Merge branch 'master' into alert-autofix-74

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Signed-off-by: aias00 <liuhongyu@apache.org>

hertzbeat-manager/src/main/java/org/apache/hertzbeat/manager/service/impl/AppServiceImpl.java

@@ -679,12 +679,13 @@ public class AppServiceImpl implements AppService, InitializingBean {
 
         @Override
         public void delete(String app) {
+            validateAppName(app);
             var classpath = Objects.requireNonNull(this.getClass().getClassLoader().getResource("")).getPath();
             var defineAppPath = classpath + "define" + File.separator + "app-" + app + ".yml";
             var defineAppFile = new File(defineAppPath);
 
-            if (!defineAppFile.exists() && appDefines.containsKey(app.toLowerCase())){
-                throw new CommonException("the app define file is not in current file server provider");
+            if (!defineAppFile.exists() && appDefines.containsKey(app.toLowerCase())) {
+                throw new CommonException("The app define file is not in the current file server provider");
             }
 
             if (defineAppFile.exists() && defineAppFile.isFile()) {
@@ -692,6 +693,18 @@ public class AppServiceImpl implements AppService, InitializingBean {
             }
             appDefines.remove(app.toLowerCase());
         }
+
+        private void validateAppName(String app) {
+            if (app == null || app.isEmpty()) {
+                throw new IllegalArgumentException("App name cannot be null or empty");
+            }
+            if (app.contains("..") || app.contains("/") || app.contains("\\")) {
+                throw new IllegalArgumentException("Invalid app name: " + app);
+            }
+            if (!app.matches("^[a-zA-Z0-9_-]+$")) {
+                throw new IllegalArgumentException("App name contains invalid characters: " + app);
+            }
+        }
     }
 
     private class ObjectStoreAppDefineStoreImpl implements AppDefineStore {