security: remove hardcoded Flask secret, disable debug mode, add SHA256 verification (Issue #272)

Author: GaneshPatil7517

Dockerfile.sh

@@ -9,7 +9,10 @@ RUN mkdir /mcr-install \
 
 WORKDIR /mcr-install
 
-RUN wget https://ssd.mathworks.com/supportfiles/downloads/R2021a/Release/1/deployment_files/installer/complete/glnxa64/MATLAB_Runtime_R2021a_Update_1_glnxa64.zip
+ENV MATLAB_RUNTIME_SHA256="b821022690804e498d2e5ad814dccb64aab17c5e4bc10a1e2a12498ef5364e0d"
+
+RUN wget https://ssd.mathworks.com/supportfiles/downloads/R2021a/Release/1/deployment_files/installer/complete/glnxa64/MATLAB_Runtime_R2021a_Update_1_glnxa64.zip \
+    && echo "${MATLAB_RUNTIME_SHA256}  MATLAB_Runtime_R2021a_Update_1_glnxa64.zip" | sha256sum -c -
 
 RUN unzip MATLAB_Runtime_R2021a_Update_1_glnxa64.zip \
     && ./install -destinationFolder /opt/mcr -agreeToLicense yes -mode silent \

fri/server/main.py

@@ -14,7 +14,9 @@
 
 
 app = Flask(__name__)
-app.secret_key = "secret key"
+app.secret_key = os.environ.get("FLASK_SECRET_KEY")
+if not app.secret_key:
+    raise RuntimeError("FLASK_SECRET_KEY environment variable not set")
 
 cors = CORS(app)
 app.config['CORS_HEADERS'] = 'Content-Type'
@@ -407,4 +409,6 @@ def openJupyter():
 
 
 if __name__ == "__main__":
-    app.run(host="0.0.0.0", port=5000)
+    # In production, use:
+    # gunicorn -w 4 -b 0.0.0.0:5000 main:app
+    app.run(host="0.0.0.0", port=5000, debug=False)