[AzureMonitorAutoConfigure] Validate ingestion and Live Metrics redirect targets

[xiang17]

Description

Adds trust-boundary validation for server-issued redirect targets in
azure-monitor-opentelemetry-autoconfigure.

Azure Monitor has two redirect mechanisms, and neither was validated:

• Live Metrics (QuickPulse) returns an x-ms-qps-service-endpoint-redirect-v2
  header. The SDK accepted and stored the target without any trust check.
• Ingestion (Breeze) returns HTTP 307/308 with a Location header. The SDK
  followed the target and cached it per connection string, so a single poisoned
  response redirected all subsequent telemetry for that connection string.

Because the same HttpPipeline carries a BearerTokenAuthenticationPolicy scoped to
https://monitor.azure.com/.default, following an attacker-controlled redirect would
attach a freshly signed token — and the telemetry payload — to a foreign host.

Validation

• mvn -f sdk/monitor/azure-monitor-opentelemetry-autoconfigure/pom.xml -Dtest="RedirectPolicyHelperTest,TelemetryItemExporterTest,QuickPulseCoordinatorTest" test

Also verified the submitted PoC against the patched local artifact. The SDK no longer derives or stores the attacker redirect endpoint:

REAL dataSender.redirectEndpointPrefix after one ping cycle : null
endpoint the REAL SDK derived from it ... : null

All SDK Contribution checklist:

• The pull request does not introduce [breaking changes]: Added domain name trust boundary check
• CHANGELOG is updated for new features, bug fixes or other significant changes.
• I have read the contribution guidelines.

General Guidelines and Best Practices

• Title of the pull request is clear and informative.
• There are a small number of commits, each of which have an informative message. This means that previously merged commits do not appear in the history of the PR. For more information on cleaning up the commits in your PR, see this page.

Testing Guidelines

• Pull request includes test coverage for the included changes.

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
35 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Pull request overview

This PR hardens Live Metrics (QuickPulse) redirect handling in azure-monitor-opentelemetry-autoconfigure by validating redirect targets before storing/using them, ensuring redirects stay within a trusted boundary.

Changes:

• Introduces QuickPulseRedirectValidator to validate redirect URLs (HTTPS only, no userinfo, default port, and trusted host boundary).
• Updates QuickPulseCoordinator to apply redirect validation prior to setting the redirect endpoint prefix.
• Adds unit tests covering accepted and rejected redirect scenarios, and updates the module CHANGELOG.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
sdk/monitor/azure-monitor-opentelemetry-autoconfigure/src/test/java/com/azure/monitor/opentelemetry/autoconfigure/implementation/quickpulse/QuickPulseCoordinatorTest.java	Adds tests for trusted vs. untrusted/invalid redirect targets.
sdk/monitor/azure-monitor-opentelemetry-autoconfigure/src/main/java/com/azure/monitor/opentelemetry/autoconfigure/implementation/quickpulse/QuickPulseRedirectValidator.java	New validator implementing redirect URL and trust-boundary checks.
sdk/monitor/azure-monitor-opentelemetry-autoconfigure/src/main/java/com/azure/monitor/opentelemetry/autoconfigure/implementation/quickpulse/QuickPulseCoordinator.java	Applies redirect validation before persisting/using redirect endpoint prefixes.
sdk/monitor/azure-monitor-opentelemetry-autoconfigure/CHANGELOG.md	Documents the redirect validation bug fix.

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.