SQSCANGHA-112 SQSCANGHA-113 Fixes from review and keytool refactor

dist/index.js

@@ -29895,7 +29895,7 @@ async function installSonarScanner({
   let toolDir = toolCacheExports.find(TOOLNAME, scannerVersion, flavor);
 
   if (!toolDir) {
-    console.log(
+    coreExports.info(
       `Installing Sonar Scanner CLI ${scannerVersion} for ${flavor}...`
     );
 
@@ -29905,7 +29905,7 @@ async function installSonarScanner({
       flavor,
     });
 
-    console.log(`Downloading from: ${downloadUrl}`);
+    coreExports.info(`Downloading from: ${downloadUrl}`);
 
     const downloadPath = await toolCacheExports.downloadTool(downloadUrl);
     const extractedPath = await toolCacheExports.extractZip(downloadPath);
@@ -29918,9 +29918,9 @@ async function installSonarScanner({
 
     toolDir = await toolCacheExports.cacheDir(scannerPath, TOOLNAME, scannerVersion, flavor);
 
-    console.log(`Sonar Scanner CLI cached to: ${toolDir}`);
+    coreExports.info(`Sonar Scanner CLI cached to: ${toolDir}`);
   } else {
-    console.log(`Using cached Sonar Scanner CLI from: ${toolDir}`);
+    coreExports.info(`Using cached Sonar Scanner CLI from: ${toolDir}`);
   }
 
   // Add the bin directory to PATH
@@ -29967,30 +29967,33 @@ function firstString() {
     }
 }
 
+const KEYTOOL_MAIN_CLASS = "sun.security.tools.keytool.Main";
+const TRUSTSTORE_PASSWORD = "changeit"; // default password of the Java truststore!
+
 async function runSonarScanner(
   inputArgs,
   projectBaseDir,
   scannerDir,
   runnerEnv = {}
 ) {
-  const {
-    RUNNER_DEBUG,
-    RUNNER_OS,
-    RUNNER_TEMP,
-    SONAR_ROOT_CERT,
-    SONARCLOUD_URL,
-  } = runnerEnv;
+  const { runnerDebug, runnerOs, runnerTemp, sonarRootCert, sonarcloudUrl } =
+    runnerEnv;
 
   const scannerBin =
-    RUNNER_OS === "Windows" ? "sonar-scanner.bat" : "sonar-scanner";
+    runnerOs === "Windows" ? "sonar-scanner.bat" : "sonar-scanner";
 
   const scannerArgs = [];
 
-  if (SONARCLOUD_URL) {
-    scannerArgs.push(`-Dsonar.scanner.sonarcloudUrl=${SONARCLOUD_URL}`);
+  /**
+   * Not sanitization is needed when populating scannerArgs.
+   * @actions/exec will take care of sanitizing the args it receives.
+   */
+
+  if (sonarcloudUrl) {
+    scannerArgs.push(`-Dsonar.scanner.sonarcloudUrl=${sonarcloudUrl}`);
   }
 
-  if (RUNNER_DEBUG === "1") {
+  if (runnerDebug === "1") {
     scannerArgs.push("--debug");
   }
 
@@ -30000,68 +30003,36 @@ async function runSonarScanner(
 
   // The SSL folder may exist on an uncleaned self-hosted runner
   const sslFolder = path.join(require$$0.homedir(), ".sonar", "ssl");
-  /**
-   * Use keytool for now, as SonarQube 10.6 and below doesn't support openssl generated keystores
-   * keytool requires a password > 6 characters,  so we won't use the default password 'sonar'
-   */
-  const keytoolMainClass = "sun.security.tools.keytool.Main";
   const truststoreFile = path.join(sslFolder, "truststore.p12");
-  const truststorePassword = "changeit";
+
+  const keytoolParams = {
+    scannerDir,
+    truststoreFile,
+  };
 
   if (fs.existsSync(truststoreFile)) {
     let aliasSonarIsPresent = true;
 
