security: fix CORS misconfiguration and unclosed file handle

[ghost]

Opened by @roomote-v0 on behalf of J oz

Security Fixes

1. CORS Misconfiguration (HIGH)

The server was configured with allow_origins=["*"] combined with allow_credentials=True. Per the CORS specification, browsers will reject credentialed requests when the origin is a wildcard. More importantly, this configuration signals an intent to allow all origins with credentials, which is a security anti-pattern.

Fix: Added a configurable cors_allow_origins setting to ServerSettings and disabled allow_credentials when wildcard origins are used. Users can now restrict CORS origins in production by setting specific allowed origins.

2. Unclosed File Handle (LOW)

In model.py, json.load(open(...)) was used without a context manager, creating a resource leak where file handles might not be properly closed.

Fix: Wrapped in a proper with statement.

---

View task on Roo Code Cloud

[ghost]

Rooviewer   See task

I've reviewed the PR and found an issue with the CORS validation logic.

• Fix incomplete wildcard check for allow_credentials in app.py

_{Mention @roomote in a comment to request specific changes to this pull request or fix all unresolved issues.}

[ghost]

Rooviewer   See task

I've reviewed the PR and found an issue with the CORS validation logic.

• Fix incomplete wildcard check for allow_credentials in app.py

_{Mention @roomote in a comment to request specific changes to this pull request or fix all unresolved issues.}

[ghost]

This condition only checks for an exact match of ["*"]. If cors_allow_origins is configured with multiple origins including a wildcard (e.g., ["*", "https://example.com"]), this evaluates to True and enables credentials, defeating the intended security fix. You should check if "*" is present in the list instead.

Suggested change

	allow_credentials=True if server_settings.cors_allow_origins != ["*"] else False,
	allow_credentials="*" not in server_settings.cors_allow_origins,

_{Fix it with Roo Code or mention @roomote and request a fix.}