security: add sanitization for custom thread element update

[asvishnyakov]

Summary by cubic

Sanitizes custom thread element updates and deletes to block unsafe fields (path/URL) and prevent arbitrary file reads. Adds tests to verify access control and request forgery protections.

• Bug Fixes
  • Server: sanitize custom element payloads and build elements from safe fields only in update/delete handlers.
  • Tests: added Cypress specs to confirm injected file paths/URLs aren’t readable and forged requests don’t expose element data.
  • Test fixtures: updated data layer to persist elements and normalize suspicious URLs.
  • Utilities: added a WebSocket listener helper to capture Socket.IO “element” events in tests.

^{Written for commit 9d6f99a. Summary will update automatically on new commits.}

[cubic-dev-ai]

1 issue found across 7 files

Prompt for AI agents (all issues)

Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name="cypress/e2e/data_layer/spec.cy.ts">

<violation number="1" location="cypress/e2e/data_layer/spec.cy.ts:297">
P0: Critical test logic bug: URL mismatch makes the assertion meaningless. The request sends `http://example.org/test.txt` but the assertion checks against `http://example.com/test.txt`. These are different domains, so this test will always pass even if the security fix isn&#39;t working.</violation>
</file>

_{Reply to cubic to teach it or ask questions. Re-run a review with @cubic-dev-ai review this PR}