feat(Security): fixes

src/js/logic/digital-sign-pdf-page.ts

@@ -203,8 +203,15 @@ function initializePage(): void {
 
         if (sigImageThumb && sigImagePreview) {
           const url = URL.createObjectURL(file);
-          sigImageThumb.src = url;
-          sigImagePreview.classList.remove('hidden');
+          try {
+            const parsed = new URL(url);
+            if (parsed.protocol === 'blob:') {
+              sigImageThumb.src = parsed.href;
+              sigImagePreview.classList.remove('hidden');
+            }
+          } catch {
+            console.warn('Invalid blob URL for signature preview');
+          }
         }
       }
     });

src/js/logic/form-creator.ts

@@ -19,6 +19,7 @@ type LucideWindow = Window & {
   };
 };
 
+import DOMPurify from 'dompurify';
 import { initializeGlobalShortcuts } from '../utils/shortcuts-init.js';
 import { downloadFile, escapeHtml, hexToRgb } from '../utils/helpers.js';
 import { loadPdfWithPasswordPrompt } from '../utils/password-prompt.js';
@@ -1327,7 +1328,7 @@ function showProperties(field: FormField): void {
         `;
   }
 
-  propertiesPanel.innerHTML = `
+  const propertiesHtml = `
     <div class="space-y-3">
       <div>
         <label class="block text-xs font-semibold text-gray-300 mb-1">Field Name ${field.type === 'radio' ? '(Group Name)' : ''}</label>
@@ -1399,6 +1400,10 @@ function showProperties(field: FormField): void {
     </div>
   `;
 
+  propertiesPanel.innerHTML = DOMPurify.sanitize(propertiesHtml, {
+    ADD_ATTR: ['target'],
+  });
+
   // Common listeners
   const propName = document.getElementById('propName') as HTMLInputElement;
   const nameError = document.getElementById('nameError') as HTMLDivElement;