fix: reject non-mapping entries under networks and models

loader/loader_test.go

@@ -1572,6 +1572,17 @@ networks:
 	assert.ErrorContains(t, err, "networks.foo: name and external.name conflict; only use name")
 }
 
+func TestLoadNetworkWithInvalidKey(t *testing.T) {
+	_, err := loadYAML(`
+name: load-network-with-invalid-key
+networks:
+  /:
+    driver: bridge
+`)
+
+	assert.ErrorContains(t, err, "networks additional properties '/' not allowed")
+}
+
 func TestLoadNetworkWithName(t *testing.T) {
 	config, err := loadYAML(`
 name: load-network-with-name

loader/tests/models_test.go

@@ -23,8 +23,10 @@ package tests
 // runtime, referencing entries under the top-level `models` key"
 
 import (
+	"context"
 	"testing"
 
+	"github.com/compose-spec/compose-go/v2/loader"
 	"github.com/compose-spec/compose-go/v2/types"
 	"gotest.tools/v3/assert"
 )
@@ -74,3 +76,16 @@ models:
 	assert.Equal(t, p.Jobs["test_mapping"].Models["foo"].EndpointVariable, "MODEL_URL")
 	assert.Equal(t, p.Jobs["test_mapping"].Models["foo"].ModelVariable, "MODEL")
 }
+
+func TestModelsWithInvalidKey(t *testing.T) {
+	_, err := loader.LoadWithContext(context.TODO(), types.ConfigDetails{
+		ConfigFiles: []types.ConfigFile{{Filename: "compose.yml", Content: []byte(`
+name: test
+models:
+  /:
+    model: ai/model
+`)}},
+		Environment: map[string]string{},
+	})
+	assert.ErrorContains(t, err, "models additional properties '/' not allowed")
+}

schema/compose-spec.json

@@ -38,6 +38,7 @@
           "$ref": "#/$defs/model"
         }
       },
+      "additionalProperties": false,
       "description": "Language models that will be used by your application."
     },
     "networks": {
@@ -47,6 +48,7 @@
           "$ref": "#/$defs/network"
         }
       },
+      "additionalProperties": false,
       "description": "Networks that are shared among multiple services."
     },
     "volumes": {

transform/external.go

@@ -27,7 +27,11 @@ func transformMaybeExternal(data any, p tree.Path, ignoreParseError bool) (any,
 	if data == nil {
 		return nil, nil
 	}
-	resource, err := transformMapping(data.(map[string]any), p, ignoreParseError)
+	m, ok := data.(map[string]any)
+	if !ok {
+		return nil, fmt.Errorf("%s: must be a mapping", p)
+	}
+	resource, err := transformMapping(m, p, ignoreParseError)
 	if err != nil {
 		return nil, err
 	}

transform/external_test.go

@@ -68,6 +68,11 @@ func TestExternalLegacy(t *testing.T) {
 	})
 }
 
+func TestExternalNonMapping(t *testing.T) {
+	_, err := transformMaybeExternal(1, tree.NewPath("resources.test"), false)
+	assert.Error(t, err, "resources.test: must be a mapping")
+}
+
 func TestExternalLegacyNamed(t *testing.T) {
 	ssh, err := transformMaybeExternal(map[string]any{
 		"external": map[string]any{