fix(telemetry): validate opt-out beacon URL (scheme/host) to clear CWE-918

Apply the repo's established request-forgery barrier (mirror validateRegistryURL):
parse the configured telemetry endpoint, constrain the scheme to http/https,
require a host, and issue the beacon against the re-serialized URL. Rejects
file://, gopher://, and schemeless/malformed endpoints before any request.

Related #MCP-2482

Author: Dumbris

internal/telemetry/optout.go

@@ -7,6 +7,8 @@ import (
 	"errors"
 	"fmt"
 	"net/http"
+	"net/url"
+	"strings"
 
 	"go.uber.org/zap"
 
@@ -71,8 +73,16 @@ func (s *Service) SendOptOutBeacon(ctx context.Context) error {
 		return fmt.Errorf("opt-out beacon failed anonymity scan: %w", scanErr)
 	}
 
-	url := s.endpoint + "/heartbeat"
-	req, err := http.NewRequestWithContext(ctx, http.MethodPost, url, bytes.NewReader(data))
+	// Bound the outbound request (CWE-918 request forgery): the endpoint is a
+	// configured value, so re-parse it, constrain the scheme to http/https,
+	// require a host, and issue the request against the re-serialized URL. This
+	// mirrors validateRegistryURL and guarantees a malformed/non-http endpoint
+	// can never aim the beacon at, e.g., file:// or a schemeless host.
+	beaconURL, err := validateTelemetryURL(strings.TrimRight(s.endpoint, "/") + "/heartbeat")
+	if err != nil {
+		return err
+	}
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, beaconURL, bytes.NewReader(data))
 	if err != nil {
 		return fmt.Errorf("build opt-out request: %w", err)
 	}
@@ -89,6 +99,27 @@ func (s *Service) SendOptOutBeacon(ctx context.Context) error {
 	return nil
 }
 
+// validateTelemetryURL bounds an outbound telemetry request (CWE-918 request
+// forgery). It parses the candidate URL, constrains the scheme to http/https,
+// requires a non-empty host, and returns the re-serialized URL to use for the
+// request. The telemetry endpoint is operator-configured (default production
+// host, overridable for self-hosting/testing), so the host is intentionally not
+// pinned to a single value — but a non-http scheme (file://, gopher://, …) or a
+// malformed/schemeless URL is rejected before any request is issued.
+func validateTelemetryURL(rawURL string) (string, error) {
+	u, err := url.Parse(rawURL)
+	if err != nil {
+		return "", fmt.Errorf("invalid telemetry URL: %w", err)
+	}
+	if u.Scheme != "http" && u.Scheme != "https" {
+		return "", fmt.Errorf("telemetry URL scheme %q not allowed (want http/https)", u.Scheme)
+	}
+	if u.Host == "" {
+		return "", fmt.Errorf("telemetry URL has no host")
+	}
+	return u.String(), nil
+}
+
 // NotifyConfigChanged informs the telemetry service that the live configuration
 // has been swapped. It is the single server-side hook for the opt-out beacon:
 // the running daemon calls it from every config-write path (REST apply, disk

internal/telemetry/optout_test.go

@@ -117,6 +117,21 @@ func TestSendOptOutBeacon_PayloadShape(t *testing.T) {
 	}
 }
 
+func TestValidateTelemetryURL(t *testing.T) {
+	ok := []string{"https://telemetry.mcpproxy.app/v1/heartbeat", "http://127.0.0.1:8080/heartbeat"}
+	for _, u := range ok {
+		if _, err := validateTelemetryURL(u); err != nil {
+			t.Errorf("validateTelemetryURL(%q) unexpected error: %v", u, err)
+		}
+	}
+	bad := []string{"file:///etc/passwd", "gopher://x/heartbeat", "/heartbeat", "telemetry.mcpproxy.app/heartbeat"}
+	for _, u := range bad {
+		if _, err := validateTelemetryURL(u); err == nil {
+			t.Errorf("validateTelemetryURL(%q) expected error, got nil", u)
+		}
+	}
+}
+
 // TestNotifyConfigChanged_FiresExactlyOnceOnDisable verifies the server-side
 // transition detection: an enabled->disabled config swap emits exactly one
 // opt-out beacon carrying the anonymous ID.