diff --git a/frontend/src/components/editor-uploads-panel.tsx b/frontend/src/components/editor-uploads-panel.tsx
index ee8313b..773b4dd 100644
--- a/frontend/src/components/editor-uploads-panel.tsx
+++ b/frontend/src/components/editor-uploads-panel.tsx
@@ -1,18 +1,128 @@
-import { Cancel01Icon } from '@hugeicons/core-free-icons'
+import { Cancel01Icon, CloudUploadIcon } from '@hugeicons/core-free-icons'
import { HugeiconsIcon } from '@hugeicons/react'
+import { useRef } from 'react'
import {
editorSidebarPanelLeftClass,
editorSidebarPanelTopClass,
} from '../lib/editor-sidebar-panel-layout'
+import type { SceneSvg } from '../lib/avnac-scene'
+import { useEditorStore } from './scene-editor/editor-store'
type Props = {
open: boolean
onClose: () => void
}
+// SVGs are rendered exclusively via
with a data URL, which sandboxes scripts
+// and event handlers at the browser level. This sanitizer is defense-in-depth only —
+// it removes common XSS vectors so that stored markup stays clean if the rendering
+// approach ever changes.
+function sanitizeSvgMarkup(markup: string): string {
+ return markup
+ .replace(/