faro.receiver sourcemap download fetches client-influenced URLs with no private-IP or redirect validation

[SashaMIT]

Component(s)

faro.receiver

What's wrong?

The faro.receiver component's sourcemap download is enabled by default (download=true) with download_from_origins=["*"]. The receiver then fetches URLs derived from client-supplied signal fields (Filename and the resolved sourceMappingURL) using a bare http.Client. There is no rejection of loopback / RFC1918 / link-local / CGNAT targets, no re-check of download_from_origins against an absolute sourceMappingURL, and no validation of redirect hops. Any client that can send faro signals to the receiver can therefore make the Alloy pod issue GET requests to internal network addresses (cloud metadata endpoints, internal services) and receive the bodies as sourcemap content. I have a fix ready and will link a PR.

Steps to reproduce

1. Run Alloy with a faro.receiver using the default sourcemap settings (download=true, download_from_origins=["*"]).
2. Send a faro signal whose sourcemap reference resolves to an internal address, e.g. http://169.254.169.254/latest/meta-data/ or an RFC1918 service.
3. The receiver fetches the URL server-side and accepts the response body as sourcemap content.

System information

Deployment-independent; any platform running the receiver.

Software version

Observed on main (August 2026); applies to releases with faro.receiver sourcemap download enabled.

Configuration

Default sourcemap download settings: download=true, download_from_origins=["*"].

Logs

N/A

AI disclosure

• This issue was substantially generated with AI assistance.