     try {
-      await execExports.exec(
-        `${scannerDir}/jre/bin/java`,
-        [
-          keytoolMainClass,
-          "-storetype",
-          "PKCS12",
-          "-keystore",
-          truststoreFile,
-          "-storepass",
-          truststorePassword,
-          "-noprompt",
-          "-trustcacerts",
-          "-list",
-          "-v",
-          "-alias",
-          "sonar",
-        ],
-        { silent: true }
-      );
+      await checkSonarAliasInTruststore(keytoolParams);
     } catch (_) {
       aliasSonarIsPresent = false;
-      console.log(
+      coreExports.info(
         `Existing Scanner truststore ${truststoreFile} does not contain 'sonar' alias`
       );
     }
 
     if (aliasSonarIsPresent) {
-      console.log(
+      coreExports.info(
         `Removing 'sonar' alias from already existing Scanner truststore: ${truststoreFile}`
       );
-      await execExports.exec(`${scannerDir}/jre/bin/java`, [
-        keytoolMainClass,
-        "-storetype",
-        "PKCS12",
-        "-keystore",
-        truststoreFile,
-        "-storepass",
-        truststorePassword,
-        "-noprompt",
-        "-trustcacerts",
-        "-delete",
-        "-alias",
-        "sonar",
-      ]);
+      await deleteSonarAliasFromTruststore(keytoolParams);
     }
   }
 
-  if (SONAR_ROOT_CERT) {
-    console.log("Adding SSL certificate to the Scanner truststore");
-    const tempCertPath = path.join(RUNNER_TEMP, "tmpcert.pem");
+  if (sonarRootCert) {
+    coreExports.info("Adding SSL certificate to the Scanner truststore");
+    const tempCertPath = path.join(runnerTemp, "tmpcert.pem");
 
     try {
       fs.unlinkSync(tempCertPath);
@@ -30069,39 +30040,79 @@ async function runSonarScanner(
       // File doesn't exist, ignore
     }
 
-    fs.writeFileSync(tempCertPath, SONAR_ROOT_CERT);
+    fs.writeFileSync(tempCertPath, sonarRootCert);
     fs.mkdirSync(sslFolder, { recursive: true });
 
-    await execExports.exec(`${scannerDir}/jre/bin/java`, [
-      keytoolMainClass,
-      "-storetype",
-      "PKCS12",
-      "-keystore",
-      truststoreFile,
-      "-storepass",
-      truststorePassword,
-      "-noprompt",
-      "-trustcacerts",
-      "-importcert",
-      "-alias",
-      "sonar",
-      "-file",
-      tempCertPath,
-    ]);
+    await importCertificateToTruststore(keytoolParams, tempCertPath);
 
     scannerArgs.push(
-      `-Dsonar.scanner.truststorePassword=${truststorePassword}`
+      `-Dsonar.scanner.truststorePassword=${TRUSTSTORE_PASSWORD}`
     );
   }
 
   if (inputArgs) {
+    /**
+     * No sanitization, but it is parsing a string into an array of arguments in a safe way (= no command execution),
+     * and with good enough support of quotes to support arguments containing spaces.
+     */
     const args = parseArgsStringToArgv(inputArgs);
     scannerArgs.push(...args);
   }
 
+  /**
+   * Arguments are sanitized by `exec`
+   */
   await execExports.exec(scannerBin, scannerArgs);
 }
 
