Security: Fix command injection, path traversal, and hardcoded secrets

[Copilot]

Description

Comprehensive security review identified and resolved 9 vulnerabilities across shell scripts, Python code, and web endpoints.

Command Injection (High)

• scripts/uefi-tools/uuefi-apply.sh, scripts/secure-boot/keys-centralize.sh: Replaced eval "$*" with "$@"
• scripts/recovery/autonuke.py: Changed subprocess.run() default to shell=False with shlex.split()

Secrets & Credentials (High)

• web/hardware_database_server.py: Replaced hardcoded Flask SECRET_KEY with os.environ.get('SECRET_KEY', secrets.token_hex(32))

Path Traversal (Critical)

• web/hardware_database_server.py: Added alphanumeric validation and TOCTOU-resistant path resolution in download endpoint

# Validate input format
if not re.match(r'^[a-zA-Z0-9_-]+$', hardware_id):
    return "Invalid hardware ID format", 400

# Resolve symlinks and verify containment
profile_file = profile_file.resolve()
if not str(profile_file).startswith(str(UPLOADS_PATH.resolve())):
    return "Invalid file path", 400

Insecure Temp Files (Medium)

• scripts/secure-boot/enable-secureboot-kexec.sh: Replaced predictable /tmp/phoenixboot_*.sh with mktemp

Input Validation (Medium)

• scripts/recovery/nuclear-wipe.sh: Added device path regex validation, extracted to reusable function

Deprecated APIs

• scripts/validation/detect_bootkit.py: Replaced os.system() with subprocess.run()

• Breaking change?

• Impacts security?

• Includes tests?

How This Was Tested

• CodeQL security scanning: 0 alerts
• Shellcheck analysis: No critical errors
• Python syntax validation: All files valid

Integration Instructions

Production deployments should set SECRET_KEY environment variable for web/hardware_database_server.py. If unset, a random key is generated (sessions invalidated on restart).

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Full on review</issue_title>
<issue_description>For correctnes and posterity.</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes Full on review #137

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.