[AzureMonitorAutoConfigure] Validate Live Metrics redirect targets

[xiang17]

Description

Adds validation for Live Metrics QuickPulse redirect targets in
azure-monitor-opentelemetry-autoconfigure.

The QuickPulse service can return x-ms-qps-service-endpoint-redirect-v2.
Previously, the SDK accepted the redirect target before applying a trust-boundary
check. This change validates the redirect before storing or using it.

The validator now requires redirect targets to:

• use HTTPS
• omit user info
• use the default HTTPS port
• target either the configured Live Metrics host or a known Azure Monitor Live Metrics domain

Invalid or untrusted redirects are ignored and the SDK continues using its current endpoint (the configured endpoint, or the last successfully validated redirect).

Validation

• mvn -f sdk/monitor/azure-monitor-opentelemetry-autoconfigure/pom.xml -Dtest=QuickPulseCoordinatorTest test

Also verified the submitted PoC against the patched local artifact. The SDK no longer derives or stores the attacker redirect endpoint:

REAL dataSender.redirectEndpointPrefix after one ping cycle : null
endpoint the REAL SDK derived from it ... : null

All SDK Contribution checklist:

• The pull request does not introduce [breaking changes]: Added domain name trust boundary check
• CHANGELOG is updated for new features, bug fixes or other significant changes.
• I have read the contribution guidelines.

General Guidelines and Best Practices

• Title of the pull request is clear and informative.
• There are a small number of commits, each of which have an informative message. This means that previously merged commits do not appear in the history of the PR. For more information on cleaning up the commits in your PR, see this page.

Testing Guidelines

• Pull request includes test coverage for the included changes.

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
35 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Pull request overview

This PR hardens Live Metrics (QuickPulse) redirect handling in azure-monitor-opentelemetry-autoconfigure by validating redirect targets before storing/using them, ensuring redirects stay within a trusted boundary.

Changes:

• Introduces QuickPulseRedirectValidator to validate redirect URLs (HTTPS only, no userinfo, default port, and trusted host boundary).
• Updates QuickPulseCoordinator to apply redirect validation prior to setting the redirect endpoint prefix.
• Adds unit tests covering accepted and rejected redirect scenarios, and updates the module CHANGELOG.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
sdk/monitor/azure-monitor-opentelemetry-autoconfigure/src/test/java/com/azure/monitor/opentelemetry/autoconfigure/implementation/quickpulse/QuickPulseCoordinatorTest.java	Adds tests for trusted vs. untrusted/invalid redirect targets.
sdk/monitor/azure-monitor-opentelemetry-autoconfigure/src/main/java/com/azure/monitor/opentelemetry/autoconfigure/implementation/quickpulse/QuickPulseRedirectValidator.java	New validator implementing redirect URL and trust-boundary checks.
sdk/monitor/azure-monitor-opentelemetry-autoconfigure/src/main/java/com/azure/monitor/opentelemetry/autoconfigure/implementation/quickpulse/QuickPulseCoordinator.java	Applies redirect validation before persisting/using redirect endpoint prefixes.
sdk/monitor/azure-monitor-opentelemetry-autoconfigure/CHANGELOG.md	Documents the redirect validation bug fix.

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.