feat: harden HTTP clients, dashboard server, and hook system by I4cTime · Pull Request #4 · I4cTime/quantum_ring

I4cTime · 2026-03-23T15:02:21Z

Summary

Shared HTTP helper (src/utils/http-request.ts): Extracts duplicated node:http/node:https logic from validate.ts and hooks.ts into a single typed helper with configurable timeout and 64 KiB response body cap
Dashboard pathname routing: Fixes route matching to parse URL.pathname instead of raw req.url, so query strings (e.g. /events?retry=true) no longer break SSE and API endpoints
SSE backpressure: broadcast() now checks writableEnded/destroyed before writing and drops slow clients when write() returns false, preventing unbounded memory growth
SSRF mitigation: HTTP hook URLs targeting private/loopback/link-local IP ranges are blocked by default with DNS resolution pre-check; override with Q_RING_ALLOW_PRIVATE_HOOKS=1; blocked requests log a policy_deny audit event
CORS cleanup: Removed unnecessary Access-Control-Allow-Origin: * headers from the localhost-only dashboard endpoints
Offline dashboard: Replaced Google Fonts CDN links and remote icon with system font stacks and inline SVG — dashboard now works fully air-gapped
Docs: Added SSRF protection documentation to README hooks section

Test plan

pnpm run typecheck passes
pnpm run build passes
Open dashboard (qring status), confirm SSE updates at /events, JSON at /api/status, HTML at /
Test with query string: /events?test=1 should still stream
Verify SSRF block: register a hook with http://127.0.0.1 URL, confirm it is blocked
Verify SSRF override: set Q_RING_ALLOW_PRIVATE_HOOKS=1, confirm local hooks work

Made with Cursor

- Add shared HTTP helper (src/utils/http-request.ts) with timeout and 64 KiB response body cap; refactor validate.ts and hooks.ts to use it - Fix dashboard route matching to parse URL pathname (query strings no longer break /events and /api/status) - Add SSE broadcast backpressure: drop destroyed or slow clients - Block SSRF on HTTP hooks by default (private/loopback/link-local IP ranges); override with Q_RING_ALLOW_PRIVATE_HOOKS=1 - Remove unnecessary CORS wildcard headers from localhost dashboard - Replace external Google Fonts and remote icon in dashboard HTML with system font stacks and inline SVG for full offline operation - Document SSRF protection in README Made-with: Cursor

Copilot

Pull request overview

This PR hardens network-facing components by extracting a shared HTTP request helper, improving dashboard routing/backpressure handling, and adding SSRF protections for HTTP hooks, alongside dashboard offline asset cleanup and documentation updates.

Changes:

Introduces a shared httpRequest_ helper with timeouts and response-size caps, and migrates validation/hooks to use it.
Updates dashboard routing to use URL.pathname and adjusts SSE broadcasting/backpressure behavior.
Adds SSRF mitigation for HTTP hooks with private-IP blocking (opt-out via env var) and documents the behavior.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
src/utils/http-request.ts	Adds shared HTTP(S) request helper with timeout + response body cap
src/core/validate.ts	Replaces duplicated request code with shared HTTP helper
src/core/hooks.ts	Uses shared HTTP helper; adds SSRF pre-checks for HTTP hooks and audit logging
src/core/dashboard.ts	Fixes route matching via pathname parsing; adjusts SSE broadcast backpressure handling
src/core/dashboard-html.ts	Removes external font/icon dependencies; switches to system fonts + inline SVG
README.md	Documents SSRF protection and override env var for hooks
.github/workflows/nextjs.yml	Bumps Next.js workflow Node version

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

I4cTime · 2026-03-23T15:26:16Z

@copilot open a new pull request to apply changes based on the comments in this thread

Copilot · 2026-03-23T15:26:24Z

@I4cTime I've opened a new pull request, #5, to work on those changes. Once the pull request is ready, I'll request review from you.

…eview feedback (#5) * Initial plan * fix: address all 7 review comments on HTTP helper, dashboard, and hooks Co-authored-by: I4cTime <24039758+I4cTime@users.noreply.github.com> Agent-Logs-Url: https://github.com/I4cTime/quantum_ring/sessions/f98e4751-fde3-4773-832f-4daaafdb62be --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: I4cTime <24039758+I4cTime@users.noreply.github.com>

