Fix security vulnerabilities, infinite recursion bug, resource leaks, and migrate to ESM for CodeceptJS 4.x

[Copilot]

Comprehensive review of CodeceptUI surfaced critical security issues, a stack-overflow bug, and several resource leaks. Additionally migrated the entire codebase from CommonJS to native ESM to match CodeceptJS 4.x.

Critical

• lib/api/new-test.js: Replace eval(req.body.code) with new Function('return ' + req.body.code)() — eliminates local scope access from user input
• lib/api/editor.js, lib/api/get-file.js: Path traversal via symlinks — added fs.realpathSync() validation. Extracted shared resolveSecurePath() helper in editor.js
• lib/codeceptjs/reporter-utils.js: retry-- (post-decrement) passes original value to recursive call → infinite recursion → stack overflow. Fixed to retry - 1

// Before: infinite recursion — retry never decrements
return takeSnapshot(helper, snapshotId, takeScreenshot, retry--);
// After:
return takeSnapshot(helper, snapshotId, takeScreenshot, retry - 1);

Resource leaks / memory

• lib/model/snapshot-store/index.js: Unbounded in-memory snapshot accumulation. Added FIFO eviction at 500 entries
• lib/model/scenario-repository.js: Chokidar watcher created but never stored. Saved reference and exported closeWatcher()

Hardening

• lib/model/testrun-repository.js: JSON.parse of file content without try-catch; missing 'utf8' encoding on readFileSync
• lib/api/get-file.js: Stream error after headersSent silently ignored — now calls destroy() + end()
• lib/model/settings-repository.js: Object.assign(settings, newSettings) accepts arbitrary keys. Added allowlist
• lib/commands/init.js: Unguarded fs.lstatSync throws on missing config path. Wrapped in try-catch with process.exit(1)

Full ESM Migration

Migrated the entire CodeceptUI codebase from CommonJS to native ESM (import/export), matching CodeceptJS 4.x which also uses ESM.

• package.json: Added "type": "module". Updated codeceptjs peer and dev dependency to ^4.0.0-rc.1
• Root config files: Renamed to .cjs (vue.config.cjs, babel.config.cjs, postcss.config.cjs, tailwind.cjs, codecept.conf.cjs) since they use CommonJS syntax consumed by tooling
• All lib/ files (55+ files): Converted require()/module.exports to import/export
• bin/codecept-ui.js: Converted entry point to ESM
• lib/codeceptjs/codeceptjs-imports.js: Simplified from dynamic import() CJS-ESM bridge to direct import codeceptjs from 'codeceptjs' — no interop layer needed since CodeceptUI is now ESM
• lib/model/codeceptjs-factory.js: Uses direct ESM imports. create(), reloadConfig(), and reloadConfigIfNecessary() are fully async to support CodeceptJS 4.x async APIs
• Helper factory pattern: The 4 helper files (realtime-reporter, network-recorder, console-recorder, single-session) export factory functions that receive the Helper base class as a parameter (replacing the removed codecept_helper global)
• All API handlers: Updated to ESM imports and async module loading where needed
• __dirname/__filename: Replaced with import.meta.dirname/import.meta.filename throughout
• require.resolve()/require.cache: Replaced with createRequire(import.meta.url) where dynamic require is still needed (e.g., module cache invalidation, loading user config files)

Key ESM conversion patterns

// debug package
const debug = require('debug')('name');
// →
import Debug from 'debug';
const debug = Debug('name');

// socket.io-client
const socket = require('socket.io-client')(url);
// →
import { io } from 'socket.io-client';
const socket = io(url);

// Local imports require .js extension
import X from './local.js';

Tests

All test files (14 + 9 co-located specs) converted to ESM. 11 new tests in test/security-fixes.spec.js. All 171 tests pass.

CodeQL note

Pre-existing js/missing-rate-limiting alert on file-access routes in lib/api/index.js — not introduced here, would require architectural change (e.g. express-rate-limit).

---

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.

[kobenguyent]

@copilot adapt the codeceptUI to work with new codeceptjs 4.x (https://github.com/codeceptjs/CodeceptJS/tree/4.x) it's moving to ESM from CommonJS.

[Copilot]

@copilot adapt the codeceptUI to work with new codeceptjs 4.x (https://github.com/codeceptjs/CodeceptJS/tree/4.x) it's moving to ESM from CommonJS.

Adapted the CodeceptUI to work with CodeceptJS 4.x ESM in commit 5d342ee.

Key changes:

1. ESM-CJS interop layer (lib/codeceptjs/codeceptjs-imports.js) — Since CodeceptUI is CJS and CodeceptJS 4.x is ESM ("type": "module"), all require('codeceptjs') calls are replaced with a cached dynamic import() bridge via codeceptjsModules() and importSubpath().

2. Helper factory pattern — The 4 helper files (realtime-reporter, network-recorder, console-recorder, single-session) no longer use the codecept_helper global (removed in 4.x). They export factory functions that receive the Helper base class as a parameter from @codeceptjs/helper.

3. Async initialization — codeceptjs-factory.create(), reloadConfig(), config.load(), initGlobals(), container.create(), and runHooks() are all awaited since they became async in 4.x.

4. Dependency update — codeceptjs peer/dev dependency updated to ^4.0.0-rc.1. Note: npm install --legacy-peer-deps is required due to a peer dep conflict with @codeceptjs/configure.

All 172 tests pass, 0 CodeQL alerts.

[kobenguyent]

@copilot move codeceptui to esm like codeceptjs 4.x esm.

[Copilot]

@copilot move codeceptui to esm like codeceptjs 4.x esm.

Migrated CodeceptUI to ESM in commits 6e03a9b..241dea6.

Changes:

• Added "type": "module" to package.json
• Converted all 65+ files in lib/, bin/, and test/ from require()/module.exports to import/export
• Renamed root config files to .cjs (vue.config.cjs, babel.config.cjs, postcss.config.cjs, tailwind.cjs, codecept.conf.cjs)
• Simplified lib/codeceptjs/codeceptjs-imports.js — now uses direct import codeceptjs from 'codeceptjs' instead of the dynamic import() bridge
• Replaced all __dirname → import.meta.dirname
• Used createRequire(import.meta.url) for the few cases that still need dynamic require (e.g. require.cache for module reloading, loading user profile config files)

All 171 tests pass.