+/**
+ * Use keytool for now, as SonarQube 10.6 and below doesn't support openssl generated keystores
+ * keytool requires a password > 6 characters,  so we won't use the default password 'sonar'
+ */
+function executeKeytoolCommand({
+  scannerDir,
+  truststoreFile,
+  extraArgs,
+  options = {},
+}) {
+  const baseArgs = [
+    KEYTOOL_MAIN_CLASS,
+    "-storetype",
+    "PKCS12",
+    "-keystore",
+    truststoreFile,
+    "-storepass",
+    TRUSTSTORE_PASSWORD,
+    "-noprompt",
+    "-trustcacerts",
+    ...extraArgs,
+  ];
+
+  return execExports.exec(`${scannerDir}/jre/bin/java`, baseArgs, options);
+}
+
+function importCertificateToTruststore(keytoolParams, certPath) {
+  return executeKeytoolCommand({
+    ...keytoolParams,
+    extraArgs: ["-importcert", "-alias", "sonar", "-file", certPath],
+  });
+}
+
+function checkSonarAliasInTruststore(keytoolParams) {
+  return executeKeytoolCommand({
+    ...keytoolParams,
+    extraArgs: ["-list", "-v", "-alias", "sonar"],
+    options: { silent: true },
+  });
+}
+
+function deleteSonarAliasFromTruststore(keytoolParams) {
+  return executeKeytoolCommand({
+    ...keytoolParams,
+    extraArgs: ["-delete", "-alias", "sonar"],
+  });
+}
+
 function validateScannerVersion(version) {
   if (!version) {
     return;
@@ -30116,7 +30127,7 @@ function validateScannerVersion(version) {
 }
 
 function checkSonarToken(core, sonarToken) {
-  {
+  if (!sonarToken) {
     core.warning(
       "Running this GitHub Action without SONAR_TOKEN is not recommended"
     );
@@ -30164,21 +30175,21 @@ function getInputs() {
  */
 function getEnvVariables() {
   return {
-    RUNNER_DEBUG: process.env.RUNNER_DEBUG,
-    RUNNER_OS: process.env.RUNNER_OS,
-    RUNNER_TEMP: process.env.RUNNER_TEMP,
-    SONAR_ROOT_CERT: process.env.SONAR_ROOT_CERT,
-    SONARCLOUD_URL: process.env.SONARCLOUD_URL,
-    SONAR_TOKEN: process.env.SONAR_TOKEN,
+    runnerDebug: process.env.RUNNER_DEBUG,
+    runnerOs: process.env.RUNNER_OS,
+    runnerTemp: process.env.RUNNER_TEMP,
+    sonarRootCert: process.env.SONAR_ROOT_CERT,
+    sonarcloudUrl: process.env.SONARCLOUD_URL,
+    sonarToken: process.env.SONAR_TOKEN,
   };
 }
 
 function runSanityChecks(inputs) {
   try {
-    const { projectBaseDir, scannerVersion } = inputs;
+    const { projectBaseDir, scannerVersion, sonarToken } = inputs;
 
     validateScannerVersion(scannerVersion);
-    checkSonarToken(core$1);
+    checkSonarToken(core$1, sonarToken);
     checkMavenProject(core$1, projectBaseDir);
     checkGradleProject(core$1, projectBaseDir);
   } catch (error) {

dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sources":["../node_modules/@actions/core/lib/utils.js","../node_modules/@actions/core/lib/command.js","../node_modules/@actions/core/lib/file-command.js","../node_modules/@actions/http-client/lib/proxy.js","../node_modules/tunnel/lib/tunnel.js","../node_modules/tunnel/index.js","../node_modules/undici/lib/core/symbols.js","../node_modules/undici/lib/core/errors.js","../node_modules/undici/lib/core/constants.js","../node_modules/undici/lib/core/util.js","../node_modules/undici/lib/timers.js","../node_modules/@fastify/busboy/deps/streamsearch/sbmh.js","../node_modules/@fastify/busboy/deps/dicer/lib/PartStream.js","../node_modules/@fastify/busboy/lib/utils/getLimit.js","../node_modules/@fastify/busboy/deps/dicer/lib/HeaderParser.js","../node_modules/@fastify/busboy/deps/dicer/lib/Dicer.js","../node_modules/@fastify/busboy/lib/utils/decodeText.js","../node_modules/@fastify/busboy/lib/utils/parseParams.js","../node_modules/@fastify/busboy/lib/utils/basename.js","../node_modules/@fastify/busboy/lib/types/multipart.js","../node_modules/@fastify/busboy/lib/utils/Decoder.js","../node_modules/@fastify/busboy/lib/types/urlencoded.js","../node_modules/@fastify/busboy/lib/main.js","../node_modules/undici/lib/fetch/constants.js","../node_modules/undici/lib/fetch/global.js","../node_modules/undici/lib/fetch/util.js","../node_modules/undici/lib/fetch/symbols.js","../node_modules/undici/lib/fetch/webidl.js","../node_modules/undici/lib/fetch/dataURL.js","../node_modules/undici/lib/fetch/file.js","../node_modules/undici/lib/fetch/formdata.js","../node_modules/undici/lib/fetch/body.js","../node_modules/undici/lib/core/request.js","../node_modules/undici/lib/dispatcher.js","../node_modules/undici/lib/dispatcher-base.js","../node_modules/undici/lib/core/connect.js","../node_modules/undici/lib/llhttp/utils.js","../node_modules/undici/lib/llhttp/constants.js","../node_modules/undici/lib/handler/RedirectHandler.js","../node_modules/undici/lib/interceptor/redirectInterceptor.js","../node_modules/undici/lib/llhttp/llhttp-wasm.js","../node_modules/undici/lib/llhttp/llhttp_simd-wasm.js","../node_modules/undici/lib/client.js","../node_modules/undici/lib/node/fixed-queue.js","../node_modules/undici/lib/pool-stats.js","../node_modules/undici/lib/pool-base.js","../node_modules/undici/lib/pool.js","../node_modules/undici/lib/balanced-pool.js","../node_modules/undici/lib/compat/dispatcher-weakref.js","../node_modules/undici/lib/agent.js","../node_modules/undici/lib/api/readable.js","../node_modules/undici/lib/api/util.js","../node_modules/undici/lib/api/abort-signal.js","../node_modules/undici/lib/api/api-request.js","../node_modules/undici/lib/api/api-stream.js","../node_modules/undici/lib/api/api-pipeline.js","../node_modules/undici/lib/api/api-upgrade.js","../node_modules/undici/lib/api/api-connect.js","../node_modules/undici/lib/api/index.js","../node_modules/undici/lib/mock/mock-errors.js","../node_modules/undici/lib/mock/mock-symbols.js","../node_modules/undici/lib/mock/mock-utils.js","../node_modules/undici/lib/mock/mock-interceptor.js","../node_modules/undici/lib/mock/mock-client.js","../node_modules/undici/lib/mock/mock-pool.js","../node_modules/undici/lib/mock/pluralizer.js","../node_modules/undici/lib/mock/pending-interceptors-formatter.js","../node_modules/undici/lib/mock/mock-agent.js","../node_modules/undici/lib/proxy-agent.js","../node_modules/undici/lib/handler/RetryHandler.js","../node_modules/undici/lib/global.js","../node_modules/undici/lib/handler/DecoratorHandler.js","../node_modules/undici/lib/fetch/headers.js","../node_modules/undici/lib/fetch/response.js","../node_modules/undici/lib/fetch/request.js","../node_modules/undici/lib/fetch/index.js","../node_modules/undici/lib/fileapi/symbols.js","../node_modules/undici/lib/fileapi/progressevent.js","../node_modules/undici/lib/fileapi/encoding.js","../node_modules/undici/lib/fileapi/util.js","../node_modules/undici/lib/fileapi/filereader.js","../node_modules/undici/lib/cache/symbols.js","../node_modules/undici/lib/cache/util.js","../node_modules/undici/lib/cache/cache.js","../node_modules/undici/lib/cache/cachestorage.js","../node_modules/undici/lib/cookies/constants.js","../node_modules/undici/lib/cookies/util.js","../node_modules/undici/lib/cookies/parse.js","../node_modules/undici/lib/cookies/index.js","../node_modules/undici/lib/websocket/constants.js","../node_modules/undici/lib/websocket/symbols.js","../node_modules/undici/lib/websocket/events.js","../node_modules/undici/lib/websocket/util.js","../node_modules/undici/lib/websocket/connection.js","../node_modules/undici/lib/websocket/frame.js","../node_modules/undici/lib/websocket/receiver.js","../node_modules/undici/lib/websocket/websocket.js","../node_modules/undici/index.js","../node_modules/@actions/http-client/lib/index.js","../node_modules/@actions/http-client/lib/auth.js","../node_modules/@actions/core/lib/oidc-utils.js","../node_modules/@actions/core/lib/summary.js","../node_modLine truncated
