fix(server): sandbox user-provided SVGs

[t3dotgg]

User-provided SVGs are served from signed URLs on the app origin. Opening one directly could run active SVG content with access to that origin.

This adds a restrictive Content Security Policy to SVG asset responses. Inline SVG styles still render, while scripts, external loads, and same-origin access are blocked. Raster asset responses are unchanged.

Tests: vp test run apps/server/src/http.test.ts

Made with GPT-5.6 using the Codex harness in T3 Code.

---

Note

Medium Risk
Targets a real XSS/origin-abuse vector on user content, but the change is limited to response headers on the asset route and is covered by unit tests.

Overview
User-uploaded SVGs served from signed asset URLs now get a restrictive Content-Security-Policy so opening them directly cannot run scripts or access the app origin.

A shared assetResponseHeaders helper centralizes asset response headers: .svg paths (case-insensitive) add default-src 'none'; style-src 'unsafe-inline'; sandbox on top of existing private cache and nosniff. Raster and other assets keep the same headers as before, with no CSP.

The signed asset GET route uses this helper instead of inline header objects. Tests cover SVG vs PNG behavior.

^{Reviewed by Cursor Bugbot for commit 457efa6. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Add CSP sandbox header to SVG assets served by the asset route

Adds a Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox header to responses for .svg files (case-insensitive) to prevent script execution in user-provided SVGs. Header logic is centralized in a new exported assetResponseHeaders function in http.ts. Non-SVG assets continue to receive only Cache-Control and X-Content-Type-Options headers.

^{Macroscope summarized 457efa6.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 31e48ec0-68e5-4c41-88ce-83bb7b77ebc4

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	11.3 KiB	11.3 KiB	+4 B (+0.0%)	15.1 KiB	✅
Codex	Thread snapshot wire	5.5 KiB	5.5 KiB	−8 B (−0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	5.9 KiB	5.9 KiB	+12 B (+0.2%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	49.7 KiB	49.7 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	16	16	0 (0.0%)	21	✅
Claude	Total thread wire	11.3 KiB	11.3 KiB	+9 B (+0.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	5.5 KiB	5.5 KiB	+4 B (+0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	5.8 KiB	5.9 KiB	+5 B (+0.1%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	50.6 KiB	50.6 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	16	16	0 (0.0%)	21	✅

Baseline: 0d38866 · PR result: 457efa6 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 94.6 KiB
• Claude decoded thread snapshot: 95.4 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

Approvability

Verdict: Approved 457efa6

This PR adds standard security hardening by sandboxing user-provided SVG files with restrictive CSP headers to prevent XSS attacks. The change is small, well-tested, and follows established security best practices for handling untrusted SVG content.

^{You can customize Macroscope's approvability policy. Learn more.}