Merge branch 'master' into fix/fix-alert-88

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Signed-off-by: aias00 <liuhongyu@apache.org>

hertzbeat-alerter/src/main/java/org/apache/hertzbeat/alert/notice/impl/WeComRobotAlertNotifyHandlerImpl.java

@@ -57,7 +57,12 @@ final class WeComRobotAlertNotifyHandlerImpl extends AbstractAlertNotifyHandlerI
             HttpHeaders headers = new HttpHeaders();
             headers.setContentType(MediaType.APPLICATION_JSON);
             HttpEntity<WeWorkWebHookDto> httpEntity = new HttpEntity<>(weWorkWebHookDTO, headers);
-            String webHookUrl = alerterProperties.getWeWorkWebhookUrl() + receiver.getWechatId();
+            String wechatId = receiver.getWechatId();
+            if (!isValidWechatId(wechatId)) {
+                log.warn("Invalid WeChat ID: {}", wechatId);
+                throw new AlertNoticeException("Invalid WeChat ID provided.");
+            }
+            String webHookUrl = alerterProperties.getWeWorkWebhookUrl() + wechatId;
             ResponseEntity<CommonRobotNotifyResp> entity = restTemplate.postForEntity(webHookUrl, httpEntity, CommonRobotNotifyResp.class);
             if (entity.getStatusCode() == HttpStatus.OK) {
                 assert entity.getBody() != null;
@@ -170,4 +175,15 @@ final class WeComRobotAlertNotifyHandlerImpl extends AbstractAlertNotifyHandlerI
         }
 
     }
+    
+    /**
+     * Validate the WeChat ID to ensure it meets the expected format.
+     *
+     * @param wechatId the WeChat ID to validate
+     * @return true if valid, false otherwise
+     */
+    private boolean isValidWechatId(String wechatId) {
+        // Example validation: ensure the ID is alphanumeric and non-empty
+        return StringUtils.isNotBlank(wechatId) && wechatId.matches("^[a-zA-Z0-9_-]+$");
+    }
 }

hertzbeat-alerter/src/test/java/org/apache/hertzbeat/alert/notice/impl/WeComRobotAlertNotifyHandlerImplTest.java

@@ -48,7 +48,7 @@ import java.util.ResourceBundle;
  */
 @ExtendWith(MockitoExtension.class)
 class WeComRobotAlertNotifyHandlerImplTest {
-
+    
     @Mock
     private RestTemplate restTemplate;
     
@@ -57,20 +57,21 @@ class WeComRobotAlertNotifyHandlerImplTest {
     
     @Mock
     private ResourceBundle bundle;
-
+    
     @InjectMocks
     private WeComRobotAlertNotifyHandlerImpl weComRobotAlertNotifyHandler;
-
+    
     private NoticeReceiver receiver;
     private GroupAlert groupAlert;
     private NoticeTemplate template;
-
+    
     @BeforeEach
     public void setUp() {
         receiver = new NoticeReceiver();
         receiver.setId(1L);
         receiver.setName("test-receiver");
         receiver.setAccessToken("test-token");
+        receiver.setWechatId("test-wechat-id");
         
         groupAlert = new GroupAlert();
         SingleAlert singleAlert = new SingleAlert();
@@ -95,33 +96,29 @@ class WeComRobotAlertNotifyHandlerImplTest {
     public void testNotifyAlertSuccess() {
         CommonRobotNotifyResp successResp = new CommonRobotNotifyResp();
         successResp.setErrCode(0);
-        ResponseEntity<CommonRobotNotifyResp> responseEntity =
-                new ResponseEntity<>(successResp, HttpStatus.OK);
-
+        ResponseEntity<CommonRobotNotifyResp> responseEntity = new ResponseEntity<>(successResp, HttpStatus.OK);
+        
         when(restTemplate.postForEntity(
                 any(String.class),
                 any(),
-                eq(CommonRobotNotifyResp.class)
-        )).thenReturn(responseEntity);
+                eq(CommonRobotNotifyResp.class))).thenReturn(responseEntity);
         
         weComRobotAlertNotifyHandler.send(receiver, template, groupAlert);
     }
-
+    
     @Test
     public void testNotifyAlertFailure() {
         CommonRobotNotifyResp failResp = new CommonRobotNotifyResp();
         failResp.setCode(1);
         failResp.setErrMsg("Test Error");
-        ResponseEntity<CommonRobotNotifyResp> responseEntity =
-                new ResponseEntity<>(failResp, HttpStatus.OK);
-
+        ResponseEntity<CommonRobotNotifyResp> responseEntity = new ResponseEntity<>(failResp, HttpStatus.OK);
+        
         when(restTemplate.postForEntity(
                 any(String.class),
                 any(),
-                eq(CommonRobotNotifyResp.class)
-        )).thenReturn(responseEntity);
+                eq(CommonRobotNotifyResp.class))).thenReturn(responseEntity);
         
-        assertThrows(AlertNoticeException.class, 
+        assertThrows(AlertNoticeException.class,
                 () -> weComRobotAlertNotifyHandler.send(receiver, template, groupAlert));
     }
 }