Merge branch 'master' into fix/alert-53

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Signed-off-by: aias00 <liuhongyu@apache.org>

hertzbeat-warehouse/src/main/java/org/apache/hertzbeat/warehouse/controller/MetricsDataController.java

@@ -17,8 +17,6 @@
 
 package org.apache.hertzbeat.warehouse.controller;
 
-import static org.apache.hertzbeat.common.constants.CommonConstants.FAIL_CODE;
-import static org.springframework.http.MediaType.APPLICATION_JSON_VALUE;
 import io.swagger.v3.oas.annotations.Operation;
 import io.swagger.v3.oas.annotations.Parameter;
 import io.swagger.v3.oas.annotations.tags.Tag;
@@ -33,6 +31,9 @@ import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RequestParam;
 import org.springframework.web.bind.annotation.RestController;
 
+import static org.apache.hertzbeat.common.constants.CommonConstants.FAIL_CODE;
+import static org.springframework.http.MediaType.APPLICATION_JSON_VALUE;
+
 /**
  * Indicator data query interface
  */
@@ -99,7 +100,9 @@ public class MetricsDataController {
         String app = names[0];
         String metrics = names[1];
         String metric = names[2];
+        
         MetricsHistoryData historyData = metricsDataService.getMetricHistoryData(monitorId, app, metrics, metric, label, history, interval);
         return ResponseEntity.ok(Message.success(historyData));
     }
+
 }

hertzbeat-warehouse/src/main/java/org/apache/hertzbeat/warehouse/store/history/vm/VictoriaMetricsDataStorage.java

@@ -361,7 +361,12 @@ public class VictoriaMetricsDataStorage extends AbstractHistoryDataStorage {
                         + SignConstants.BLANK + encodedAuth);
             }
             HttpEntity<Void> httpEntity = new HttpEntity<>(headers);
-            URI uri = UriComponentsBuilder.fromHttpUrl(victoriaMetricsProp.url() + QUERY_RANGE_PATH)
+            // Ensure victoriaMetricsProp.url() is a trusted base URL
+            String baseUrl = victoriaMetricsProp.url();
+            if (!isTrustedBaseUrl(baseUrl)) {
+                throw new IllegalStateException("Untrusted base URL: " + baseUrl);
+            }
+            URI uri = UriComponentsBuilder.fromHttpUrl(baseUrl + QUERY_RANGE_PATH)
                     .queryParam(URLEncoder.encode("query", StandardCharsets.UTF_8), URLEncoder.encode("{" + timeSeriesSelector + "}", StandardCharsets.UTF_8))
                     .queryParam("step", "4h")
                     .queryParam("start", startTime)
@@ -532,4 +537,9 @@ public class VictoriaMetricsDataStorage extends AbstractHistoryDataStorage {
          */
         private Long[] timestamps;
     }
+
+    private boolean isTrustedBaseUrl(String url) {
+        // Define a trusted base URL
+        return url.equals("http://trusted-victoriametrics-server.com");
+    }
 }