+{"version":3,"file":"index.js","sources":["../node_modules/@actions/core/lib/utils.js","../node_modules/@actions/core/lib/command.js","../node_modules/@actions/core/lib/file-command.js","../node_modules/@actions/http-client/lib/proxy.js","../node_modules/tunnel/lib/tunnel.js","../node_modules/tunnel/index.js","../node_modules/undici/lib/core/symbols.js","../node_modules/undici/lib/core/errors.js","../node_modules/undici/lib/core/constants.js","../node_modules/undici/lib/core/util.js","../node_modules/undici/lib/timers.js","../node_modules/@fastify/busboy/deps/streamsearch/sbmh.js","../node_modules/@fastify/busboy/deps/dicer/lib/PartStream.js","../node_modules/@fastify/busboy/lib/utils/getLimit.js","../node_modules/@fastify/busboy/deps/dicer/lib/HeaderParser.js","../node_modules/@fastify/busboy/deps/dicer/lib/Dicer.js","../node_modules/@fastify/busboy/lib/utils/decodeText.js","../node_modules/@fastify/busboy/lib/utils/parseParams.js","../node_modules/@fastify/busboy/lib/utils/basename.js","../node_modules/@fastify/busboy/lib/types/multipart.js","../node_modules/@fastify/busboy/lib/utils/Decoder.js","../node_modules/@fastify/busboy/lib/types/urlencoded.js","../node_modules/@fastify/busboy/lib/main.js","../node_modules/undici/lib/fetch/constants.js","../node_modules/undici/lib/fetch/global.js","../node_modules/undici/lib/fetch/util.js","../node_modules/undici/lib/fetch/symbols.js","../node_modules/undici/lib/fetch/webidl.js","../node_modules/undici/lib/fetch/dataURL.js","../node_modules/undici/lib/fetch/file.js","../node_modules/undici/lib/fetch/formdata.js","../node_modules/undici/lib/fetch/body.js","../node_modules/undici/lib/core/request.js","../node_modules/undici/lib/dispatcher.js","../node_modules/undici/lib/dispatcher-base.js","../node_modules/undici/lib/core/connect.js","../node_modules/undici/lib/llhttp/utils.js","../node_modules/undici/lib/llhttp/constants.js","../node_modules/undici/lib/handler/RedirectHandler.js","../node_modules/undici/lib/interceptor/redirectInterceptor.js","../node_modules/undici/lib/llhttp/llhttp-wasm.js","../node_modules/undici/lib/llhttp/llhttp_simd-wasm.js","../node_modules/undici/lib/client.js","../node_modules/undici/lib/node/fixed-queue.js","../node_modules/undici/lib/pool-stats.js","../node_modules/undici/lib/pool-base.js","../node_modules/undici/lib/pool.js","../node_modules/undici/lib/balanced-pool.js","../node_modules/undici/lib/compat/dispatcher-weakref.js","../node_modules/undici/lib/agent.js","../node_modules/undici/lib/api/readable.js","../node_modules/undici/lib/api/util.js","../node_modules/undici/lib/api/abort-signal.js","../node_modules/undici/lib/api/api-request.js","../node_modules/undici/lib/api/api-stream.js","../node_modules/undici/lib/api/api-pipeline.js","../node_modules/undici/lib/api/api-upgrade.js","../node_modules/undici/lib/api/api-connect.js","../node_modules/undici/lib/api/index.js","../node_modules/undici/lib/mock/mock-errors.js","../node_modules/undici/lib/mock/mock-symbols.js","../node_modules/undici/lib/mock/mock-utils.js","../node_modules/undici/lib/mock/mock-interceptor.js","../node_modules/undici/lib/mock/mock-client.js","../node_modules/undici/lib/mock/mock-pool.js","../node_modules/undici/lib/mock/pluralizer.js","../node_modules/undici/lib/mock/pending-interceptors-formatter.js","../node_modules/undici/lib/mock/mock-agent.js","../node_modules/undici/lib/proxy-agent.js","../node_modules/undici/lib/handler/RetryHandler.js","../node_modules/undici/lib/global.js","../node_modules/undici/lib/handler/DecoratorHandler.js","../node_modules/undici/lib/fetch/headers.js","../node_modules/undici/lib/fetch/response.js","../node_modules/undici/lib/fetch/request.js","../node_modules/undici/lib/fetch/index.js","../node_modules/undici/lib/fileapi/symbols.js","../node_modules/undici/lib/fileapi/progressevent.js","../node_modules/undici/lib/fileapi/encoding.js","../node_modules/undici/lib/fileapi/util.js","../node_modules/undici/lib/fileapi/filereader.js","../node_modules/undici/lib/cache/symbols.js","../node_modules/undici/lib/cache/util.js","../node_modules/undici/lib/cache/cache.js","../node_modules/undici/lib/cache/cachestorage.js","../node_modules/undici/lib/cookies/constants.js","../node_modules/undici/lib/cookies/util.js","../node_modules/undici/lib/cookies/parse.js","../node_modules/undici/lib/cookies/index.js","../node_modules/undici/lib/websocket/constants.js","../node_modules/undici/lib/websocket/symbols.js","../node_modules/undici/lib/websocket/events.js","../node_modules/undici/lib/websocket/util.js","../node_modules/undici/lib/websocket/connection.js","../node_modules/undici/lib/websocket/frame.js","../node_modules/undici/lib/websocket/receiver.js","../node_modules/undici/lib/websocket/websocket.js","../node_modules/undici/index.js","../node_modules/@actions/http-client/lib/index.js","../node_modules/@actions/http-client/lib/auth.js","../node_modules/@actions/core/lib/oidc-utils.js","../node_modules/@actions/core/lib/summary.js","../node_modLine truncated

