Potential fix for code scanning alert no. 73: Uncontrolled data used in path expression

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Signed-off-by: aias00 <liuhongyu@apache.org>

hertzbeat-manager/src/main/java/org/apache/hertzbeat/manager/service/impl/AppServiceImpl.java

@@ -666,6 +666,7 @@ public class AppServiceImpl implements AppService, InitializingBean {
 
         @Override
         public void save(String app, String ymlContent) {
+            validateAppName(app);
             var classpath = Objects.requireNonNull(this.getClass().getClassLoader().getResource("")).getPath();
             var defineAppPath = classpath + "define" + File.separator + "app-" + app + ".yml";
             var defineAppFile = new File(defineAppPath);
@@ -673,18 +674,19 @@ public class AppServiceImpl implements AppService, InitializingBean {
                 FileUtils.writeStringToFile(defineAppFile, ymlContent, StandardCharsets.UTF_8, false);
             } catch (Exception e) {
                 log.error(e.getMessage());
-                throw new RuntimeException("flush file " + defineAppPath + " error: " + e.getMessage());
+                throw new RuntimeException("Flush file " + defineAppPath + " error: " + e.getMessage());
             }
         }
 
         @Override
         public void delete(String app) {
+            validateAppName(app);
             var classpath = Objects.requireNonNull(this.getClass().getClassLoader().getResource("")).getPath();
             var defineAppPath = classpath + "define" + File.separator + "app-" + app + ".yml";
             var defineAppFile = new File(defineAppPath);
 
-            if (!defineAppFile.exists() && appDefines.containsKey(app.toLowerCase())){
-                throw new CommonException("the app define file is not in current file server provider");
+            if (!defineAppFile.exists() && appDefines.containsKey(app.toLowerCase())) {
+                throw new CommonException("The app define file is not in the current file server provider");
             }
 
             if (defineAppFile.exists() && defineAppFile.isFile()) {
@@ -694,6 +696,15 @@ public class AppServiceImpl implements AppService, InitializingBean {
         }
     }
 
+    private void validateAppName(String app) {
+        if (app == null || app.isEmpty() || app.contains("..") || app.contains("/") || app.contains("\\")) {
+            throw new IllegalArgumentException("Invalid app name: " + app);
+        }
+        if (!app.matches("^[a-zA-Z0-9_-]+$")) {
+            throw new IllegalArgumentException("App name must only contain alphanumeric characters, dashes, or underscores: " + app);
+        }
+    }
+
     private class ObjectStoreAppDefineStoreImpl implements AppDefineStore {
 
         @Override