fix(custom-blocks): restrict iconUrl to https or internal serve paths

[TheodoreSpeaks]

Summary

• follow-up to feat(custom-blocks): add deploy_custom_block copilot tool #5532 (merged before this landed): iconUrl on the custom-block publish/update contracts now accepts only https URLs or internal /api/files/serve/ paths — no data:/blob:/other schemes in org-wide block metadata rendered as <img> sources
• same check in the copilot deploy_custom_block handler's pass-through branch (workspace files/... ingestion already validated type/size)
• addresses the P2 review finding; the underlying exposure predates the tool (REST accepted arbitrary strings) and was advisory-only in practice (img@src is a non-scripting sink, CSP already allows data:), so this is hardening, not an exploit fix

Companion: simstudioai/mothership#350

Type of Change

• Bug fix

Testing

32 handler tests incl. new scheme rejection/acceptance cases; lint and check:api-validation:strict pass.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Jul 12, 2026 1:36am

[github-actions]

⚠️ Cross-repo companion check

One or more companion PRs aren't merged into staging yet. Merging this without them will leave copilot and sim out of sync — merge them in lockstep.

• ❌ simstudioai/mothership#350 — OPEN, not merged (targets staging) — improvement(deploy-custom-block): document https-only external icon URLs

[cursor]

PR Summary

Low Risk
Defensive input validation on shared metadata rendered as img src; no auth or data-model changes, with tests for allowed and rejected schemes.

Overview
Custom block iconUrl is now validated on publish/update so org-wide block metadata used as <img> sources cannot store arbitrary schemes (data:, blob:, plain http:, etc.).

A shared isAllowedCustomBlockIconUrl helper (only https:// or /api/files/serve/) backs new Zod iconUrlSchema on the REST publish/update contracts. The copilot deploy_custom_block pass-through path applies the same rule before accepting external URLs; workspace files/... ingestion is unchanged.

Tests cover rejection of data: and http: URLs and acceptance of internal serve paths.

^{Reviewed by Cursor Bugbot for commit 912bdf2. Bugbot is set up for automated code reviews on this repo. Configure here.}

[greptile-apps]

Greptile Summary

This PR tightens custom-block icon URL validation. The main changes are:

• Added a shared helper for allowed custom-block icon URLs.
• Applied the helper to publish and update API contract schemas.
• Added the same check to the copilot deploy handler pass-through path.
• Added tests for rejected schemes and accepted internal serve paths.

Confidence Score: 5/5

This looks safe to merge after a small tool-contract cleanup.

• The API validation and handler checks match the intended URL restriction.
• The remaining issue is a stale agent-facing description that can make the deploy tool reject inputs it still describes as valid.

apps/sim/lib/copilot/tools/handlers/deployment/custom-block.ts

Important Files Changed

Filename	Overview
apps/sim/lib/api/contracts/custom-blocks.ts	Adds the shared icon URL allowlist and applies it to publish/update request validation.
apps/sim/lib/copilot/tools/handlers/deployment/custom-block.ts	Validates pass-through iconUrl values before deploy, but the agent-facing contract still describes broader external URL support.
apps/sim/lib/copilot/tools/handlers/deployment/custom-block.test.ts	Adds handler coverage for rejecting data/http URLs and accepting internal serve paths.

_{Reviews (1): Last reviewed commit: "fix(custom-blocks): restrict iconUrl to ..." | Re-trigger Greptile}