ADFA-3255 | Fix high severity Snyk vulnerabilities

[jatezzz]

Description

This PR addresses the 10 HIGH severity security problems recently reported by Snyk to prevent security regressions and maintain user trust.

To achieve this, the local test server (serve-static.js) was updated to include path resolution checks that strictly prevent directory traversal, HTML output escaping to mitigate XSS risks, and strict Content-Security-Policy (CSP) and nosniff headers. Additionally, a large number of outdated or unmaintained examples were removed from the llama.cpp subproject to drastically reduce the attack surface and eliminate flagged vulnerabilities within legacy code.

Details

• Snyk scan will now report 0 HIGH severity problems.
• Attempting to navigate outside the static directory bounds on the local dev server will correctly return a 403 Forbidden error.

No visual changes have been made to Code On the Go; we can only verify that the “Agent” continues to function perfectly.

document_5014844204682053344.mp4

Ticket

ADFA-3255

Observation

A significant portion of this patch involves the deletion of legacy example files in subprojects/llama.cpp/examples/. This cleanup is intentional as it removes unmaintained files that trigger static analysis alerts without providing core value to the current active project.

[hal-eisen-adfa]

LGTM