Resolve CodeQL issues

[nitrocode]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request. Searching for pre-existing feature requests helps us consolidate datapoints for identical requirements into a single place, thank you!
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.

---

• I'd be willing to implement this feature (contributing guide)

Describe the user story

There are many issues that came up from gosec which were ignored in the code without a comment. I proposed CodeQL in a recent PR and it found some issues that I believe still impact this project today.

https://github.com/runatlantis/atlantis/security/code-scanning?query=pr%3A2879+tool%3ACodeQL+is%3Aopen

Describe the solution you'd like

Lets go over each vulnerability, dismiss or acknowledge it, and either fix it or create an issue to fix it for the next release.

Critical

• (2) Command built from user-controlled sources
  • Both seem bitbucket related and could be resolved by using a bitbucket dependency such as https://github.com/ktrysmt/go-bitbucket.

High

• (9) Log entries created from user input
  • Some of these are bitbucket related (resolved by using a bitbucket library)
  • Some of these are azure devops related (resolved by using the already installed azure devops library)
  • Some are due to not sanitizing inputs from the API /locks?id endpoint
• (1) Arbitrary file write during zip extraction ("zip slip")
  • Seems easy enough to address by checking for ..
• (8) Uncontrolled data used in path expression

Medium

• (3) Reflected cross-site scripting

---

For now, investigating each // nolint:gosec comment can be left for a future ticket. The work for that ticket would be reduced by this ticket.

Describe the drawbacks of your solution

None

Describe alternatives you've considered

None