[bugfix]A bug fix (apache#2853)

Co-authored-by: shown <[email protected]>
Co-authored-by: aias00 <[email protected]>

hertzbeat-collector/hertzbeat-collector-basic/src/main/java/org/apache/hertzbeat/collector/collect/database/JdbcCommonCollect.java

@@ -292,6 +292,13 @@ private String constructDatabaseUrl(JdbcProtocol jdbcProtocol) {
         if (Objects.nonNull(jdbcProtocol.getUrl())
                 && !Objects.equals("", jdbcProtocol.getUrl())
                 && jdbcProtocol.getUrl().startsWith("jdbc")) {
+            String url = jdbcProtocol.getUrl().toLowerCase(); // convert the URL to lowercase for case-insensitive checking
+            // check whether the parameter is valid
+            if (url.contains("create trigger") || url.contains("create alias") || url.contains("runscript from")
+                    || url.contains("allowloadlocalinfile") || url.contains("allowloadlocalinfileinpath")
+                    || url.contains("uselocalinfile")) {
+                throw new IllegalArgumentException("Invalid JDBC URL: contains malicious characters.");
+            }
             // when has config jdbc url, use it 
             return jdbcProtocol.getUrl();
         }