security: add CSP, URL scheme validation, and promptId sanitization

- Add Content-Security-Policy meta tag restricting scripts, images, and
  connections to self, ComfyUI localhost, and Tailscale origins
- Validate URL scheme in setServerUrl() to reject non-http(s) protocols
- Sanitize promptId with encodeURIComponent in /history/ URL path

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: Geoff Smith

index.html

@@ -4,6 +4,16 @@
     <meta charset="UTF-8" />
     <link rel="icon" type="image/svg+xml" href="/vite.svg" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <meta http-equiv="Content-Security-Policy" content="
+      default-src 'self';
+      script-src 'self';
+      style-src 'self' 'unsafe-inline';
+      img-src 'self' blob: data: http://127.0.0.1:8188 https://*.ts.net;
+      connect-src 'self' http://127.0.0.1:8188 ws://127.0.0.1:8188 https://*.ts.net wss://*.ts.net;
+      font-src 'self';
+      object-src 'none';
+      base-uri 'self';
+    " />
     <title>ComfyUI Web Interface</title>
   </head>
   <body>

src/services/comfyui-api.js

@@ -51,7 +51,7 @@ export async function queuePrompt(workflow, clientId) {
  */
 export async function getHistory(promptId) {
   try {
-    const response = await fetch(`${getApiBase()}/history/${promptId}`);
+    const response = await fetch(`${getApiBase()}/history/${encodeURIComponent(promptId)}`);
 
     if (!response.ok) {
       throw new Error(`HTTP error! status: ${response.status}`);

src/utils/constants.js

@@ -21,6 +21,9 @@ export function getServerUrl() {
 
 export function setServerUrl(url) {
   const normalized = normalizeUrl(url);
+  if (!/^https?:\/\//.test(normalized)) {
+    throw new Error('Server URL must use http:// or https:// scheme');
+  }
   if (normalized === DEFAULT_SERVER) {
     localStorage.removeItem(LS_KEY);
   } else {