- Validate data URL format (must start with data:image/png)
- Validate PNG magic bytes on binary data before sending
- Enforce 2MB size limit matching server
- Add try/catch around atob() to handle invalid base64 gracefully
- Fix XSS vulnerability in editor download: replace unsafe window.open()+document.write()
with safe anchor-based download that also validates data URL scheme
- add ClickUserMessageComposer and outgoing header wiring\n- send the user click packet from RoomObjectEventHandler for avatar single clicks\n- support wf_trg_click_user in the linked Nitro UI/emulator flow
Lorenzune