SQSCANGHA-101 Add another test

Author: aleksandra-bozhinoska-sonarsource

.github/workflows/qa-main.yml

@@ -74,6 +74,28 @@ jobs:
       - name: Assert the scanner was not called
         run: |
           ./test/assertFileDoesntExist ./output.properties
+  argsCommandInjectionTest:
+    name: >
+      'args' input with backticks injection does not execute command
+    strategy:
+      matrix:
+        os: [ ubuntu-latest-large, windows-latest-large, macos-latest ]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+      - name: Run action with args
+        uses: ./
+        continue-on-error: true
+        with:
+          args: -Dsonar.someArg="test `echo Command Injection`"
+        env:
+          SONAR_HOST_URL: http://not_actually_used
+          SONAR_SCANNER_JSON_PARAMS: '{"sonar.scanner.internal.dumpToFile": "./output.properties"}'
+      - name: Assert command in arg is not executed
+        run: |
+          ./test/assertFileContains ./output.properties "sonar.someArg=test Command Injection"
   projectBaseDirInputTest:
     name: >
       'projectBaseDir' input

action.yml

@@ -53,8 +53,7 @@ runs:
     - name: Run SonarScanner
       run: |
         args=(${{ inputs.args }})
-        cmd=(${GITHUB_ACTION_PATH}/scripts/run-sonar-scanner-cli.sh "${args[@]}")
-        "${cmd[@]}"
+        "${GITHUB_ACTION_PATH}/scripts/run-sonar-scanner-cli.sh" "${args[@]}"
       shell: bash
       env:
         INPUT_PROJECTBASEDIR: ${{ inputs.projectBaseDir }}

scripts/run-sonar-scanner-cli.sh

@@ -73,9 +73,16 @@ if [[ -n "${SONAR_ROOT_CERT}" ]]; then
   scanner_args+=("-Dsonar.scanner.truststorePassword=$SONAR_SSL_TRUSTSTORE_PASSWORD")
 fi
 
-scanner_args+=("$@")
-
+for arg in "$@"; do
+    # Append each argument to the array
+    # The double quotes around "$arg" are crucial
+    scanner_args+=("$arg")
+done
+echo "Args to sonar-scanner: ${scanner_args}"
 set -ux
 
-$SCANNER_BIN ${scanner_args[@]+"${scanner_args[@]}"}
-
+if [[ ${#scanner_args[@]} -gt 0 ]]; then
+    $SCANNER_BIN "${scanner_args[@]}"
+else
+    $SCANNER_BIN
+fi