Create codeql-analysis.yml

[pandyaved98]

There are some Critical and High Priority bugs.

[dacbd]

Thank you, there are certainly some improvements that can be made from that scanning report. The proper domain detection for example would be a great PR if you want to take that on as well 😉.

As far as the command injection, we might be able to do more? but I feel the nature of the tool doesn't include taking unsanitized input from systems, and if a user did put cml in particular cml runner behind a service/system that took non-predetermined input the onus would be on that system to sanitize the input. Thoughts @0x2b3bfa0 ?

[dacbd]

@pandyaved98 can you update the PR more closely reflect: https://github.com/iterative/terraform-provider-iterative/blob/master/.github/workflows/codeql-analysis.yml

[dacbd]

#1096 (comment)

[0x2b3bfa0]

Thoughts @0x2b3bfa0?

None of these issues seem critical from a security standpoint; i.e. command execution is required beforehand, rendering them futile. 🤷🏼‍♂️

Still, it would be nice to escape properly the affected values. 👍🏼

[dacbd]

some of the values are pretty explicit in what they accept perhaps some form of input validation could be used?

[dacbd]

@pandyaved98 if you are willing to make the requested modifications please do so; if you don't have the time or are unable to, I'll merge this to an intermediate branch to tweak. That way your contribution is not in limbo for too long.

[0x2b3bfa0]

🔔 @pandyaved98, feel free to ping us if you need workflow run approvals; I took some days of vacation and missed the last workflow run request. 🙈

[dacbd]

enforce style changes