Skip to content

Remediate OWASP findings, harden localStorage, add tests, mobile touch support - #2

Merged
knarayanareddy merged 1 commit into
mainfrom
arena/eae1b485-appbuilder
Nov 3, 2026
Merged

knarayanareddy merged 1 commit into
mainfrom
arena/eae1b485-appbuilder

Conversation

@knarayanareddy

Copy link
Copy Markdown
Owner

Summary

Remediates the remaining highest-value findings from the security/code review:

Security (OWASP)

  • **** — Hardened persistence (A08 Software & Data Integrity Failures, A02 Cryptographic Failures):
    • Schema validation on load for mode, settings, presets, and location data; falls back to defaults on corruption/tampering
    • Numeric range guards (ISO stops, EV ±3, kelvin 2300–10000, zoom 0.6–100, lat/lng bounds)
    • Preset quota cap (50) to prevent storage-quota DoS (A04 Insecure Design)
    • Unique preset IDs via instead of collision-prone
    • Empty preset-name rejection; exported

Dependency remediation

  • ** / ** — eslint v4→v9, v10→v9, vite 7.2.4→7.3.7 (fixes high-severity path traversal GHSA-4w7w-66w2-5vf9)
  • npm audit: 18 vulnerabilities (5 high) → 11 moderate (0 high)

Tests

  • 31 new tests across 6 previously untested components: GalleryView, SettingsPanel, ShotLog, Viewfinder, ViewfinderOverlays, ProControlBar
  • Total: 43 tests across 9 files, all passing

Mobile (Android target platform)

  • **** — Added touch drag handlers () with , class, and momentum scrolling so the mode carousel works on touch devices

Verification

  • — pass
  • — pass
  • — 43/43 pass
  • — pass

…h support

- Security harden localStorage persistence: schema validation on load,
  preset quota limit, unique preset IDs, location/coordinate validation,
  mode validation, default-settings merge for missing fields
- Remediate dependency vulnerabilities: upgrade eslint to v9, @eslint/js
  to v9, vite to v7.3.7 (fixes high-severity path traversal); 18 vulns
  (5 high) reduced to 11 moderate (0 high)
- Expand test coverage: 31 new tests across 6 untested components
  (GalleryView, SettingsPanel, ShotLog, Viewfinder, ViewfinderOverlays,
  ProControlBar); 43 tests total, all passing
- Add mobile touch support to ModeCarousel: touch drag handlers with
  preventDefault, touch-none class, momentum scrolling for Android

Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ⚠️ Failed 2026-11-03T09:00:07.991908Z
We couldn’t complete this review. Comment @codex review to try again.
dea12da PR opened
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@coderabbitai

coderabbitai Bot commented Nov 3, 2026

Copy link
Copy Markdown

Important

  • Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration
  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: defaults
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: ee4abe33-09cf-4b05-8b2d-cddfa35db236
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

CodeRabbit Verify

  • Run CodeRabbit Verify to test the changes in this pull request.

@chatgpt-codex-connector

Copy link
Copy Markdown

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

@knarayanareddy
knarayanareddy merged commit 5029d89 into main Nov 3, 2026
1 of 2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant