v1.5 backport of initwd: require valid module name

CHANGELOG.md

@@ -1,5 +1,9 @@
 ## 1.5.7 (Unreleased)
 
+BUG FIXES:
+
+* `terraform init`: Terraform will no longer allow downloading remote modules to invalid paths. [#33745]
+
 ## 1.5.6 (August 23, 2023)
 
 BUG FIXES:

internal/initwd/module_install.go

@@ -16,7 +16,7 @@ import (
 	"github.com/apparentlymart/go-versions/versions"
 	version "github.com/hashicorp/go-version"
 	"github.com/hashicorp/hcl/v2"
-
+	"github.com/hashicorp/hcl/v2/hclsyntax"
 	"github.com/hashicorp/terraform/internal/addrs"
 	"github.com/hashicorp/terraform/internal/configs"
 	"github.com/hashicorp/terraform/internal/configs/configload"
@@ -156,6 +156,13 @@ func (i *ModuleInstaller) installDescendentModules(ctx context.Context, rootMod
 				return nil, nil, diags
 			}
 
+			if !hclsyntax.ValidIdentifier(req.Name) {
+				// A module with an invalid name shouldn't be installed at all. This is
+				// mostly a concern for remote modules, since we need to be able to convert
+				// the name to a valid path.
+				return nil, nil, diags
+			}
+
 			key := manifest.ModuleKey(req.Path)
 			instPath := i.packageInstallPath(req.Path)
 

internal/initwd/module_install_test.go

@@ -139,6 +139,27 @@ func TestModuleInstaller_emptyModuleName(t *testing.T) {
 	}
 }
 
+func TestModuleInstaller_invalidModuleName(t *testing.T) {
+	fixtureDir := filepath.Clean("testdata/invalid-module-name")
+	dir, done := tempChdir(t, fixtureDir)
+	defer done()
+
+	hooks := &testInstallHooks{}
+
+	modulesDir := filepath.Join(dir, ".terraform/modules")
+
+	loader, close := configload.NewLoaderForTests(t)
+	defer close()
+	inst := NewModuleInstaller(modulesDir, loader, registry.NewClient(nil, nil))
+	_, diags := inst.InstallModules(context.Background(), dir, false, hooks)
+
+	if !diags.HasErrors() {
+		t.Fatal("expected error")
+	} else {
+		assertDiagnosticSummary(t, diags, "Invalid module instance name")
+	}
+}
+
 func TestModuleInstaller_packageEscapeError(t *testing.T) {
 	fixtureDir := filepath.Clean("testdata/load-module-package-escape")
 	dir, done := tempChdir(t, fixtureDir)

internal/initwd/testdata/invalid-module-name/child/main.tf

@@ -0,0 +1,3 @@
+output "boop" {
+  value = "beep"
+}

internal/initwd/testdata/invalid-module-name/main.tf

@@ -0,0 +1,3 @@
+module "../invalid" {
+  source  = "./child"
+}