fix(web): block SVG from media relay

[zapabob]

Summary

• stop /api/media from relaying SVG files as image data URLs
• keep raster image and icon relay behavior unchanged
• add a regression test alongside the existing media-root and auth checks

Security impact

The media relay is intended for gateway-local generated media. SVG is active content in several browser contexts, so this endpoint now serves inert raster/icon formats only.

Tests

• uv run --with pytest python -m pytest -o addopts='' tests/hermes_cli/test_web_server.py -k get_media
• python -m py_compile hermes_cli/web_server.py

[liuhao1024]

Verification: SVG removed from media relay allowlist

Confirmed the security rationale and the fix:

The risk: SVG files can embed <script> tags, event handlers (onload, onerror), and external entity references — serving them through the media relay as image/svg+xml opens XSS and SSRF vectors in any browser context that renders them.

The fix: Removes ".svg": "image/svg+xml" from _MEDIA_CONTENT_TYPES in web_server.py. Any .svg request now falls through to the existing 415 rejection for unsupported extensions.

Test: Verifies that requesting an .svg file returns HTTP 415. The test creates a file with embedded <script>alert(1)</script> to demonstrate the exact XSS vector being blocked.

Clean, minimal, correct. No false positives — legitimate SVG use cases (e.g., icon libraries) don't need server-side media relay.

[teknium1]

Thanks for the focused security hardening. Current main still maps .svg to image/svg+xml in hermes_cli/web_server.py:1260; get_media() accepts that allowlist entry at hermes_cli/web_server.py:1579 and returns its bytes as a data URL at hermes_cli/web_server.py:1592. Removing the entry routes SVG through the existing 415 rejection, while retaining the raster and icon entries.

The linked maintainer comment on #2690 explicitly identifies this media-relay scope as the intended narrow SVG mitigation, while preserving SVG support in the vision path. The added regression test is appropriately colocated with the existing /api/media authorization and allowlist tests.

Automated hermes-sweeper review.