updating release info

replacing exec with execFile for security
testing commit
2022-12-07 18:49:57 +00:00 · 2022-12-07 18:19:23 +00:00 · 2022-12-07 18:11:37 +00:00 · 2022-11-17 12:42:10 +05:30 · 2022-11-17 12:26:27 +05:30 · 2022-11-16 16:55:59 +05:30
15 changed files with 1519 additions and 2713 deletions
@@ -22,12 +22,12 @@ jobs:

    steps:
    - name: Checkout
-      uses: actions/checkout@v3
+      uses: actions/checkout@v2

-    - name: Set Node.js 16.x
-      uses: actions/setup-node@v3
+    - name: Set Node.js 12.x
+      uses: actions/setup-node@v1
      with:
-        node-version: 16.x
+        node-version: 12.x

    # In order to upload & download artifacts from a shell script, certain env variables need to be set that are only available in the
    # node context. This runs a local action that gets and sets the necessary env variables that are needed
@@ -58,13 +58,6 @@ jobs:
        echo ${{ env.non-gzip-artifact-content }} > artifact-path/world.txt
        echo ${{ env.gzip-artifact-content }} > artifact-path/gzip.txt
        touch artifact-path/empty.txt
-        
-    - name: Add additional logging after create
-      shell: bash
-      run: | 
-        cat ./artifact-path/world.txt
-        cat ./artifact-path/gzip.txt
-        cat ./artifact-path/empty.txt

    # We're using node -e to call the functions directly available in the @actions/artifact package
    - name: Upload artifacts using uploadArtifact()
@@ -81,14 +74,7 @@ jobs:
        node -e "Promise.resolve(require('./packages/artifact/lib/artifact-client').create().downloadArtifact('my-artifact-2','artifact-2-directory'))"
        mkdir artifact-3-directory
        node -e "Promise.resolve(require('./packages/artifact/lib/artifact-client').create().downloadArtifact('my-artifact-3','artifact-3-directory'))"
-    
-    - name: Add additional logging
-      shell: bash
-      run: | 
-        cat ./artifact-1-directory/artifact-path/world.txt
-        cat ./artifact-2-directory/artifact-path/gzip.txt
-        cat ./artifact-3-directory/artifact-path/empty.txt
-        
+
    - name: Verify downloadArtifact()
      shell: bash
      run: |
@@ -18,12 +18,12 @@ jobs:

    steps:
    - name: Checkout
-      uses: actions/checkout@v3
+      uses: actions/checkout@v2

-    - name: Set Node.js 14.x
-      uses: actions/setup-node@v3
+    - name: Set Node.js 12.x
+      uses: actions/setup-node@v1
      with:
-        node-version: 14.x
+        node-version: 12.x

    - name: npm install
      run: npm install
@@ -22,12 +22,12 @@ jobs:

    steps:
    - name: Checkout
-      uses: actions/checkout@v3
+      uses: actions/checkout@v2

-    - name: Set Node.js 14.x
-      uses: actions/setup-node@v3
+    - name: Set Node.js 12.x
+      uses: actions/setup-node@v1
      with:
-        node-version: 14.x
+        node-version: 12.x

    # In order to save & restore cache from a shell script, certain env variables need to be set that are only available in the
    # node context. This runs a local action that gets and sets the necessary env variables that are needed
@@ -20,7 +20,7 @@ jobs:

    steps:
    - name: Checkout repository
-      uses: actions/checkout@v3
+      uses: actions/checkout@v2

    # Initializes the CodeQL tools for scanning.
    - name: Initialize CodeQL
@@ -13,15 +13,15 @@ jobs:

    steps:
      - name: setup repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@v2

      - name: verify package exists
        run: ls packages/${{ github.event.inputs.package }}

-      - name: Set Node.js 14.x
-        uses: actions/setup-node@v3
+      - name: Set Node.js 12.x
+        uses: actions/setup-node@v1
        with:
-          node-version: 14.x
+          node-version: 12.x

      - name: npm install
        run: npm install
@@ -23,13 +23,12 @@ jobs:

    steps:
    - name: Checkout
-      uses: actions/checkout@v3
+      uses: actions/checkout@v2

-    - name: Set Node.js 14.x
-      uses: actions/setup-node@v3
+    - name: Set Node.js 12.x
+      uses: actions/setup-node@v1
      with:
-        node-version: 14.x
-    - run: npm -v
+        node-version: 12.x

    - name: npm install
      run: npm install
@@ -9,7 +9,7 @@ jobs:
    if: ${{ github.repository_owner == 'actions' }}
    steps:
    - name: Checkout repository
-      uses: actions/checkout@v3
+      uses: actions/checkout@v2
    - name: Update Octokit
      working-directory: packages/github 
      run: |
@@ -32,7 +32,7 @@ jobs:
        os: [ubuntu-16.04, windows-2019]
    runs-on: ${{matrix.os}}
    actions:
-    - uses: actions/setup-node@v3
+    - uses: actions/setup-node@v1
      with:
        version: ${{matrix.node}}
    - run: | 
@@ -18,7 +18,7 @@ e.g. To use https://github.com/actions/setup-node, users will author:

 ```yaml
 steps:
-    using: actions/setup-node@v3
+    using: actions/setup-node@v1
 ```

 # Define Metadata
@@ -457,9 +457,9 @@
      }
    },
    "node_modules/minimatch": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
-      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.0.4.tgz",
+      "integrity": "sha512-yJHVQEhyqPLUTgt9B83PXu6W3rx4MvvHvSUvToogpwoGDOUQ+yDrR0HRot+yOCdCO7u4hX3pWft6kWBBcqh0UA==",
      "dependencies": {
        "brace-expansion": "^1.1.7"
      },
@@ -998,9 +998,9 @@
      }
    },
    "minimatch": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
-      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.0.4.tgz",
+      "integrity": "sha512-yJHVQEhyqPLUTgt9B83PXu6W3rx4MvvHvSUvToogpwoGDOUQ+yDrR0HRot+yOCdCO7u4hX3pWft6kWBBcqh0UA==",
      "requires": {
        "brace-expansion": "^1.1.7"
      }
@@ -50,9 +50,9 @@
      "integrity": "sha1-2Klr13/Wjfd5OnMDajug1UBdR3s="
    },
    "node_modules/minimatch": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
-      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.0.4.tgz",
+      "integrity": "sha512-yJHVQEhyqPLUTgt9B83PXu6W3rx4MvvHvSUvToogpwoGDOUQ+yDrR0HRot+yOCdCO7u4hX3pWft6kWBBcqh0UA==",
      "dependencies": {
        "brace-expansion": "^1.1.7"
      },
@@ -115,9 +115,9 @@
      "integrity": "sha1-2Klr13/Wjfd5OnMDajug1UBdR3s="
    },
    "minimatch": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
-      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.0.4.tgz",
+      "integrity": "sha512-yJHVQEhyqPLUTgt9B83PXu6W3rx4MvvHvSUvToogpwoGDOUQ+yDrR0HRot+yOCdCO7u4hX3pWft6kWBBcqh0UA==",
      "requires": {
        "brace-expansion": "^1.1.7"
      }
@@ -1,5 +1,7 @@
 # @actions/io Releases

+### 1.1.3
+- [Fixed a security bug where we used child_proccess.exec instead of execFile for windows](https://github.com/actions/toolkit/pull/1255)
 ### 1.1.2
 - Update `lockfileVersion` to `v2` in `package-lock.json [#1020](https://github.com/actions/toolkit/pull/1020) 

@@ -1,6 +1,6 @@
 {
  "name": "@actions/io",
-  "version": "1.1.2",
+  "version": "1.1.3",
  "description": "Actions io lib",
  "keywords": [
    "github",
@@ -4,7 +4,6 @@ import * as path from 'path'
 import {promisify} from 'util'
 import * as ioUtil from './io-util'

-const exec = promisify(childProcess.exec)
 const execFile = promisify(childProcess.execFile)

 /**
@@ -129,11 +128,11 @@ export async function rmRF(inputPath: string): Promise<void> {
    try {
      const cmdPath = ioUtil.getCmdPath()
      if (await ioUtil.isDirectory(inputPath, true)) {
-        await exec(`${cmdPath} /s /c "rd /s /q "%inputPath%""`, {
+        await execFile(`${cmdPath} /s /c "rd /s /q "%inputPath%""`, {
          env: {inputPath}
        })
      } else {
-        await exec(`${cmdPath} /s /c "del /f /a "%inputPath%""`, {
+        await execFile(`${cmdPath} /s /c "del /f /a "%inputPath%""`, {
          env: {inputPath}
        })
      }
Author	SHA1	Message	Date
Vallie Joseph	19d5d6138b	updating release info	2022-12-07 18:49:57 +00:00
Vallie Joseph	aee8700cae	replacing exec with execFile for security	2022-12-07 18:19:23 +00:00
Vallie Joseph	b56e7fcd67	testing commit	2022-12-07 18:11:37 +00:00
Sampark Sharma	819157bf87	Merge pull request #1238 from actions/revert-1232-phantsure/gnutar_windows Revert "Add GNUtar as default in windows"	2022-11-17 12:42:10 +05:30
Sampark Sharma	86102e88e9	Revert "Add GNUtar as default in windows"	2022-11-17 12:26:27 +05:30
Sampark Sharma	e4c071ba19	Merge pull request #1232 from actions/phantsure/gnutar_windows Add GNUtar as default in windows	2022-11-16 16:55:59 +05:30
Sampark Sharma	9443e26349	Address review comments	2022-11-15 10:18:46 +00:00
Sampark Sharma	5a0405df4e	Fix tests	2022-11-15 08:48:29 +00:00
Sampark Sharma	0e707aeabc	Address comments	2022-11-15 08:41:04 +00:00
Sampark Sharma	7441dc5e59	Fix tests	2022-11-14 10:25:17 +00:00
Sampark Sharma	1ddac5e02f	Fix tests	2022-11-14 10:11:46 +00:00
Sampark Sharma	55484166d8	Address review comments	2022-11-14 08:12:15 +00:00
Sampark Sharma	7181b913f5	Remove export	2022-11-14 06:34:18 +00:00
Sampark Sharma	81cd5a5c2e	Revert "Add logs for cache version on miss" This reverts commit `4b348086a9`.	2022-11-14 06:33:53 +00:00
Sampark Sharma	4b348086a9	Add logs for cache version on miss	2022-11-14 05:24:09 +00:00
Sampark Sharma	436cf8d6ea	Fix tests	2022-11-10 15:50:06 +00:00
Sampark Sharma	e0aadb573c	Fix GNUtar path	2022-11-08 08:29:31 +00:00
Sampark Sharma	62a66a8ce9	Fix tests	2022-11-08 06:43:28 +00:00
Sampark Sharma	0c58e4113e	Fix gnutar check on windows	2022-11-07 13:43:54 +00:00
Sampark Sharma	9366237c90	Add gnuTar as default in windows	2022-11-07 13:39:07 +00:00