feat(timestamp): add TSA URL validation and sanitization methods

src/js/workflow/nodes/base-node.ts

@@ -28,4 +28,19 @@ export abstract class BaseWorkflowNode extends ClassicPreset.Node {
       description: this.description,
     };
   }
+
+  sanitizeControlValue(key: string, value: unknown): unknown {
+    const control = this.controls[key];
+    if (!control || typeof control !== 'object' || !('value' in control)) {
+      return value;
+    }
+    const current = (control as { value: unknown }).value;
+    if (current === null || current === undefined) {
+      return value;
+    }
+    if (typeof value !== typeof current) {
+      return current;
+    }
+    return value;
+  }
 }

src/js/workflow/nodes/timestamp-node.ts

@@ -4,7 +4,10 @@ import { pdfSocket } from '../sockets';
 import type { SocketData } from '../types';
 import { requirePdfInput, processBatch } from '../types';
 import { wfError } from '../errors';
-import { TIMESTAMP_TSA_PRESETS } from '../../config/timestamp-tsa.js';
+import {
+  TIMESTAMP_TSA_PRESETS,
+  isAllowedTsaUrl,
+} from '../../config/timestamp-tsa.js';
 import { timestampPdf } from '../../logic/digital-sign-pdf.js';
 import { loadPdfDocument } from '../../utils/load-pdf-document.js';
 
@@ -32,6 +35,14 @@ export class TimestampNode extends BaseWorkflowNode {
     return TIMESTAMP_TSA_PRESETS;
   }
 
+  sanitizeControlValue(key: string, value: unknown): unknown {
+    const sanitized = super.sanitizeControlValue(key, value);
+    if (key === 'tsaUrl' && !isAllowedTsaUrl(sanitized)) {
+      return TIMESTAMP_TSA_PRESETS[0].url;
+    }
+    return sanitized;
+  }
+
   async data(
     inputs: Record<string, SocketData[]>
   ): Promise<Record<string, SocketData>> {

src/js/workflow/serialization.ts

@@ -98,7 +98,10 @@ async function deserializeWorkflow(
     for (const [key, value] of Object.entries(serializedNode.controls || {})) {
       const control = node.controls[key];
       if (control && 'value' in control) {
-        (control as { value: unknown }).value = value;
+        (control as { value: unknown }).value = node.sanitizeControlValue(
+          key,
+          value
+        );
       }
     }