[INLONG-12149][Improve] [Manager] Add command whitelist validation in Manager

inlong-manager/manager-common/src/main/java/org/apache/inlong/manager/common/consts/InlongConstants.java

@@ -74,10 +74,24 @@ public class InlongConstants {
 
     public static final String AMPERSAND = "&";
 
+    public static final String ASTERISK = "*";
+
     public static final String NEW_LINE = "\n";
 
     public static final String REGEX_WHITESPACE = "\\s";
 
+    public static final char SINGLE_QUOTE_CHAR = '\'';
+
+    public static final char DOUBLE_QUOTE_CHAR = '"';
+
+    public static final char NEW_LINE_CHAR = '\n';
+
+    public static final char CARRIAGE_RETURN_CHAR = '\r';
+
+    public static final char SEMICOLON_CHAR = ';';
+
+    public static final char PIPE_CHAR = '|';
+
     public static final String ADMIN_USER = "admin";
 
     public static final Integer AFFECTED_ONE_ROW = 1;

inlong-manager/manager-common/src/main/java/org/apache/inlong/manager/common/enums/ErrorCodeEnum.java

@@ -169,6 +169,8 @@ public enum ErrorCodeEnum {
 
     MODULE_NOT_FOUND(6001, "Module does not exist/no operation authority"),
     MODULE_INFO_INCORRECT(6002, "Module info was incorrect"),
+    MODULE_COMMAND_NOT_IN_WHITELIST(6003,
+            "Module command not in whitelist: %s"),
 
     PACKAGE_NOT_FOUND(7001, "Package does not exist/no operation authority"),
     PACKAGE_INFO_INCORRECT(7002, "Package info was incorrect"),

inlong-manager/manager-service/src/main/java/org/apache/inlong/manager/service/module/ModuleCommandAccessors.java

@@ -0,0 +1,52 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.inlong.manager.service.module;
+
+import org.apache.inlong.manager.pojo.module.ModuleDTO;
+import org.apache.inlong.manager.pojo.module.ModuleRequest;
+
+import java.util.Arrays;
+import java.util.List;
+
+/**
+ * Flattens a carrier ({@link ModuleRequest} / {@link ModuleDTO} / ...) into a plain list
+ * of raw command strings.
+ */
+public final class ModuleCommandAccessors {
+
+    private ModuleCommandAccessors() {
+    }
+
+    public static List<String> of(ModuleRequest request) {
+        return Arrays.asList(
+                request.getStartCommand(),
+                request.getStopCommand(),
+                request.getCheckCommand(),
+                request.getInstallCommand(),
+                request.getUninstallCommand());
+    }
+
+    public static List<String> of(ModuleDTO dto) {
+        return Arrays.asList(
+                dto.getStartCommand(),
+                dto.getStopCommand(),
+                dto.getCheckCommand(),
+                dto.getInstallCommand(),
+                dto.getUninstallCommand());
+    }
+}