What is the problem

Closes #201

PluginManager.build_command() interpolated user-supplied values directly into the argv list without any validation. While asyncio.create_subprocess_exec (no shell=True) prevents shell metacharacter injection, argv-level flag injection is still exploitable:

# Attacker input:
inputs = {"ports": "--script=evil.nse", "scan_type": "-sV --max-rate=1"}

# Resulting argv:
["nmap", "--script=evil.nse", "-sV", "--max-rate=1", "192.168.1.1"]
# nmap treats every element as a valid flag

Affected fields in the nmap plugin: ports (free-text string, no validation), and any plugin field that accepts a STRING type without a pattern constraint.

What was changed

Why this approach

• Validation at the schema boundary: each field's type and options list is declared in metadata.json; validating against it blocks injections for all plugins generically, not just nmap
• Port fields get a dedicated grammar check (^[\d,\-]+$) because they legitimately contain hyphens (ranges), so a blanket "no leading dash" rule is insufficient
• Validation before normalisation: SELECT checks must run on raw user values; if normalisation ran first (e.g. resolving a wordlist alias), the resolved path would fail the SELECT check
• No shell=True: create_subprocess_exec already handles shell metacharacters; this fix closes the remaining argv-level vector

How to test

from backend.secuscan.plugins import get_plugin_manager

pm = get_plugin_manager()

# Should raise ValueError — ports flag injection
pm.build_command("nmap", {"target": "127.0.0.1", "ports": "--script=evil.nse"})

# Should raise ValueError — scan_type out of allowed values
pm.build_command("nmap", {"target": "127.0.0.1", "scan_type": "-sV"})

# Should succeed
pm.build_command("nmap", {"target": "127.0.0.1", "ports": "22,80,443", "scan_type": "T"})

Edge cases covered

• Empty ports string is valid (plugin uses --top-ports 100 default)
• Port ranges like "1-1000" are valid (hyphen in numeric context)
• "-sT" and "sT" are normalised to "T" by PortScanner before reaching validation
• Integer fields: "30" accepted, "thirty" rejected, "--evil" rejected
• Boolean fields: True, "true", "1" accepted; "yes" rejected
• None and "" values are skipped (handled by _with_field_defaults)
• Unknown fields (not in schema) are ignored

Verification checklist

• pytest testing/backend/ — 290 passed (1 pre-existing failure in test_route_rejects_task_when_limiter_full)
• 52 new injection/validation tests — all pass
• All existing plugin tests — pass