@theme

* feat(web): add Next.js site with deploy and CI workflows Made-with: Cursor * feat: harden HTTP clients, dashboard server, and hook system (#4) * feat: harden HTTP clients, dashboard server, and hook system - Add shared HTTP helper (src/utils/http-request.ts) with timeout and 64 KiB response body cap; refactor validate.ts and hooks.ts to use it - Fix dashboard route matching to parse URL pathname (query strings no longer break /events and /api/status) - Add SSE broadcast backpressure: drop destroyed or slow clients - Block SSRF on HTTP hooks by default (private/loopback/link-local IP ranges); override with Q_RING_ALLOW_PRIVATE_HOOKS=1 - Remove unnecessary CORS wildcard headers from localhost dashboard - Replace external Google Fonts and remote icon in dashboard HTML with system font stacks and inline SVG for full offline operation - Document SSRF protection in README Made-with: Cursor * fix: harden HTTP helper, dashboard server, and SSRF hook checks per review feedback (#5) * Initial plan * fix: address all 7 review comments on HTTP helper, dashboard, and hooks Co-authored-by: I4cTime <24039758+I4cTime@users.noreply.github.com> Agent-Logs-Url: https://github.com/I4cTime/quantum_ring/sessions/f98e4751-fde3-4773-832f-4daaafdb62be --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: I4cTime <24039758+I4cTime@users.noreply.github.com> --------- Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com> Co-authored-by: I4cTime <24039758+I4cTime@users.noreply.github.com> * feat(web): Tailwind v4, motion, docs/changelog, mobile nav - Add Tailwind CSS v4 with @theme tokens and PostCSS - Add Framer Motion (motion) FadeIn, StaggerGroup, animated stats - CopyableTerminal with copy buttons; remove RevealObserver - Mobile nav with focus trap, Docs/Changelog routes - Interactive Architecture tooltips and scroll targets - Getting Started (/docs) and Changelog (/changelog) pages - Skip link, main landmark, reduced-motion for WebGL Made-with: Cursor * chore: bump version to v0.4.1 Made-with: Cursor * chore: bump version to v0.9.0 Made-with: Cursor --------- Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com> Co-authored-by: I4cTime <24039758+I4cTime@users.noreply.github.com>

@theme

* feat(web): add Next.js site with deploy and CI workflows Made-with: Cursor * feat: harden HTTP clients, dashboard server, and hook system (#4) * feat: harden HTTP clients, dashboard server, and hook system - Add shared HTTP helper (src/utils/http-request.ts) with timeout and 64 KiB response body cap; refactor validate.ts and hooks.ts to use it - Fix dashboard route matching to parse URL pathname (query strings no longer break /events and /api/status) - Add SSE broadcast backpressure: drop destroyed or slow clients - Block SSRF on HTTP hooks by default (private/loopback/link-local IP ranges); override with Q_RING_ALLOW_PRIVATE_HOOKS=1 - Remove unnecessary CORS wildcard headers from localhost dashboard - Replace external Google Fonts and remote icon in dashboard HTML with system font stacks and inline SVG for full offline operation - Document SSRF protection in README Made-with: Cursor * fix: harden HTTP helper, dashboard server, and SSRF hook checks per review feedback (#5) * Initial plan * fix: address all 7 review comments on HTTP helper, dashboard, and hooks Co-authored-by: I4cTime <24039758+I4cTime@users.noreply.github.com> Agent-Logs-Url: https://github.com/I4cTime/quantum_ring/sessions/f98e4751-fde3-4773-832f-4daaafdb62be --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: I4cTime <24039758+I4cTime@users.noreply.github.com> --------- Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com> Co-authored-by: I4cTime <24039758+I4cTime@users.noreply.github.com> * feat(web): Tailwind v4, motion, docs/changelog, mobile nav - Add Tailwind CSS v4 with @theme tokens and PostCSS - Add Framer Motion (motion) FadeIn, StaggerGroup, animated stats - CopyableTerminal with copy buttons; remove RevealObserver - Mobile nav with focus trap, Docs/Changelog routes - Interactive Architecture tooltips and scroll targets - Getting Started (/docs) and Changelog (/changelog) pages - Skip link, main landmark, reduced-motion for WebGL Made-with: Cursor * chore: bump version to v0.4.1 Made-with: Cursor * chore: bump version to v0.9.0 Made-with: Cursor * docs: add missing Tier 4-6 features to CHANGELOG, web site, and MCP listings (#7) The Tier 4-6 features (composite secrets, approvals, JIT provisioning, exec/redaction, scanner, linter, agent memory, context, governance, team/org scopes, rotation, CI validation, audit verify/export, analytics, wizard, pre-commit hook) were shipped in v0.9.0 but never recorded in the CHANGELOG or reflected on the landing site. - CHANGELOG.md: consolidate 17 missing entries into [0.9.0] - web/app/changelog/page.tsx: match CHANGELOG with full 0.9.0 entry - web/components/McpSection.tsx: add 3 tool groups (15 tools), fix count 31→44 - web/components/Features.tsx: add 11 feature cards, update count 13→24 - web/components/Architecture.tsx: add 8 missing core modules - web/components/Stats.tsx: remove Tiers/Platforms cards, keep MCP Tools + Features Made-with: Cursor --------- Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com> Co-authored-by: I4cTime <24039758+I4cTime@users.noreply.github.com>

