Skip to content

Security hardening: authentication, input validation, OWASP compliance, architecture improvements, and CSP fixes for browser mode #942

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
thomasnordquist merged 37 commits into from
Dec 22, 2025
Merged

Security hardening: authentication, input validation, OWASP compliance, architecture improvements, and CSP fixes for browser mode #942

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
37 commits
Select commit Hold shift + click to select a range
8681176
Initial plan
Copilot Dec 21, 2025
b63e02e
Add security improvements: helmet, rate limiting, path traversal prot…
Copilot Dec 21, 2025
4a31844
Add SECURITY.md policy and complete security review
Copilot Dec 21, 2025
2360f32
Address code review: Use ES6 imports instead of require() in security…
Copilot Dec 21, 2025
3f6947a
Fix code formatting with Prettier
Copilot Dec 21, 2025
f59c5cd
Merge master branch - update to Node.js 24, dependencies, and ES modules
Copilot Dec 21, 2025
9ceed9e
Merge branch 'master' into copilot/security-review-ipc-connection
thomasnordquist Dec 21, 2025
4d094bb
Fix duplicate entry in yarn.lock causing CI build failures
Copilot Dec 21, 2025
82e2799
Fix React 18 type compatibility for ReactSplitPane onChange handlers
Copilot Dec 21, 2025
f18336b
Merge branch 'master' into copilot/security-review-ipc-connection
thomasnordquist Dec 21, 2025
0b9658d
Fix React 18 type incompatibility with react-split-pane using type cast
Copilot Dec 21, 2025
afa9586
Merge branch 'master' into copilot/security-review-ipc-connection
thomasnordquist Dec 21, 2025
dd629fd
Fix Material-UI v5 SelectChangeEvent type compatibility in Settings.tsx
Copilot Dec 21, 2025
5aa1d07
Fix webpack source-map-loader warning by excluding ace-builds
Copilot Dec 21, 2025
bdcf2a5
chore: update node in devcontainer
thomasnordquist Dec 21, 2025
ccb4804
Fix UI test locator for Material-UI v5 TextField compatibility
Copilot Dec 21, 2025
e47b113
Fix Material-UI v5 theme compatibility: add legacy ThemeProvider and …
Copilot Dec 21, 2025
5eb3721
Fix UI test compatibility: update connect button locator and modal ha…
Copilot Dec 21, 2025
a6a3f10
Fix UI test: wait for modal detachment instead of hidden state in MUI v5
Copilot Dec 21, 2025
593c699
Fix expandTopic: use direct Playwright click instead of custom mouse …
Copilot Dec 21, 2025
28bc2e4
Revert expandTopic change - clickOn was working correctly
Copilot Dec 22, 2025
58c700c
Fix clickOn to gracefully handle window.demo.moveMouse unavailability
Copilot Dec 22, 2025
c7866b2
Fix MQTT broker connection in UI tests: add Mosquitto config for anon…
Copilot Dec 22, 2025
4342437
Improve browser compatibility
thomasnordquist Dec 22, 2025
77ee8b6
Revert connectTo to original manual input behavior and remove mosquit…
Copilot Dec 22, 2025
a6da1bc
Fix TypeScript error in connect.ts: remove await from browser.locator()
Copilot Dec 22, 2025
091fdbc
Fix webpack browser config: prioritize app node_modules and remove De…
Copilot Dec 22, 2025
c363eac
Refactor: move socket.io-client dependency from events to app layer
Copilot Dec 22, 2025
bfd4bba
Fix CSP for webpack runtime and add browser mode debugging docs
Copilot Dec 22, 2025
983caf9
Document browser mode login, console errors, and UI flow with screens…
Copilot Dec 22, 2025
be30d3f
Fix: Exclude IPC EventBus from browser builds with improved webpack c…
Copilot Dec 22, 2025
4e3e71c
Fix dev:server - add webpack-dev-server config with proper port and p…
Copilot Dec 22, 2025
5df7ae3
Add data-testid to connect button for reliable UI test location
Copilot Dec 22, 2025
827eea5
Add data-testid to Disconnect, Advanced, Add, and Back buttons for re…
Copilot Dec 22, 2025
6a57e44
Change Node.js engine requirement from >=24 to >=20 for broader compa…
Copilot Dec 22, 2025
6346c44
chore: fix agent setup steps
thomasnordquist Dec 22, 2025
436045d
Add data-testid attributes to all interactive UI elements for reliabl…
Copilot Dec 22, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 21 additions & 3 deletions .devcontainer/devcontainer.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
"name": "MQTT Explorer Development",
"dockerComposeFile": "docker-compose.yml",
"service": "app",
"workspaceFolder": "/workspace",
"workspaceFolder": "/workspace/MQTT-Explorer",

"customizations": {
"vscode": {
Expand All @@ -15,7 +15,6 @@
],
"settings": {
"editor.formatOnSave": true,
"editor.defaultFormatter": "esbenp.prettier-vscode",
"typescript.tsdk": "node_modules/typescript/lib",
"editor.codeActionsOnSave": {
"source.fixAll.eslint": "explicit"
Expand All @@ -24,7 +23,7 @@
}
},

"forwardPorts": [3000, 8080, 1883],
"forwardPorts": [3000, 8080, 1883, 5900, 6080],
"portsAttributes": {
"3000": {
"label": "MQTT Explorer Server",
Expand All @@ -37,10 +36,29 @@
"1883": {
"label": "MQTT Broker",
"onAutoForward": "ignore"
},
"5900": {
"label": "VNC Server",
"onAutoForward": "ignore"
},
"6080": {
"label": "noVNC Web Client",
"onAutoForward": "notify"
}
},

"postCreateCommand": "yarn install",

"postStartCommand": "sudo apt-get update && sudo apt-get install -y mosquitto xvfb x11vnc ffmpeg tmux python3 python3-pip && sudo pip3 install --break-system-packages websockify",

"features": {
"ghcr.io/devcontainers/features/common-utils:2": {
"installZsh": true,
"installOhMyZsh": true,
"upgradePackages": true
}
},

"remoteUser": "node"
}

12 changes: 7 additions & 5 deletions .devcontainer/docker-compose.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,9 +2,9 @@ version: '3.8'

services:
app:
image: mcr.microsoft.com/devcontainers/javascript-node:20
image: mcr.microsoft.com/devcontainers/javascript-node:24

Copilot AI Dec 22, 2025

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The devcontainer uses Node.js 24 (javascript-node:24), but package.json specifies "node": ">=20". While using a newer version is acceptable, consider using the minimum supported version (Node 20) in the devcontainer to catch compatibility issues early during development.

Suggested change
image: mcr.microsoft.com/devcontainers/javascript-node:24
image: mcr.microsoft.com/devcontainers/javascript-node:20

Copilot uses AI. Check for mistakes.
volumes:
- ../..:/workspace:cached
- ..:/workspaces/MQTT-Explorer:cached
command: sleep infinity
network_mode: service:mosquitto
environment:
Expand All @@ -14,8 +14,10 @@ services:
mosquitto:
image: eclipse-mosquitto:2
ports:
- "1883:1883"
- "3000:3000"
- "8080:8080"
- '1883:1883'
- '3000:3000'
- '8080:8080'
- '5900:5900'
- '6080:6080'
volumes:
- ./mosquitto.conf:/mosquitto/config/mosquitto.conf:ro
Loading
Loading