Merge branch 'master' into fix/alert-80

Potential fix for code scanning alert no. 80: Server-side request forgery
2026-09-17 09:40:58 +00:00 · 2025-05-18 16:55:10 +08:00 · 2025-05-18 13:48:35 +08:00 · 2025-05-17 14:30:25 +08:00
1 changed files with 9 additions and 1 deletions
@@ -54,7 +54,15 @@ final class DingTalkRobotAlertNotifyHandlerImpl extends AbstractAlertNotifyHandl
            HttpHeaders headers = new HttpHeaders();
            headers.setContentType(MediaType.APPLICATION_JSON);
            HttpEntity<DingTalkWebHookDto> httpEntity = new HttpEntity<>(dingTalkWebHookDto, headers);
-            String webHookUrl = alerterProperties.getDingTalkWebhookUrl() + receiver.getAccessToken();
+            String baseUrl = alerterProperties.getDingTalkWebhookUrl();
+            String accessToken = receiver.getAccessToken();
+            if (StringUtils.isBlank(accessToken) || !accessToken.matches("^[a-zA-Z0-9_-]+$")) {
+                throw new AlertNoticeException("Invalid access token provided for DingTalk webhook.");
+            }
+            String webHookUrl = baseUrl + accessToken;
+            if (!webHookUrl.startsWith(baseUrl)) {
+                throw new AlertNoticeException("Constructed webhook URL does not match the trusted base URL.");
+            }
            ResponseEntity<CommonRobotNotifyResp> responseEntity = restTemplate.postForEntity(webHookUrl,
                    httpEntity, CommonRobotNotifyResp.class);
            if (responseEntity.getStatusCode() == HttpStatus.OK) {
Author	SHA1	Message	Date
tomsun28	849f0b4887	Merge branch 'master' into fix/alert-80	2025-05-18 16:55:10 +08:00
Calvin	cf544ffd64	Merge branch 'master' into fix/alert-80	2025-05-18 13:48:35 +08:00
aias00andCopilot Autofix powered by AI	ffc7a6d1e0	Potential fix for code scanning alert no. 80: Server-side request forgery Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Signed-off-by: aias00 <liuhongyu@apache.org>	2025-05-17 14:30:25 +08:00