fix: add missing quote and backslash chars to sanitize_input to preve…

[Midoriya-w]

fix: patch command injection bypass in sanitize_input()

Closes #309

Problem

sanitize_input() was missing critical shell characters from its blocklist, allowing attackers to bypass sanitization using quoted strings or backslash sequences.

Changes

• Updated dangerous_chars in backend/secuscan/validation.py to include:
  • ' — single quote (breaks out of quoted strings)
  • " — double quote (breaks out of double-quoted strings)
  • \ — backslash (escapes characters)
  • ! — bash history expansion
  • { } — brace expansion

Before / After

# Before
dangerous_chars = [';', '|', '&', '$', '`', '(', ')', '<', '>', '\n', '\r']

# After
dangerous_chars = [';', '|', '&', '$', '`', '(', ')', '<', '>', '\n', '\r', "'", '"', '\\', '!', '{', '}']

Security Impact

Severity: High — Attackers could bypass sanitization and inject shell commands using quoted strings or backslash sequences on any input passed to shell commands.

[utksh1]

Approved for merge. This is a focused sanitize_input hardening change that removes additional shell-sensitive characters without unrelated churn, and CI is green.