Security: Remove hardcoded credentials and add input validation

Commit ee2d9c7

Description

BREAKING CHANGE: All secrets now require environment variables

• config.py: Remove hardcoded POSTGRES_PASSWORD, GITEA_TOKEN, XENSERVER_PASS
  • Add field validators to reject placeholder values
  • CORS_ORIGINS now configurable (defaults to specific domains, not “*”)
• main.py: Fix CORS to use configured origins instead of wildcard
  • Replace bare except: handlers with proper exception logging
• schemas.py: Add input validation patterns
  • VM/container names: alphanumeric, hyphens, underscores only
  • Docker images: validate format (registry/image:tag)
  • Port mappings: validate format and range (1-65535)
  • Add max length constraints to prevent abuse
• plugin_zap.py, plugin_burp.py: Load API keys from environment
  • ZAP_API_KEY and BURP_API_KEY env vars required
• .env.example: Document all required environment variables

ACTION REQUIRED: Rotate exposed credentials in git history

Co-Authored-By: Claude Opus 4.5 noreply@anthropic.com

Fichiers modifiés

Statistiques