Patch critical CORS misconfiguration and dependency vulnerabilities

[Copilot]

Summary

Fixed CORS misconfiguration allowing unrestricted cross-origin requests and updated 5 vulnerable dependencies with known CVEs.

Changes

CORS Security Hardening

Files: demo/realtime-txt2img/main.py, demo/realtime-img2img/main.py

• Restricted allow_origins from ["*"] to localhost-only
• Added validated ALLOWED_ORIGINS env var for additional origins
• Restricted allow_methods from ["*"] to ["GET", "POST"]
• Restricted allow_headers from ["*"] to ["Content-Type", "Accept"]
• Implemented URL validation using urllib.parse.urlparse() with scheme, netloc, whitespace, and length checks

# Before
allow_origins=["*"]  # Any origin accepted

# After
allowed_origins = ["http://localhost:7860", "http://127.0.0.1:7860"]
additional_origins = os.environ.get("ALLOWED_ORIGINS", "")
if additional_origins:
    for origin in additional_origins.split(","):
        parsed = urlparse(origin.strip())
        if (parsed.scheme in ("http", "https") and parsed.netloc and 
            len(origin) < 200 and not any(c.isspace() for c in origin)):
            allowed_origins.append(origin)

Dependency Updates

Files: setup.py, demo/realtime-img2img/requirements.txt

Package	Version	CVEs Fixed
protobuf	3.20.2 → 5.29.6	DoS, JSON recursion depth bypass
onnx	1.15.0 → 1.17.0	Path traversal, arbitrary file overwrite
Pillow	10.1.0 → 10.3.0	Arbitrary code execution, buffer overflow
fastapi	0.104.1 → 0.109.1	ReDoS
uvicorn	0.24.0 → 0.25.0	Compatibility

Validation

• GitHub Advisory Database: 0 vulnerabilities in updated dependencies
• CodeQL: 0 alerts

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Patch security</issue_title>
<issue_description></issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes Patch security #1

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[cybermorena]

More color

[Copilot]

More color

Could you clarify what you mean by "More color"? Are you referring to:

• Adding colored terminal output/logging?
• Improving code documentation?
• Something else?

I want to make sure I implement the right enhancement.