Frontend loads mqtt.js from the unpkg CDN (unversioned, no SRI); the UI fails to initialise on disconnected or air-gapped sites
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 78/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- javascript
- Domain
- frontend
Research direction
Start with src/frontend/public/index.html and src/frontend/package.json, then inspect the frontend Docker build to see how its assets are served. Bundle the existing MQTT browser client locally and update the script reference; verify the app no longer requests mqtt.js from unpkg and that its UI initializes. The optional missing-client guard and CI check are separate additions.
Written by the indexing model from the issue text.
Description
Summary
src/frontend/public/index.html loads the MQTT browser client from a public CDN at runtime:
<script src="https://unpkg.com/mqtt/dist/mqtt.min.js"></script>
This conflicts with the goal of running the same app in disconnected and sovereign environments:
- Disconnected or egress-restricted sites: if the browser can't reach unpkg,
mqttis undefined. The inline initialisation then throws atmqtt.connect(...)before the order and chat handlers, data loading and timers are set up, so most of the UI is non-functional. Orders are published from the browser toorders/newover MQTT, so placing orders depends on this script too. - Supply chain and reproducibility: with no version pinned and no Subresource Integrity, every page load gets whatever the latest
mqttrelease is.
Suggested fix
mqtt is already a dependency of the frontend (src/frontend/package.json, ^5.15.0). Serve its browser bundle from the frontend container instead of the CDN. For example, copy node_modules/mqtt/dist/mqtt.min.js to public/vendor/mqtt.min.js during the Docker build, and reference /vendor/mqtt.min.js from index.html.
Optionally, guard initialisation so that a missing MQTT client degrades to "live updates unavailable" instead of stopping the page, and add a CI check for absolute https:// script/style URLs in public/.
- Dominant language
- Rust
- Stars
- 5
- Forks
- 3
- Avg merge
- 2d 7h
- Merged PRs (30d)
- 9
Getting set up
This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from microsoft/adaptive-apps
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
microsoft/adaptive-apps#58 ·
-
help wanted Microhack
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
microsoft/adaptive-apps#28 ·
-
Create Microhack Challenge 08 Coach guideMay be free again @gowrishacv claimed this 46 days ago, and no pull request is open. Openhelp wanted Microhack
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
microsoft/adaptive-apps#27 · 1 comment ·
-
help wanted Microhack
Difficulty 2/5 Half a day Newbie friendliness 68/100
microsoft/adaptive-apps#26 ·
-
help wanted Microhack
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
microsoft/adaptive-apps#25 ·
All issues in microsoft/adaptive-apps
Similar issues
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
eclipse-opensovd/classic-diagnostic-adapter#616 ·
Maintainers usually reply within 2 days
-
documentation
Difficulty 1/5 Under an hour Newbie friendliness 86/100
Maintainers usually reply within 1 day
-
track: content
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
0xAndersen/witness-log#10 ·
-
follow-up main-defect wave-A
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
carrick-sh/carrick#249 ·
Maintainers usually reply within 1 day
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
lugassawan/swe-workbench#799 ·
Maintainers usually reply within 1 day