Merge branch 'master' into fix/alert-86

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Signed-off-by: aias00 <liuhongyu@apache.org>

hertzbeat-alerter/src/main/java/org/apache/hertzbeat/alert/notice/impl/TelegramBotAlertNotifyHandlerImpl.java

@@ -42,9 +42,14 @@ import org.springframework.stereotype.Component;
 final class TelegramBotAlertNotifyHandlerImpl extends AbstractAlertNotifyHandlerImpl {
 
     @Override
-    public void send(NoticeReceiver receiver, NoticeTemplate noticeTemplate, GroupAlert alert) throws AlertNoticeException {
+    public void send(NoticeReceiver receiver, NoticeTemplate noticeTemplate, GroupAlert alert)
+            throws AlertNoticeException {
         try {
-            String url = String.format(alerterProperties.getTelegramWebhookUrl(), receiver.getTgBotToken());
+            String token = receiver.getTgBotToken();
+            if (!isValidTelegramToken(token)) {
+                throw new AlertNoticeException("Invalid Telegram Bot Token");
+            }
+            String url = String.format(alerterProperties.getTelegramWebhookUrl(), token);
             TelegramBotNotifyDTO notifyBody = TelegramBotNotifyDTO.builder()
                     .chatId(receiver.getTgUserId())
                     .text(renderContent(noticeTemplate, alert))
@@ -54,7 +59,8 @@ final class TelegramBotAlertNotifyHandlerImpl extends AbstractAlertNotifyHandler
             HttpHeaders headers = new HttpHeaders();
             headers.setContentType(MediaType.APPLICATION_JSON);
             HttpEntity<TelegramBotNotifyDTO> telegramEntity = new HttpEntity<>(notifyBody, headers);
-            ResponseEntity<TelegramBotNotifyResponse> entity = restTemplate.postForEntity(url, telegramEntity, TelegramBotNotifyResponse.class);
+            ResponseEntity<TelegramBotNotifyResponse> entity = restTemplate.postForEntity(url, telegramEntity,
+                    TelegramBotNotifyResponse.class);
             if (entity.getStatusCode() == HttpStatus.OK && entity.getBody() != null) {
                 TelegramBotNotifyResponse body = entity.getBody();
                 if (body.ok) {
@@ -99,4 +105,10 @@ final class TelegramBotAlertNotifyHandlerImpl extends AbstractAlertNotifyHandler
         private String description;
     }
 
+    private boolean isValidTelegramToken(String token) {
+        // Adjusted pattern to match real Telegram Bot tokens like
+        // 110201543:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsaw
+        String tokenPattern = "^[0-9]+:[a-zA-Z0-9_-]+$";
+        return token != null && token.matches(tokenPattern);
+    }
 }

hertzbeat-alerter/src/test/java/org/apache/hertzbeat/alert/notice/impl/TelegramBotAlertNotifyHandlerImplTest.java

@@ -20,6 +20,7 @@ package org.apache.hertzbeat.alert.notice.impl;
 import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.lenient;
 import static org.mockito.Mockito.when;
 
 import org.apache.hertzbeat.alert.AlerterProperties;
@@ -51,10 +52,10 @@ class TelegramBotAlertNotifyHandlerImplTest {
 
     @Mock
     private RestTemplate restTemplate;
-    
+
     @Mock
     private AlerterProperties alerterProperties;
-    
+
     @Mock
     private ResourceBundle bundle;
 
@@ -70,58 +71,57 @@ class TelegramBotAlertNotifyHandlerImplTest {
         receiver = new NoticeReceiver();
         receiver.setId(1L);
         receiver.setName("test-receiver");
-        receiver.setAccessToken("test-token");
+        receiver.setTgBotToken("123456:ABC-DEF1234ghIkl-zyx57W2v1u123ew11");
         receiver.setTgUserId("123456789"); // Telegram specific - chat ID
-        
+
         groupAlert = new GroupAlert();
         SingleAlert singleAlert = new SingleAlert();
         singleAlert.setLabels(new HashMap<>());
         singleAlert.getLabels().put("severity", "critical");
         singleAlert.getLabels().put("alertname", "Test Alert");
-        
+
         List<SingleAlert> alerts = new ArrayList<>();
         alerts.add(singleAlert);
         groupAlert.setAlerts(alerts);
-        
+
         template = new NoticeTemplate();
         template.setId(1L);
         template.setName("test-template");
         template.setContent("test content");
-        
-        when(alerterProperties.getTelegramWebhookUrl()).thenReturn("https://api.telegram.org/bot%s/sendMessage");
-        when(bundle.getString("alerter.notify.title")).thenReturn("Alert Notification");
+
+        lenient().when(alerterProperties.getTelegramWebhookUrl())
+                .thenReturn("https://api.telegram.org/bot%s/sendMessage");
+        lenient().when(bundle.getString("alerter.notify.title")).thenReturn("Alert Notification");
     }
 
     @Test
     public void testNotifyAlertSuccess() {
-        TelegramBotAlertNotifyHandlerImpl.TelegramBotNotifyResponse successResp = 
-            new TelegramBotAlertNotifyHandlerImpl.TelegramBotNotifyResponse();
+        TelegramBotAlertNotifyHandlerImpl.TelegramBotNotifyResponse successResp = new TelegramBotAlertNotifyHandlerImpl.TelegramBotNotifyResponse();
         successResp.setOk(true);
         successResp.setDescription("Test Success");
-        
-        ResponseEntity<TelegramBotAlertNotifyHandlerImpl.TelegramBotNotifyResponse> responseEntity = 
-            new ResponseEntity<>(successResp, HttpStatus.OK);
-        
-        when(restTemplate.postForEntity(any(String.class), any(), 
+
+        ResponseEntity<TelegramBotAlertNotifyHandlerImpl.TelegramBotNotifyResponse> responseEntity = new ResponseEntity<>(
+                successResp, HttpStatus.OK);
+
+        when(restTemplate.postForEntity(any(String.class), any(),
                 eq(TelegramBotAlertNotifyHandlerImpl.TelegramBotNotifyResponse.class))).thenReturn(responseEntity);
-        
+
         telegramBotAlertNotifyHandler.send(receiver, template, groupAlert);
     }
 
     @Test
     public void testNotifyAlertFailure() {
-        TelegramBotAlertNotifyHandlerImpl.TelegramBotNotifyResponse successResp =
-                new TelegramBotAlertNotifyHandlerImpl.TelegramBotNotifyResponse();
-        successResp.setOk(false);
-        successResp.setDescription("Test failed");
+        TelegramBotAlertNotifyHandlerImpl.TelegramBotNotifyResponse failureResp = new TelegramBotAlertNotifyHandlerImpl.TelegramBotNotifyResponse();
+        failureResp.setOk(false);
+        failureResp.setDescription("Test failed");
 
-        ResponseEntity<TelegramBotAlertNotifyHandlerImpl.TelegramBotNotifyResponse> responseEntity =
-                new ResponseEntity<>(successResp, HttpStatus.BAD_REQUEST);
+        ResponseEntity<TelegramBotAlertNotifyHandlerImpl.TelegramBotNotifyResponse> responseEntity = new ResponseEntity<>(
+                failureResp, HttpStatus.OK);
 
         when(restTemplate.postForEntity(any(String.class), any(),
                 eq(TelegramBotAlertNotifyHandlerImpl.TelegramBotNotifyResponse.class))).thenReturn(responseEntity);
-        
-        assertThrows(AlertNoticeException.class, 
+
+        assertThrows(AlertNoticeException.class,
                 () -> telegramBotAlertNotifyHandler.send(receiver, template, groupAlert));
     }
 }