fix: add null guards to DrawingCanvas and restrict image proxy to AoPS domains

DrawingCanvas: guard ctx in draw(), handleMouseDown(), resizeCanvas(), and
effect to prevent crashes when canvas events fire before initialization.

Worker: restrict image proxy to artofproblemsolving.com domains only,
preventing SSRF via the open proxy endpoint.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: andrewboldi

src/lib/components/DrawingCanvas.svelte

@@ -33,7 +33,7 @@
 	];
 
 	function resizeCanvas() {
-		if (!canvas || !visible) return;
+		if (!canvas || !visible || !ctx) return;
 		const body = document.body;
 		const html = document.documentElement;
 		height = Math.max(body.scrollHeight, body.offsetHeight, html.clientHeight, html.scrollHeight, html.offsetHeight);
@@ -50,13 +50,14 @@
 		if (visible && canvas) {
 			ctx = canvas.getContext('2d')!;
 			resizeCanvas();
-			if (undoStack.length === 0) {
+			if (ctx && undoStack.length === 0) {
 				undoStack.push(ctx.getImageData(0, 0, width, height));
 			}
 		}
 	});
 
 	function draw() {
+		if (!ctx) return;
 		ctx.beginPath();
 		ctx.moveTo(prevX, prevY);
 		if (tool === 'eraser') {
@@ -78,6 +79,7 @@
 	}
 
 	function handleMouseDown(e: MouseEvent) {
+		if (!ctx) return;
 		prevX = currX;
 		prevY = currY;
 		currX = e.clientX - canvas.offsetLeft;

worker/src/worker.ts

@@ -255,11 +255,21 @@ async function handleIngest(request: Request, env: Env): Promise<Response> {
 }
 
 /** Legacy image proxy — forwards requests to external URLs (AoPS diagrams, etc.) */
+const ALLOWED_PROXY_HOSTS = ['latex.artofproblemsolving.com', 'artofproblemsolving.com', 'wiki-images.artofproblemsolving.com'];
+
 async function handleImageProxy(url: URL, request: Request): Promise<Response> {
 	const targetUrl = decodeURIComponent(url.search.slice(1));
 	if (!targetUrl.startsWith('https://')) {
 		return error('Invalid proxy URL', 400);
 	}
+	try {
+		const parsed = new URL(targetUrl);
+		if (!ALLOWED_PROXY_HOSTS.includes(parsed.hostname)) {
+			return error('Proxy domain not allowed', 403);
+		}
+	} catch {
+		return error('Invalid proxy URL', 400);
+	}
 
 	const response = await fetch(targetUrl, {
 		headers: { 'User-Agent': 'AMC-Trainer-Proxy/2.0' },