refactor to prevent injection

Author: chdsbd

action.yml

@@ -92,46 +92,49 @@ runs:
         PG_VERSION="$INPUT_PG_VERSION"
         VERBOSE="$INPUT_VERBOSE"
 
-        COMMAND="squawk"
+        COMMAND=(squawk)
 
         if "$ASSUME_IN_TRANSACTION"; then
-          COMMAND="$COMMAND --assume-in-transaction"
+          COMMAND+=(--assume-in-transaction)
         fi
 
         if [ -n "$CONFIG" ]; then
-          COMMAND="$COMMAND --config=$CONFIG"
+          COMMAND+=("--config=$CONFIG")
         fi
 
         if [ -n "$EXCLUDE" ]; then
-          COMMAND="$COMMAND --exclude=$EXCLUDE"
+          COMMAND+=("--exclude=$EXCLUDE")
         fi
 
         if [ -n "$PG_VERSION" ]; then
-          COMMAND="$COMMAND --pg-version=$PG_VERSION"
+          COMMAND+=("--pg-version=$PG_VERSION")
         fi
 
         if "$VERBOSE"; then
-          COMMAND="$COMMAND --verbose"
+          COMMAND+=(--verbose)
         fi
 
         # We can only leave a comment when we run on pull_request.
         if [[ "$GITHUB_EVENT_NAME" == "pull_request" ]]; then
           if "$UPLOAD_TO_GITHUB"; then
-            COMMAND="$COMMAND upload-to-github"
+            COMMAND+=(upload-to-github)
           fi
 
           if "$FAIL_ON_VIOLATIONS"; then
-            COMMAND="$COMMAND --fail-on-violations"
+            COMMAND+=(--fail-on-violations)
           fi
         fi
 
         if [ -n "$FILES" ]; then
-          COMMAND="$COMMAND $FILES"
+          # FILES is a space-separated list of paths (no globs).
+          read -ra FILES_ARRAY <<< "$FILES"
+          COMMAND+=("${FILES_ARRAY[@]}")
         fi
 
         if [ -n "$PATTERN" ]; then
-          expandedFiles=$(find . \( -path "./$PATTERN" -or -path "$PATTERN" \) -type f | xargs echo)
-          COMMAND="$COMMAND $expandedFiles"
+          while IFS= read -r -d '' file; do
+            COMMAND+=("$file")
+          done < <(find . \( -path "./$PATTERN" -or -path "$PATTERN" \) -type f -print0)
         fi
 
         export SQUAWK_GITHUB_API_URL=$GITHUB_API_URL
@@ -140,5 +143,5 @@ runs:
         export SQUAWK_GITHUB_REPO_NAME=$(jq --raw-output .repository.name "$GITHUB_EVENT_PATH")
         export SQUAWK_GITHUB_PR_NUMBER=$(jq --raw-output .pull_request.number "$GITHUB_EVENT_PATH")
 
-        echo "Running: $COMMAND"
-        sh -c "$COMMAND"
+        echo "Running: ${COMMAND[*]}"
+        "${COMMAND[@]}"