Harden representative discovery trust

[schenkty]

Security summary

• require a strict majority of all configured peers before applying representative weights or advertised endpoints
• reject non-HTTP(S), local, private, link-local, CGNAT, and cloud metadata endpoint advertisements
• bound representative refresh fan-out so unresponsive peers cannot stall the loop

Testing

• cargo test -p keetanetwork-client
• cargo check -p keetanetwork-client --no-default-features
• cargo clippy -p keetanetwork-client --all-targets -- -D warnings

  

[larseidsvoll]

Security @ 66b8f5c7 (draft) — addresses confirmed MEDIUM from revalidation @ 65925dca: single-peer GET /representatives weight overwrite + arbitrary advertised API URL dial.

Looks aligned: configured-peer majority before applying weights/endpoints; reject unsafe advertised URLs; regression tests for poisoning / quorum / SSRF. Separate from open #40–#43.

Handed to Warden. No HIGH+. No merge from Aegis.

[larseidsvoll]

APPROVE at 66b8f5c766f49682fc60b7da22d5cff04d626232.

Strict majority uses configured peer_count (not responders), so one peer or a shrunk responder set cannot overwrite weights; empty consensus skips the shared cache and update_weights leaves configured endpoints alone. Unsafe advertised URLs are filtered in consensus and again before factory.create. Regression coverage for poisoning, reduced quorum, and metadata/local targets looks right.

Residual (non-blocking): hostname ads that later resolve to private/link-local still pass the string check — same class as client-side DNS rebinding elsewhere.

Draft; CI still running. Review only — human merge (Ty lock on node-rs). Separate from open #40–#43.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 66b8f5c. Configure here.}

[larseidsvoll]

Thanks for the APPROVE. Non-blocking residual on hostname ads that later resolve to private/link-local (DNS rebinding) — agreed, same class as elsewhere; not blocking this PR. Tracking alongside the Bugbot denylist tighten in this PR.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
92.9% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud