security: block data:image/svg+xml + sandbox HtmlBlock iframes

M-5: safeUrl() blocked javascript:/vbscript:/data:text/html but
allowed data:image/svg+xml, which can execute inline <script>/onload=
when loaded as a document/navigation target despite its "image" MIME
type (defense in depth -- not currently reachable to execution via
this sink, but closing it). Added `data:image/svg+xml` to the existing
DANGEROUS_SCHEME_PREFIXES check, so it's caught after the same
entity-decode/whitespace-strip/lowercase normalization used for the
other blocked schemes (obfuscated variants included). Other
data:image/* types (png/jpeg/gif/webp, ...) remain allowed unchanged.

M-6: HtmlBlock's purifyHtml() allowed <iframe src> through with no
`sandbox` attribute -- a clickjacking/phishing vector even with
DOMPurify already stripping script/on*=. Added a DOMPurify
afterSanitizeAttributes hook, scoped tightly to each purifyHtml() call
(added right before sanitize(), removed in a finally right after) so
it can't leak onto other DOMPurify uses or accumulate duplicates
across repeated calls, that force-sets a restrictive sandbox
(allow-scripts allow-same-origin allow-popups allow-forms -- no
allow-top-navigation) and referrerpolicy=no-referrer on every iframe
that survives sanitization.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

craft/src/utils/escape.test.ts

@@ -71,6 +71,24 @@ describe('safeUrl', () => {
     expect(safeUrl(s)).toBe(s);
   });
 
+  test('M-5: blocks data:image/svg+xml (can execute script when navigated to directly)', () => {
+    expect(safeUrl('data:image/svg+xml,<svg onload=alert(1)>')).toBe('');
+  });
+
+  test('M-5: blocks data:image/svg+xml;base64 variant', () => {
+    expect(safeUrl('data:image/svg+xml;base64,PHN2ZyBvbmxvYWQ9YWxlcnQoMSk+')).toBe('');
+  });
+
+  test('M-5: blocks obfuscated (whitespace/case) data:image/svg+xml', () => {
+    expect(safeUrl('  DATA:IMAGE/SVG+XML,<svg onload=alert(1)>')).toBe('');
+  });
+
+  test('M-5: still allows other data:image/* types unchanged', () => {
+    expect(safeUrl('data:image/jpeg;base64,/9j/4AAQ')).toBe('data:image/jpeg;base64,/9j/4AAQ');
+    expect(safeUrl('data:image/gif;base64,R0lGOD')).toBe('data:image/gif;base64,R0lGOD');
+    expect(safeUrl('data:image/webp;base64,UklGR')).toBe('data:image/webp;base64,UklGR');
+  });
+
   test.each([
     'https://x.com/a?b=1&c=2',
     'http://x',

craft/src/utils/escape.ts

@@ -36,7 +36,14 @@ export function escapeAttr(s: string): string {
 // Dangerous scheme prefixes, checked against a normalized copy with all
 // colons removed (see safeUrl) so that colon-splicing obfuscation like
 // "java:script:alert(1)" can't slip past a literal "javascript:" check.
-const DANGEROUS_SCHEME_PREFIXES = ['javascript', 'vbscript', 'datatext/html'];
+// M-5: `data:image/svg+xml` is blocked alongside `data:text/html` -- an SVG
+// document can carry an inline <script>/onload= just like an HTML document,
+// so it executes script when loaded as a document/navigation target (e.g. an
+// <a href> or window.open), even though it's nominally an "image" MIME type.
+// Other `data:image/*` types (png/jpeg/gif/webp, ...) stay allowed below --
+// only this specific scriptable subtype is blocked, regardless of a
+// trailing `;base64` or other parameters.
+const DANGEROUS_SCHEME_PREFIXES = ['javascript', 'vbscript', 'datatext/html', 'dataimage/svg+xml'];
 
 /** Decodes &#NN; and &#xNN; numeric HTML entities (used to obfuscate scheme names). */
 function decodeNumericEntities(s: string): string {