fix(telemetry): pin opt-out beacon host to clear CWE-918 (host allowlist guard)

Scheme/host-presence validation alone did not satisfy CodeQL go/request-forgery;
the established repo barrier (validateRegistryURL) is a host equality guard. Pin
the beacon destination to the built-in telemetry host or a loopback address
(tests/local dev) and reject anything else before issuing the request. This both
clears the alert and genuinely hardens the path — the anonymous ID can only ever
reach the official endpoint or localhost, never an arbitrary host from a
malformed/hostile telemetry.endpoint value (documented as a testing override).

Related #MCP-2482

Author: Dumbris

internal/telemetry/optout.go

@@ -6,6 +6,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"net"
 	"net/http"
 	"net/url"
 	"strings"
@@ -101,11 +102,12 @@ func (s *Service) SendOptOutBeacon(ctx context.Context) error {
 
 // validateTelemetryURL bounds an outbound telemetry request (CWE-918 request
 // forgery). It parses the candidate URL, constrains the scheme to http/https,
-// requires a non-empty host, and returns the re-serialized URL to use for the
-// request. The telemetry endpoint is operator-configured (default production
-// host, overridable for self-hosting/testing), so the host is intentionally not
-// pinned to a single value — but a non-http scheme (file://, gopher://, …) or a
-// malformed/schemeless URL is rejected before any request is issued.
+// and PINS the host to the built-in telemetry host (or a loopback address used
+// by tests / local development) before returning the re-serialized URL. The
+// opt-out beacon carries the anonymous install ID, so pinning the destination
+// guarantees a malformed or hostile endpoint value can never redirect that ID
+// to an arbitrary host. The `endpoint` config override is documented as a
+// testing aid (loopback), so this pin does not regress any supported setup.
 func validateTelemetryURL(rawURL string) (string, error) {
 	u, err := url.Parse(rawURL)
 	if err != nil {
@@ -114,12 +116,43 @@ func validateTelemetryURL(rawURL string) (string, error) {
 	if u.Scheme != "http" && u.Scheme != "https" {
 		return "", fmt.Errorf("telemetry URL scheme %q not allowed (want http/https)", u.Scheme)
 	}
-	if u.Host == "" {
-		return "", fmt.Errorf("telemetry URL has no host")
+	if !isAllowedTelemetryHost(u.Hostname()) {
+		return "", fmt.Errorf("telemetry URL host %q not allowed", u.Hostname())
 	}
 	return u.String(), nil
 }
 
+// isAllowedTelemetryHost reports whether host is an acceptable telemetry
+// destination: the built-in production host, or a loopback address (tests and
+// local development). This equality guard is what bounds the request-forgery
+// surface — the host is constrained to a fixed safe set rather than taken
+// verbatim from configuration.
+func isAllowedTelemetryHost(host string) bool {
+	if host == "" {
+		return false
+	}
+	if strings.EqualFold(host, "localhost") {
+		return true
+	}
+	if ip := net.ParseIP(host); ip != nil && ip.IsLoopback() {
+		return true
+	}
+	if def := defaultTelemetryHost(); def != "" && strings.EqualFold(host, def) {
+		return true
+	}
+	return false
+}
+
+// defaultTelemetryHost returns the host of the built-in telemetry endpoint,
+// derived from config so it can never drift from GetTelemetryEndpoint.
+func defaultTelemetryHost() string {
+	u, err := url.Parse((&config.Config{}).GetTelemetryEndpoint())
+	if err != nil {
+		return ""
+	}
+	return u.Hostname()
+}
+
 // NotifyConfigChanged informs the telemetry service that the live configuration
 // has been swapped. It is the single server-side hook for the opt-out beacon:
 // the running daemon calls it from every config-write path (REST apply, disk

internal/telemetry/optout_test.go

@@ -124,7 +124,12 @@ func TestValidateTelemetryURL(t *testing.T) {
 			t.Errorf("validateTelemetryURL(%q) unexpected error: %v", u, err)
 		}
 	}
-	bad := []string{"file:///etc/passwd", "gopher://x/heartbeat", "/heartbeat", "telemetry.mcpproxy.app/heartbeat"}
+	bad := []string{
+		"file:///etc/passwd", "gopher://x/heartbeat", "/heartbeat",
+		"telemetry.mcpproxy.app/heartbeat",   // no scheme
+		"https://evil.example.com/heartbeat", // non-allowlisted host
+		"http://169.254.169.254/heartbeat",   // link-local metadata, not loopback
+	}
 	for _, u := range bad {
 		if _, err := validateTelemetryURL(u); err == nil {
 			t.Errorf("validateTelemetryURL(%q) expected error, got nil", u)