fix: Sanitize --jitconfig value before using it

[konradasb]

Description

Prevent possible command injection vulnerability via received --jitconfig token

Related Issue(s)

Fixes #274

Checklist

• I have read the contribution guidelines.
• I have signed off my commits.
• I have added necessary documentation (if appropriate).
• I have added tests to cover my changes.

Summary by CodeRabbit

• Bug Fixes
  • Configuration input is now validated to reject invalid characters and trim unnecessary whitespace.

[coderabbitai]

Caution

Review failed

The pull request is closed.

📝 Walkthrough

Walkthrough

The change adds input sanitization to the Run method in runner/runner.go to address a command injection vulnerability. The modification trims whitespace from r.config and validates it against disallowed characters, returning an error if invalid characters are detected before passing it to command execution.

Changes

Cohort / File(s)	Summary
Command Injection Protection runner/runner.go	Adds strings import; implements input validation by trimming whitespace and checking r.config for disallowed shell metacharacters; returns error "invalid characters in config" on validation failure; uses sanitized config in exec.CommandContext call.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

• Character validation set: Verify the complete list of disallowed characters aligns with shell injection vectors and doesn't exclude legitimate configuration values
• Whitespace trimming: Confirm that trimming doesn't inadvertently break valid configurations that require leading/trailing spaces
• Error message consistency: Ensure the error message and handling pattern match existing codebase conventions

✨ Finishing touches

• 📝 Generate docstrings

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch sanitize-jit-config

---

📜 Recent review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 330b0df and de1cad9.

📒 Files selected for processing (1)

• runner/runner.go (2 hunks)

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}