fix(security): restrict image element source URLs to HTTP and HTTPS protocols

src/components/studio/views/chat-subcomponents.tsx

@@ -283,7 +283,7 @@ export const MessageList = ({
                       )
                     },
                     img: ({ src, alt }) => {
-                      const safeSrc = typeof src === 'string' && src ? sanitizeUrl(src) : ''
+                      const safeSrc = typeof src === 'string' && src ? sanitizeUrl(src, ['http:', 'https:']) : ''
                       if (!safeSrc) return null
                       return <img src={safeSrc} alt={alt ?? ''} />
                     },

src/components/studio/views/editor-preview.tsx

@@ -45,6 +45,11 @@ export const EditorPreview = ({ content }: { content: string }) => (
             </a>
           )
         },
+        img: ({ src, alt }) => {
+          const safeSrc = typeof src === 'string' && src ? sanitizeUrl(src, ['http:', 'https:']) : ''
+          if (!safeSrc) return null
+          return <img src={safeSrc} alt={alt ?? ''} />
+        },
       }}
     >
       {content || '_Nothing to preview._'}

src/lib/security.test.ts

@@ -84,6 +84,14 @@ describe('sanitizeUrl', () => {
     expect(sanitizeUrl('https://example.com', ['ftp'])).toBe('')
   })
 
+  it('restricts image source protocols when explicit http/https allowlist is passed', () => {
+    const imageProtocols = ['http:', 'https:']
+    expect(sanitizeUrl('https://example.com/image.png', imageProtocols)).toBe('https://example.com/image.png')
+    expect(sanitizeUrl('http://example.com/image.png', imageProtocols)).toBe('http://example.com/image.png')
+    expect(sanitizeUrl('mailto:user@example.com', imageProtocols)).toBe('')
+    expect(sanitizeUrl('tel:+1234567890', imageProtocols)).toBe('')
+  })
+
   it('strips ASCII control characters and neutralizes obfuscated scheme payloads', () => {
     expect(sanitizeUrl('/dashboard\x00path')).toBe('/dashboardpath')
     expect(sanitizeUrl('/docs\x09setup')).toBe('/docssetup')