src/index.js

@@ -28,21 +28,21 @@ function getInputs() {
  */
 function getEnvVariables() {
   return {
-    RUNNER_DEBUG: process.env.RUNNER_DEBUG,
-    RUNNER_OS: process.env.RUNNER_OS,
-    RUNNER_TEMP: process.env.RUNNER_TEMP,
-    SONAR_ROOT_CERT: process.env.SONAR_ROOT_CERT,
-    SONARCLOUD_URL: process.env.SONARCLOUD_URL,
-    SONAR_TOKEN: process.env.SONAR_TOKEN,
+    runnerDebug: process.env.RUNNER_DEBUG,
+    runnerOs: process.env.RUNNER_OS,
+    runnerTemp: process.env.RUNNER_TEMP,
+    sonarRootCert: process.env.SONAR_ROOT_CERT,
+    sonarcloudUrl: process.env.SONARCLOUD_URL,
+    sonarToken: process.env.SONAR_TOKEN,
   };
 }
 
 function runSanityChecks(inputs) {
   try {
-    const { projectBaseDir, scannerVersion } = inputs;
+    const { projectBaseDir, scannerVersion, sonarToken } = inputs;
 
     validateScannerVersion(scannerVersion);
-    checkSonarToken(core);
+    checkSonarToken(core, sonarToken);
     checkMavenProject(core, projectBaseDir);
     checkGradleProject(core, projectBaseDir);
   } catch (error) {

src/install-sonar-scanner.js

@@ -23,7 +23,7 @@ export async function installSonarScanner({
   let toolDir = tc.find(TOOLNAME, scannerVersion, flavor);
 
   if (!toolDir) {
-    console.log(
+    core.info(
       `Installing Sonar Scanner CLI ${scannerVersion} for ${flavor}...`
     );
 
@@ -33,7 +33,7 @@ export async function installSonarScanner({
       flavor,
     });
 
-    console.log(`Downloading from: ${downloadUrl}`);
+    core.info(`Downloading from: ${downloadUrl}`);
 
     const downloadPath = await tc.downloadTool(downloadUrl);
     const extractedPath = await tc.extractZip(downloadPath);
@@ -46,9 +46,9 @@ export async function installSonarScanner({
 
     toolDir = await tc.cacheDir(scannerPath, TOOLNAME, scannerVersion, flavor);
 
