$ show SCADA-LTS/Scada-LTS
Scada-LTS is a production SCADA (Supervisory Control and Data Acquisition) platform for real-time industrial monitoring and control. In production it does the following: protocol drivers poll or listen to industrial devices over MQTT, AMQP, Modbus, BACnet, DNP3, IEC 101, OPC UA, SNMP, HTTP, serial, and virtual channels; a data point engine stores time-series point values (binary/multistate/numeric/alphanumeric/image) in MySQL; event detectors and handlers raise alarms with email/SMS/WebSocket notifications; and users interact with watch lists, reports, graphical views/synoptic panels, and a permission system through both a legacy JSP/DWR interface and a newer Vue.js SPA backed by a REST API. Despite the time-series data at its core, this is a live operational application, not an analytics or research pipeline.
The LLM identified 4 files worth highlighting for reuse:
Validates ZIP archive entries before extraction to prevent zip-slip path traversal (rejecting absolute paths and ../ segments) and wraps entries with SafeZipFile/SafeZipEntry models and a FileNotSafeException. Self-contained and directly reusable in any Java project that accepts user-uploaded archives for file upload endpoints, plugin installers, or backup restore. Demonstrates a defensive archive-validation pattern that is commonly implemented incorrectly.
Central XSS defense utility driven by an @XssProtect annotation: escapes HTML in user-supplied strings and integrates with DWR converters and MVC data binding so untrusted input is neutralized at the framework boundary rather than scattering escape calls through controllers. The annotation-based escaping strategy is a reusable pattern for any Java web framework needing consistent, auditable output encoding.
CSV writer that prefixes spreadsheet formula metacharacters (=, +, -, @) with a safe escape when writing cell values, preventing CSV/formula injection when exported data is opened in Excel or LibreOffice. Backed by parameterized injection tests. Self-contained and directly reusable in any project generating CSV exports from user-controlled data — exactly the kind of edge-case security handling that is easy to miss. (A mirrored copy exists under org.scada_lts.serorepl.utils.)
Rhino JavaScript sandboxing: a ContextFactory with class-shutter semantics plus a NativeJavaObject wrapper that applies method allow/deny regexes, so user-authored meta/data-source scripts can only reach whitelisted host objects and cannot touch the filesystem or JVM internals. The technique is a proven, extractable pattern for any product that embeds user JavaScript (rule engines, automation tools, dashboards) and needs a safe host-object boundary.