Fix critical security vulnerabilities: secrets, CORS, XSS, input validation

[Copilot]

Security analysis revealed multiple critical vulnerabilities enabling session hijacking, XSS attacks, and score manipulation.

Changes

Secrets Management

• Removed hardcoded SECRET_KEY, now sourced from SECRET_KEY env var with cryptographic fallback
• CORS origins configurable via ALLOWED_ORIGINS env var (comma-separated)

Input Sanitization & Validation

• _sanitize_name(): Strips HTML/script tags from player names using regex [^a-zA-Z0-9\s\-_]
• _validate_score(): Enforces type, range, and plausibility checks (max = duration × 2)
• All WebSocket handlers now validate data parameter type before processing

Production Safety

• allow_unsafe_werkzeug flag now conditional on FLASK_DEBUG env var (accepts true or 1)
• Added security warnings for debug mode

Documentation

• SECURITY.md documents all vulnerabilities, fixes, and deployment recommendations

Example

Before:

app.config["SECRET_KEY"] = "whack-a-mole-secret-key"  # Visible in source
socketio = SocketIO(app, cors_allowed_origins="*")   # Any origin allowed

@socketio.on("submit_score")
def handle_submit_score(data):
    name = data.get("name", "Anonymous")  # No sanitization
    high_scores.append({"name": name[:10], ...})  # XSS vulnerable

After:

app.config["SECRET_KEY"] = os.environ.get("SECRET_KEY", os.urandom(24).hex())
allowed_origins = os.environ.get("ALLOWED_ORIGINS", "*").split(",")
socketio = SocketIO(app, cors_allowed_origins=allowed_origins)

@socketio.on("submit_score")
def handle_submit_score(data):
    if not isinstance(data, dict): return
    name = _sanitize_name(data.get("name"))  # Strips <script> tags
    if not _validate_score(score, game_state): return

Environment Variables

Variable	Purpose	Default
SECRET_KEY	Session encryption key	Random (insecure)
ALLOWED_ORIGINS	CORS whitelist	* (dev only)
FLASK_DEBUG	Enable unsafe Werkzeug	false

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[Copilot]

Copilot wasn't able to review any files in this pull request.