Function validateAgentURL

pkg/config/sources.go:489–501

validateAgentURL enforces that an agent URL uses HTTPS, with an exception for http://localhost which is allowed for local development. SSRF protection (rejecting connections to loopback / private / link-local addresses) is done at dial time by [httpclient.NewSSRFSafeTransport] so that DNS rebinding

(rawURL string)

// rebinding cannot be used to bypass it. The SSRF transport is intentionally
// skipped for http://localhost since loopback is the whole point.
func validateAgentURL(rawURL string) error {
	u, err := url.Parse(rawURL)
	if err != nil {
		return fmt.Errorf("invalid URL %q: %w", rawURL, err)
	}
	if u.Scheme != "https" && !isLocalhostHTTP(rawURL) {
		return fmt.Errorf("refusing to load agent from %q: only https:// URLs are allowed (got scheme %q)", rawURL, u.Scheme)
	}
	if u.Host == "" {
		return fmt.Errorf("invalid URL %q: missing host", rawURL)
	}
	return nil
}