Fix security issues found in review

[PatAltimore]

Security review of the application surfaced five issues; this PR fixes all of them.

Findings & fixes

1. DOM-XSS via javascript:/data: URLs (Medium/High) — escapeAttr only quote-escaped URL attributes, never validated the scheme. Content is LLM-generated from untrusted GitHub/Wikipedia sources, so a javascript: URL could become stored XSS. Added a safeUrl() helper (strips control-char/whitespace obfuscation, allowlists http/https/mailto + relative/hash links) and wrapped all six URL sinks (image_url ×2, wikipedia_url, github_url ×2, summary link).

2. Unescaped year interpolation (Low) — wrapped the three raw ${...year} sinks in escapeHtml() (the YAML parser can return a non-numeric string).

3. CDN scripts without SRI (Medium, supply chain) — added integrity (sha384) + crossorigin to all four jsdelivr highlight.js scripts.

4. Missing security headers (Low) — added Content-Security-Policy, X-Content-Type-Options: nosniff, and X-Frame-Options: DENY to staticwebapp.config.json.

5. Generator path traversal (Low) — Checkpointer.path_for now validates slugs against ^[a-z0-9][a-z0-9-]*$ and asserts the resolved path stays under the output root.

Verification

• node --check on app.js, JSON parse of the SWA config, and slug-compliance check all pass.
• safeUrl() unit-tested against javascript:, java\tscript:, leading-space, data:, vbscript: (all blocked) and valid http/hash/relative URLs (all pass).

Notes

• CSP keeps 'unsafe-inline' in script-src because the SPA uses inline onclick= handlers, so CSP alone wouldn't block javascript: URIs — that's why Add assembly code stepper/simulator #1 fixes it at the source. Refactoring handlers to addEventListener later would allow dropping 'unsafe-inline'.
• CSP/SRI failures only surface at runtime in the browser — worth a quick smoke test of the preview (images load, highlighting applies, theme/font buttons work) before merge.

🤖 Generated with Claude Code

[github-actions]

Azure Static Web Apps: Your stage site is ready! Visit it here: https://blue-rock-0e6a0831e-20.westus2.7.azurestaticapps.net