-    console.log(`Sonar Scanner CLI cached to: ${toolDir}`);
+    core.info(`Sonar Scanner CLI cached to: ${toolDir}`);
   } else {
-    console.log(`Using cached Sonar Scanner CLI from: ${toolDir}`);
+    core.info(`Using cached Sonar Scanner CLI from: ${toolDir}`);
   }
 
   // Add the bin directory to PATH

src/run-sonar-scanner.js

@@ -1,33 +1,37 @@
+import * as core from "@actions/core";
 import * as exec from "@actions/exec";
 import * as fs from "fs";
 import * as os from "os";
 import * as path from "path";
 import { parseArgsStringToArgv } from "string-argv";
 
+const KEYTOOL_MAIN_CLASS = "sun.security.tools.keytool.Main";
+const TRUSTSTORE_PASSWORD = "changeit"; // default password of the Java truststore!
+
 export async function runSonarScanner(
   inputArgs,
   projectBaseDir,
   scannerDir,
   runnerEnv = {}
 ) {
-  const {
-    RUNNER_DEBUG,
-    RUNNER_OS,
-    RUNNER_TEMP,
-    SONAR_ROOT_CERT,
-    SONARCLOUD_URL,
-  } = runnerEnv;
+  const { runnerDebug, runnerOs, runnerTemp, sonarRootCert, sonarcloudUrl } =
+    runnerEnv;
 
   const scannerBin =
-    RUNNER_OS === "Windows" ? "sonar-scanner.bat" : "sonar-scanner";
+    runnerOs === "Windows" ? "sonar-scanner.bat" : "sonar-scanner";
 
   const scannerArgs = [];
 
-  if (SONARCLOUD_URL) {
-    scannerArgs.push(`-Dsonar.scanner.sonarcloudUrl=${SONARCLOUD_URL}`);
+  /**
+   * Not sanitization is needed when populating scannerArgs.
+   * @actions/exec will take care of sanitizing the args it receives.
+   */
+
+  if (sonarcloudUrl) {
+    scannerArgs.push(`-Dsonar.scanner.sonarcloudUrl=${sonarcloudUrl}`);
   }
 
-  if (RUNNER_DEBUG === "1") {
+  if (runnerDebug === "1") {
     scannerArgs.push("--debug");
   }
 
@@ -37,68 +41,36 @@ export async function runSonarScanner(
 
   // The SSL folder may exist on an uncleaned self-hosted runner
   const sslFolder = path.join(os.homedir(), ".sonar", "ssl");
-  /**
-   * Use keytool for now, as SonarQube 10.6 and below doesn't support openssl generated keystores
-   * keytool requires a password > 6 characters,  so we won't use the default password 'sonar'
-   */
-  const keytoolMainClass = "sun.security.tools.keytool.Main";
   const truststoreFile = path.join(sslFolder, "truststore.p12");
-  const truststorePassword = "changeit";
+
+  const keytoolParams = {
+    scannerDir,
+    truststoreFile,
+  };
 
   if (fs.existsSync(truststoreFile)) {
     let aliasSonarIsPresent = true;
 
     try {
-      await exec.exec(
-        `${scannerDir}/jre/bin/java`,
-        [
-          keytoolMainClass,
-          "-storetype",
-          "PKCS12",
-          "-keystore",
-          truststoreFile,
-          "-storepass",
-          truststorePassword,
-          "-noprompt",
-          "-trustcacerts",
-          "-list",
-          "-v",
-          "-alias",
-          "sonar",
-        ],
-        { silent: true }
-      );
+      await checkSonarAliasInTruststore(keytoolParams);
     } catch (_) {
       aliasSonarIsPresent = false;
-      console.log(
+      core.info(
         `Existing Scanner truststore ${truststoreFile} does not contain 'sonar' alias`
       );
     }
 
     if (aliasSonarIsPresent) {
-      console.log(
+      core.info(
         `Removing 'sonar' alias from already existing Scanner truststore: ${truststoreFile}`
       );
-      await exec.exec(`${scannerDir}/jre/bin/java`, [
-        keytoolMainClass,
-        "-storetype",
-        "PKCS12",
-        "-keystore",
-        truststoreFile,
-        "-storepass",
-        truststorePassword,
-        "-noprompt",
-        "-trustcacerts",
-        "-delete",
-        "-alias",
-        "sonar",
-      ]);
+      await deleteSonarAliasFromTruststore(keytoolParams);
     }
   }
 
