Hardening pass: input validation, origin checks, and default-safe field behaviour — legacy/v1

[shengxi-gt]

Hardening pass — legacy/v1

Covers several hardening changes and default-safe behaviour updates across fields and shared utilities. One commit — review the diff directly since the changes span multiple independent areas with varying blast radius.

Same changes as the main/v2 branch PRs, adapted for v1's codebase (Text instead of Typography, styled-components CSS interpolation instead of direct cssText). v1 has no Popover field and no OTP field, so those items do not apply here.

⚠️ Breaking changes

Four changes alter default runtime behaviour unconditionally, no opt-out, for every existing schema as soon as this ships:

1. Iframe postMessage origin check is now hard default-on. Messages from a mismatched origin are silently dropped.
2. 1000-character cap on schema-authored regex input. Inputs longer than 1000 chars are treated as non-matching regardless of the actual pattern result. Affects matches, notMatches, and filenameMatches rules.
3. MaskedField maxLength now defaults to 1000 whenever maskRegex is set and no max/length rule already narrows it.
4. Pattern strings not wrapped in /pattern/flags slashes are no longer silently skipped. They previously landed in a catch block and validation was skipped entirely (value always passed). The shared parsing helper now falls back to treating the whole string as a raw pattern and applies it — any schema relying on the old silent no-op will now get real validation applied.

Narrower breaking changes (only affect a consumer that relied on the specific permissive behaviour being fixed):

• sanitize-html configuration: stricter attribute allowlist may now strip attributes that previously passed through unsanitized.
• ButtonField URL scheme check: links using a non-standard scheme (e.g. custom app deep-links) will now be blocked.
• locationModalStyles / imageReviewModalStyles: url() and @import are now stripped from these CSS strings before they are applied to the modal box. Any background image or external resource passed via these props will silently stop working. Verified against all known consumers — none currently use these props with url() or @import.

Changes covered

• CI pipeline configuration hardened
• sanitize-html configuration tightened in Text, FilterCheckbox
• ButtonField link URLs now restricted to http/https/tel/mailto schemes
• Iframe postMessage now validates origin by default
• Location-field search query now escaped before use in RegExp
• Schema regex inputs now capped at 1000 characters
• MaskedField maxLength defaults to 1000 when maskRegex is set
• Shared regex parsing helper introduced; unwrapped patterns now evaluated instead of silently skipped
• Custom modal style strings now strip @import and url() references
• locationModalStyles and imageReviewModalStyles prop descriptions updated in Storybook
• ImageUpload matches rule no longer blocks valid submissions (pre-existing bug fix)

Test plan

• Full Jest suite + eslint + tsc --noEmit pass on this branch.
• Each change was individually verified at the time it was written.

[qroll]

this is not implemented in v1

can we confirm if backporting is needed for v1? most services should migrate to v2 at minimum