Security hardening: sanitize MQTT topics, fix bounds check, reduce lo…

[mplogas]

…g exposure

• Strip MQTT wildcard characters (#, +, /) from user-provided topic segments via new SanitizeSegment method, preventing topic traversal from subdevice nicknames sourced from gateway API
• Add bounds check on topic.Split('/') before array indexing in MQTT command handler to prevent IndexOutOfRangeException
• Remove full message payloads from Warning-level log lines on publish failure (topic-only logging now)
• Delete stale Ecowitt.Controller/Dockerfile targeting .NET 8 / Debug
• Remove unused FluentValidation, Swashbuckle package references

[Copilot]

Pull request overview

Security hardening for MQTT topic handling and logging in the controller’s MQTT integration, plus some cleanup of build artifacts and unused dependencies.

Changes:

• Introduces segment-level MQTT topic sanitization to prevent wildcard/topic traversal injection via gateway/subdevice names.
• Adds a defensive bounds check when parsing Home Assistant command topics to avoid IndexOutOfRangeException.
• Reduces log exposure by removing full payloads from Warning-level publish-failure logs; removes unused package references and deletes a stale Dockerfile.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
src/Ecowitt.Controller/Service/Mqtt/MqttService.Publisher.cs	Removes message payload from Warning logs on publish failures.
src/Ecowitt.Controller/Service/Mqtt/MqttService.Events.cs	Adds Split('/') bounds check before indexing when handling HA command topics.
src/Ecowitt.Controller/Service/Mqtt/MqttService.DiscoveryPublisher.cs	Switches discovery topic building to sanitize only user-provided segments.
src/Ecowitt.Controller/Service/Mqtt/MqttService.Consumer.cs	Aligns discovery removal topic generation with new segment sanitization.
src/Ecowitt.Controller/Service/Mqtt/MqttPathBuilder.cs	Adds SanitizeSegment and updates topic builders to sanitize each segment.
src/Ecowitt.Controller/Ecowitt.Controller.csproj	Removes unused FluentValidation/Swashbuckle-related package references.
src/Ecowitt.Controller/Dockerfile	Deletes stale .NET 8 Debug Dockerfile.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.