Potential fix for https://github.com/Rootless-Ghost/AtomicLoop/security/code-scanning/13

General fix: ensure user-controlled values are validated against a strict allowlist format before they can reach command execution code, and pass only validated/canonicalized values downstream.

Best single fix without changing functionality: in app.py, validate target_host for WinRM transport using the same strict rules (valid IPv4/IPv6 literal via ipaddress, or RFC1123-style hostname labels via regex) before calling execute_remote_winrm. This creates an explicit sanitizer in the taint path from request to subprocess sink, which satisfies static analysis and preserves behavior (invalid hosts were already rejected later; now they are rejected earlier).

Changes needed:

• File: app.py
• Add imports: ipaddress, re
• Add module-level compiled regex for hostname syntax.
• Add helper function _is_valid_target_host(value: str) -> bool.
• In the /execute handler, before execute_remote_winrm(...), reject invalid target_host with 400.

No changes are required in core/remote_executor.py.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.