fix(frontend): XSS hardening — SVG sanitization, iframe sandbox, workspace CSP (WS1)

[jeremyeder]

Summary

• SEC-2sl.1.1 (HIGH): Replace dangerouslySetInnerHTML SVG rendering in file-content-viewer.tsx with a new SvgBlobImage component that creates a blob URL and renders via <img>. Blob URLs are opaque to the browser's script engine, so embedded <script>, onload, and <foreignObject> payloads cannot execute.
• SEC-2sl.1.2 (HIGH): Remove allow-same-origin from the iframe sandbox attribute in the HTML viewer tab. Keeping only allow-scripts prevents sandboxed content from escaping the sandbox and accessing parent-origin storage, cookies, or DOM.
• SEC-2sl.1.3 (MEDIUM): Add Content-Security-Policy: sandbox; script-src 'none' response header in the workspace file route for HTML, HTM, and SVG extensions. This neutralizes stored XSS from workspace files served on the same origin without changing Content-Type or inline display behaviour.

Files changed

• components/frontend/src/components/file-content-viewer.tsx
• components/frontend/src/app/api/projects/[name]/agentic-sessions/[sessionName]/workspace/[...path]/route.ts

Test plan

• Upload an SVG with <script>alert(1)</script> to a workspace; confirm it renders as an image with no alert.
• Open an HTML workspace file in the viewer; confirm JS executes in isolation (alert pops inside the frame if allow-scripts is present) but has no access to window.parent or document.cookie of the app.
• Fetch an .html or .svg workspace file directly via the API route; confirm the Content-Security-Policy response header is present with value sandbox; script-src 'none'.
• Fetch a .png workspace file; confirm no CSP header is added.
• Confirm no TypeScript any types were introduced (checked via convention grep).

🤖 Generated with Claude Code

[coderabbitai]

Caution

Review failed

The head commit changed during the review from bace3a8 to 127d412.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/xss-hardening-ws1

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch fix/xss-hardening-ws1

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[netlify]

✅ Deploy Preview for cheerful-kitten-f556a0 canceled.

Name	Link
🔨 Latest commit	82b614f
🔍 Latest deploy log	https://app.netlify.com/projects/cheerful-kitten-f556a0/deploys/69e976fe488a2c000875a9ac