use env to pass input and output parameters

[fkiriakos07]

Relevant Links

Bugzilla: _
TestRail: _

Description of Code / Doc Changes

use env to pass input and output parameters to prevent attacks from malicious input and dangerous writes, as described in our guidelines.

Process Changes Required

Mark the relevant boxes:

• Adds a dependency (rerun pipenv install)
• Changes the BasePage
• Changes or creates a BOM/POM (name the object model): _
• Changes CI flow
• Changes scheduled Beta or DevEdition
• Changes Git hooks or Github settings
• Changes L10n harness

Screenshots or Explanations

If you need to explain your code, do it here.

Comments or Future Work

Do we need to start another PR soon to address something you saw while working on this?

Workflow Checklist

• Please request reviewers
• If this is an unblocker, please post in Slack.
• If asked to address comments, please resolve conversations.
• If asked to change code, please re-request review from the person who wanted changes.

Thank you!

[ben-c-at-moz]

I'm not necessarily opposed to this change, I just don't know what it gets us

[fkiriakos07]

Hello @ben-c-at-moz , it is a security precaution to make sure that we're properly escaping the input parameters, I don't think the workflow is vulnerable but I thought it wouldn't hurt to apply the fix

[ben-c-at-moz]

OK, let's go ahead and merge this. Seems ok.

[fkiriakos07]

thanks @ben-c-at-moz , I fixed the merge conflict and fixed another input parameter.

[ben-c-at-moz]

approved, I'm going to merge