Potential fix for code scanning alert no. 79: Server-side request forgery

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Signed-off-by: aias00 <liuhongyu@apache.org>

hertzbeat-alerter/src/main/java/org/apache/hertzbeat/alert/notice/impl/DingTalkRobotAlertNotifyHandlerImpl.java

@@ -54,7 +54,15 @@ final class DingTalkRobotAlertNotifyHandlerImpl extends AbstractAlertNotifyHandl
             HttpHeaders headers = new HttpHeaders();
             headers.setContentType(MediaType.APPLICATION_JSON);
             HttpEntity<DingTalkWebHookDto> httpEntity = new HttpEntity<>(dingTalkWebHookDto, headers);
-            String webHookUrl = alerterProperties.getDingTalkWebhookUrl() + receiver.getAccessToken();
+            String baseUrl = alerterProperties.getDingTalkWebhookUrl();
+            String accessToken = receiver.getAccessToken();
+            if (StringUtils.isBlank(accessToken) || !accessToken.matches("^[a-zA-Z0-9_-]{20,50}$")) {
+                throw new AlertNoticeException("Invalid access token provided for DingTalk webhook.");
+            }
+            String webHookUrl = baseUrl + accessToken;
+            if (!webHookUrl.startsWith(baseUrl)) {
+                throw new AlertNoticeException("Constructed webhook URL is not within the trusted domain.");
+            }
             ResponseEntity<CommonRobotNotifyResp> responseEntity = restTemplate.postForEntity(webHookUrl,
                     httpEntity, CommonRobotNotifyResp.class);
             if (responseEntity.getStatusCode() == HttpStatus.OK) {