@theme

* feat(web): add Next.js site with deploy and CI workflows Made-with: Cursor * feat: harden HTTP clients, dashboard server, and hook system (#4) * feat: harden HTTP clients, dashboard server, and hook system - Add shared HTTP helper (src/utils/http-request.ts) with timeout and 64 KiB response body cap; refactor validate.ts and hooks.ts to use it - Fix dashboard route matching to parse URL pathname (query strings no longer break /events and /api/status) - Add SSE broadcast backpressure: drop destroyed or slow clients - Block SSRF on HTTP hooks by default (private/loopback/link-local IP ranges); override with Q_RING_ALLOW_PRIVATE_HOOKS=1 - Remove unnecessary CORS wildcard headers from localhost dashboard - Replace external Google Fonts and remote icon in dashboard HTML with system font stacks and inline SVG for full offline operation - Document SSRF protection in README Made-with: Cursor * fix: harden HTTP helper, dashboard server, and SSRF hook checks per review feedback (#5) * Initial plan * fix: address all 7 review comments on HTTP helper, dashboard, and hooks Co-authored-by: I4cTime <24039758+I4cTime@users.noreply.github.com> Agent-Logs-Url: https://github.com/I4cTime/quantum_ring/sessions/f98e4751-fde3-4773-832f-4daaafdb62be --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: I4cTime <24039758+I4cTime@users.noreply.github.com> --------- Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com> Co-authored-by: I4cTime <24039758+I4cTime@users.noreply.github.com> * feat(web): Tailwind v4, motion, docs/changelog, mobile nav - Add Tailwind CSS v4 with @theme tokens and PostCSS - Add Framer Motion (motion) FadeIn, StaggerGroup, animated stats - CopyableTerminal with copy buttons; remove RevealObserver - Mobile nav with focus trap, Docs/Changelog routes - Interactive Architecture tooltips and scroll targets - Getting Started (/docs) and Changelog (/changelog) pages - Skip link, main landmark, reduced-motion for WebGL Made-with: Cursor * chore: bump version to v0.4.1 Made-with: Cursor * chore: bump version to v0.9.0 Made-with: Cursor * docs: add missing Tier 4-6 features to CHANGELOG, web site, and MCP listings (#7) The Tier 4-6 features (composite secrets, approvals, JIT provisioning, exec/redaction, scanner, linter, agent memory, context, governance, team/org scopes, rotation, CI validation, audit verify/export, analytics, wizard, pre-commit hook) were shipped in v0.9.0 but never recorded in the CHANGELOG or reflected on the landing site. - CHANGELOG.md: consolidate 17 missing entries into [0.9.0] - web/app/changelog/page.tsx: match CHANGELOG with full 0.9.0 entry - web/components/McpSection.tsx: add 3 tool groups (15 tools), fix count 31→44 - web/components/Features.tsx: add 11 feature cards, update count 13→24 - web/components/Architecture.tsx: add 8 missing core modules - web/components/Stats.tsx: remove Tiers/Platforms cards, keep MCP Tools + Features Made-with: Cursor * chore: bump version to v0.9.1 Made-with: Cursor --------- Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com> Co-authored-by: I4cTime <24039758+I4cTime@users.noreply.github.com>

I4cTime requested a review from Copilot March 23, 2026 15:18

Copilot started reviewing on behalf of I4cTime March 23, 2026 15:19 View session

Copilot AI reviewed Mar 23, 2026

View reviewed changes

Copilot AI mentioned this pull request Mar 23, 2026

fix: harden HTTP helper, dashboard server, and SSRF hook checks per review feedback #5

Merged

I4cTime merged commit eb585e8 into develop Mar 23, 2026
4 checks passed

I4cTime deleted the feat/network-improvements branch March 23, 2026 15:42

This was referenced Mar 26, 2026

fix: resolve double-escaping vulnerability and picomatch alerts #35

Merged

Release v0.9.6 #36

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat: harden HTTP clients, dashboard server, and hook system#4

feat: harden HTTP clients, dashboard server, and hook system#4
I4cTime merged 2 commits intodevelopfrom
feat/network-improvements

I4cTime commented Mar 23, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

I4cTime commented Mar 23, 2026

Uh oh!

Copilot AI commented Mar 23, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

I4cTime commented Mar 23, 2026

Summary

Test plan

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

I4cTime commented Mar 23, 2026

Uh oh!

Copilot AI commented Mar 23, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants