fix(dashboard-api): reject newlines and null bytes in env editor values

[Lightheartdevs]

Summary

Closes a defense-in-depth gap in the env editor (#854). Rejects values containing \n, \r, or \0 to prevent .env injection.

What was the gap

A submitted value like 3010\nINJECTED_KEY=malicious would write two lines to .env. Not exploitable in the current architecture (Docker Compose and Python dotenv treat it as a literal string), but a defense-in-depth gap.

Fix

4 lines added to _serialize_form_values in main.py:

if value is not None and any(c in str(value) for c in ("\n", "\r", "\0")):
    raise HTTPException(status_code=400, detail=f"Value for '{key}' contains invalid characters")

Tests

• test_api_settings_env_rejects_newline_in_value — submits 3010\nINJECTED_KEY=malicious, asserts 400
• test_api_settings_env_rejects_null_byte_in_value — submits 3010\x00injected, asserts 400

🤖 Generated with Claude Code

[github-actions]

Sensitive Files Detected

Trigger: Security-sensitive files detected: .env

Files flagged:

dream-server/extensions/services/dashboard-api/tests/test_settings_env.py

Extra human review is recommended for this PR.

---

Claude Code Review | Sensitive File Detection | ~$1.50

[github-actions]

Sensitive Files Detected

Trigger: Security-sensitive files detected: .env

Files flagged:

dream-server/extensions/services/dashboard-api/tests/test_settings_env.py

Extra human review is recommended for this PR.

---

Claude Code Review | Sensitive File Detection | ~$1.50