Merge branch 'master' into fix/alert-51

Potential fix for code scanning alert no. 51: Server-side request forgery
2026-09-17 18:10:28 +00:00 · 2025-05-18 17:02:32 +08:00 · 2025-05-18 13:48:43 +08:00 · 2025-05-17 14:32:49 +08:00
1 changed files with 6 additions and 0 deletions
@@ -378,6 +378,12 @@ public class VictoriaMetricsClusterDataStorage extends AbstractHistoryDataStorag
        if (CommonConstants.PROMETHEUS.equals(app)) {
            labelName = metrics;
        }
+        // Validate the metrics input against a predefined whitelist
+        List<String> allowedMetrics = List.of("cpu", "memory", "disk", "network"); // Example whitelist
+        if (!allowedMetrics.contains(metrics)) {
+            throw new IllegalArgumentException("Invalid metrics value: " + metrics);
+        }
+
        String timeSeriesSelector = Stream.of(
                LABEL_KEY_NAME + "=\"" + labelName + "\"",
                LABEL_KEY_INSTANCE + "=\"" + monitorId + "\"",
Author	SHA1	Message	Date
aias00	f3bc2ee436	Merge branch 'master' into fix/alert-51	2025-05-18 17:02:32 +08:00
Calvin	a84ff2f791	Merge branch 'master' into fix/alert-51	2025-05-18 13:48:43 +08:00
aias00andCopilot Autofix powered by AI	e9503d9743	Potential fix for code scanning alert no. 51: Server-side request forgery Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Signed-off-by: aias00 <liuhongyu@apache.org>	2025-05-17 14:32:49 +08:00