fix: prevent custom branding flash on initial load

frontend/src/utils/__tests__/branding.spec.ts

@@ -0,0 +1,22 @@
+import { beforeEach, describe, expect, it } from 'vitest'
+import { updateFavicon } from '@/utils/branding'
+
+describe('updateFavicon', () => {
+  beforeEach(() => {
+    document.head.innerHTML = '<link rel="icon" href="/logo.png">'
+  })
+
+  it('replaces the default favicon with the configured logo', () => {
+    updateFavicon('https://example.com/custom-logo.png')
+
+    const link = document.querySelector<HTMLLinkElement>('link[rel="icon"]')
+    expect(link?.href).toBe('https://example.com/custom-logo.png')
+  })
+
+  it('ignores unsafe logo URLs', () => {
+    updateFavicon('javascript:alert(1)')
+
+    const link = document.querySelector<HTMLLinkElement>('link[rel="icon"]')
+    expect(link?.getAttribute('href')).toBe('/logo.png')
+  })
+})

frontend/src/utils/branding.ts

@@ -0,0 +1,21 @@
+import { sanitizeUrl } from '@/utils/url'
+
+export function updateFavicon(logoUrl: string): void {
+  const sanitizedLogoUrl = sanitizeUrl(logoUrl, {
+    allowRelative: true,
+    allowDataUrl: true,
+  })
+  if (!sanitizedLogoUrl) {
+    return
+  }
+
+  let link = document.querySelector<HTMLLinkElement>('link[rel="icon"]')
+  if (!link) {
+    link = document.createElement('link')
+    link.rel = 'icon'
+    document.head.appendChild(link)
+  }
+
+  link.type = sanitizedLogoUrl.endsWith('.svg') ? 'image/svg+xml' : 'image/x-icon'
+  link.href = sanitizedLogoUrl
+}