security: validate batch spec mount name

Author: cbrnrd

internal/batches/service/service_test.go

@@ -594,6 +594,26 @@ changesetTemplate:
 `,
 			expectedErr: errors.New("handling mount: step 1 mount path is not in the same directory or subdirectory as the batch spec"),
 		},
+		{
+			name:         "files target path with comma",
+			batchSpecDir: tempDir,
+			rawSpec: `
+name: test-spec
+description: A test spec
+steps:
+  - run: echo "hello"
+    container: alpine:3
+    files:
+      "/tmp/x,source=/var/run/docker.sock,target=/var/run/docker.sock": "IGNORED"
+changesetTemplate:
+  title: Test Files
+  body: Test files target path with comma
+  branch: test
+  commit:
+    message: Test
+`,
+			expectedErr: errors.New("parsing batch spec: step 1 files target path contains invalid characters"),
+		},
 		{
 			name:         "mount path dot-dot traversal",
 			batchSpecDir: tempDir,

lib/batches/batch_spec.go

@@ -176,6 +176,11 @@ func parseBatchSpec(schema string, data []byte) (*BatchSpec, error) {
 				errs = errors.Append(errs, NewValidationError(errors.Newf("step %d mount mountpoint contains invalid characters", i+1)))
 			}
 		}
+		for name := range step.Files {
+			if strings.Contains(name, invalidMountCharacters) {
+				errs = errors.Append(errs, NewValidationError(errors.Newf("step %d files target path contains invalid characters", i+1)))
+			}
+		}
 	}
 
 	return &spec, errs