[sdivyanshu90]

Why

EXP_POSTHOG_HOST was passed to the PostHog client after only removing trailing slashes. A mistaken or injected local environment value could direct aggregate telemetry and the anonymous installation identifier to a remote plaintext endpoint, a credential-bearing URL, a path, or a non-web scheme.

Closes #1031.

What

• Parse the configured PostHog host as an origin before creating a telemetry client.
• Require HTTPS for remote hosts while retaining HTTP for explicit IP loopback and localhost development endpoints.
• Reject credentials, paths, queries, fragments, malformed ports, whitespace, controls, backslashes, percent encoding, and unsupported schemes.
• Keep validation inside telemetry's best-effort failure boundary so invalid configuration returns False without creating a client.
• Cover nine unsafe host forms while preserving the existing HTTPS override and loopback delivery tests.

Validation

• uv run ruff check .
• uv run ruff format --check .
• PYTHONPATH=exp/runtime/gateway/native uv run ty check
• uv run pytest -q exp/common/observability (27 passed)

The checked-in native stub was used for type checking because the local installed extension predates the current gateway API. Full test execution is left to CI; the local serial run was stopped during unrelated long-running integration coverage after the affected package had passed.

Non-goals

This does not change telemetry opt-in behavior, event contents, anonymous identity generation, delivery retries, or PostHog trace ingestion.

[sdivyanshu90]

Hi @SilenNaihin, could you please review this when you have a chance? It validates telemetry host overrides while retaining loopback development support. Thanks!

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge; no actionable correctness, security, or repository-rule violations were identified.

Summary

The PR validates PostHog telemetry host overrides before creating an anonymous identifier or telemetry client.

• Restricts configured values to credential-free HTTP or HTTPS origins.
• Allows plaintext HTTP only for explicit localhost and IP loopback destinations.
• Canonicalizes accepted origins and rejects unsafe URL components and malformed inputs.
• Adds coverage for nine unsafe override forms while retaining HTTPS and loopback behavior.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Telemetry capture requested] --> B{Telemetry enabled and API key present?}
    B -- No --> F[Return False]
    B -- Yes --> C[Parse and validate PostHog origin]
    C --> D{Valid HTTPS origin or HTTP loopback?}
    D -- No --> F
    D -- Yes --> E[Create anonymous ID and PostHog client]
    E --> G[Capture telemetry event]
    G --> H{Capture succeeds?}
    H -- Yes --> I[Return True]
    H -- No --> F

Loading

_{Reviews (1) · Last reviewed commit: "telemetry: validate PostHog host overrid..."}

[sdivyanshu90]

Hi @SilenNaihin @kfallah, could you please review this PR whenever you have some time. Thanks!