-  if (SONAR_ROOT_CERT) {
-    console.log("Adding SSL certificate to the Scanner truststore");
-    const tempCertPath = path.join(RUNNER_TEMP, "tmpcert.pem");
+  if (sonarRootCert) {
+    core.info("Adding SSL certificate to the Scanner truststore");
+    const tempCertPath = path.join(runnerTemp, "tmpcert.pem");
 
     try {
       fs.unlinkSync(tempCertPath);
@@ -106,35 +78,75 @@ export async function runSonarScanner(
       // File doesn't exist, ignore
     }
 
-    fs.writeFileSync(tempCertPath, SONAR_ROOT_CERT);
+    fs.writeFileSync(tempCertPath, sonarRootCert);
     fs.mkdirSync(sslFolder, { recursive: true });
 
-    await exec.exec(`${scannerDir}/jre/bin/java`, [
-      keytoolMainClass,
-      "-storetype",
-      "PKCS12",
-      "-keystore",
-      truststoreFile,
-      "-storepass",
-      truststorePassword,
-      "-noprompt",
-      "-trustcacerts",
-      "-importcert",
-      "-alias",
-      "sonar",
-      "-file",
-      tempCertPath,
-    ]);
+    await importCertificateToTruststore(keytoolParams, tempCertPath);
 
     scannerArgs.push(
-      `-Dsonar.scanner.truststorePassword=${truststorePassword}`
+      `-Dsonar.scanner.truststorePassword=${TRUSTSTORE_PASSWORD}`
     );
   }
 
   if (inputArgs) {
+    /**
+     * No sanitization, but it is parsing a string into an array of arguments in a safe way (= no command execution),
+     * and with good enough support of quotes to support arguments containing spaces.
+     */
     const args = parseArgsStringToArgv(inputArgs);
     scannerArgs.push(...args);
   }
 
+  /**
+   * Arguments are sanitized by `exec`
+   */
   await exec.exec(scannerBin, scannerArgs);
 }
+
+/**
+ * Use keytool for now, as SonarQube 10.6 and below doesn't support openssl generated keystores
+ * keytool requires a password > 6 characters,  so we won't use the default password 'sonar'
+ */
+function executeKeytoolCommand({
+  scannerDir,
+  truststoreFile,
+  extraArgs,
+  options = {},
+}) {
+  const baseArgs = [
+    KEYTOOL_MAIN_CLASS,
+    "-storetype",
+    "PKCS12",
+    "-keystore",
+    truststoreFile,
+    "-storepass",
+    TRUSTSTORE_PASSWORD,
+    "-noprompt",
+    "-trustcacerts",
+    ...extraArgs,
+  ];
+
+  return exec.exec(`${scannerDir}/jre/bin/java`, baseArgs, options);
+}
+
+function importCertificateToTruststore(keytoolParams, certPath) {
+  return executeKeytoolCommand({
+    ...keytoolParams,
+    extraArgs: ["-importcert", "-alias", "sonar", "-file", certPath],
+  });
+}
+
+function checkSonarAliasInTruststore(keytoolParams) {
+  return executeKeytoolCommand({
+    ...keytoolParams,
+    extraArgs: ["-list", "-v", "-alias", "sonar"],
+    options: { silent: true },
+  });
+}
+
+function deleteSonarAliasFromTruststore(keytoolParams) {
+  return executeKeytoolCommand({
+    ...keytoolParams,
+    extraArgs: ["-delete", "-alias", "sonar"],
+  });
+}