harden: add output encoding in main.js

[anupamme]

Summary

Harden input handling in src/cssfontface/main.js (flagged by multi_agent_ai).

Vulnerability

Field	Value
ID	V-001
Severity	HIGH
Scanner	multi_agent_ai
Rule	V-001
File	src/cssfontface/main.js:118
Assessment	Defensive hardening
CWE	CWE-79

Description: The application fetches a binary payload from a URL stored in sessionStorage without validation. The fetched binary is then loaded and executed via load_bin(). If an attacker can write to sessionStorage (e.g., via XSS), they can redirect the fetch to a malicious URL, causing arbitrary code execution on the PS4 kernel.

Threat Model Context

This is a Node.js library - vulnerabilities affect downstream consumers who use this package.

Changes

• src/cssfontface/main.js

Behavior Preservation

The change is scoped to 1 file on the vulnerable path; it only tightens handling of untrusted input and leaves valid inputs unaffected.

---

This patch removes an exploit primitive — a code pattern that, while not independently exploitable today, could be chained with other weaknesses by automated exploit-development tooling. Proactive removal of such primitives raises the bar against increasingly capable automated attack tools.

---

Automated security fix by OrbisAI Security