+    }
+    return PlatformTileOverlay(
+      id: id.value,
+      urlTemplate: urlTemplate,
+      minimumZ: minimumZ,
+      maximumZ: maximumZ,
+      tileSize: tileSize,
+      canReplaceMapContent: canReplaceMapContent,
+      alpha: alpha,
+      level: level,
+    );
+  }
 
   @override
   bool operator ==(Object other) =>

test/mk_tile_overlay_test.dart

@@ -50,6 +50,14 @@ void main() {
         ),
       ).throws<AssertionError>();
     });
+
+    test('rejects invalid url template scheme in toPlatform()', () {
+      const overlay = MKTileOverlay(
+        id: MKTileOverlayId('bad_scheme'),
+        urlTemplate: 'file:///etc/passwd',
+      );
+      check(() => overlay.toPlatform()).throws<ArgumentError>();
+    });
   });
 
   group('equality', () {