updating release info

replacing exec with execFile for security
testing commit
2022-12-07 18:49:57 +00:00 · 2022-12-07 18:19:23 +00:00 · 2022-12-07 18:11:37 +00:00 · 2022-11-17 12:42:10 +05:30 · 2022-11-17 12:26:27 +05:30 · 2022-11-16 16:55:59 +05:30
3 changed files with 5 additions and 4 deletions
@@ -1,5 +1,7 @@
 # @actions/io Releases

+### 1.1.3
+- [Fixed a security bug where we used child_proccess.exec instead of execFile for windows](https://github.com/actions/toolkit/pull/1255)
 ### 1.1.2
 - Update `lockfileVersion` to `v2` in `package-lock.json [#1020](https://github.com/actions/toolkit/pull/1020) 

@@ -1,6 +1,6 @@
 {
  "name": "@actions/io",
-  "version": "1.1.2",
+  "version": "1.1.3",
  "description": "Actions io lib",
  "keywords": [
    "github",
@@ -4,7 +4,6 @@ import * as path from 'path'
 import {promisify} from 'util'
 import * as ioUtil from './io-util'

-const exec = promisify(childProcess.exec)
 const execFile = promisify(childProcess.execFile)

 /**
@@ -129,11 +128,11 @@ export async function rmRF(inputPath: string): Promise<void> {
    try {
      const cmdPath = ioUtil.getCmdPath()
      if (await ioUtil.isDirectory(inputPath, true)) {
-        await exec(`${cmdPath} /s /c "rd /s /q "%inputPath%""`, {
+        await execFile(`${cmdPath} /s /c "rd /s /q "%inputPath%""`, {
          env: {inputPath}
        })
      } else {
-        await exec(`${cmdPath} /s /c "del /f /a "%inputPath%""`, {
+        await execFile(`${cmdPath} /s /c "del /f /a "%inputPath%""`, {
          env: {inputPath}
        })
      }
Author	SHA1	Message	Date
Vallie Joseph	19d5d6138b	updating release info	2022-12-07 18:49:57 +00:00
Vallie Joseph	aee8700cae	replacing exec with execFile for security	2022-12-07 18:19:23 +00:00
Vallie Joseph	b56e7fcd67	testing commit	2022-12-07 18:11:37 +00:00
Sampark Sharma	819157bf87	Merge pull request #1238 from actions/revert-1232-phantsure/gnutar_windows Revert "Add GNUtar as default in windows"	2022-11-17 12:42:10 +05:30
Sampark Sharma	86102e88e9	Revert "Add GNUtar as default in windows"	2022-11-17 12:26:27 +05:30
Sampark Sharma	e4c071ba19	Merge pull request #1232 from actions/phantsure/gnutar_windows Add GNUtar as default in windows	2022-11-16 16:55:59 +05:30
Sampark Sharma	9443e26349	Address review comments	2022-11-15 10:18:46 +00:00
Sampark Sharma	5a0405df4e	Fix tests	2022-11-15 08:48:29 +00:00
Sampark Sharma	0e707aeabc	Address comments	2022-11-15 08:41:04 +00:00
Sampark Sharma	7441dc5e59	Fix tests	2022-11-14 10:25:17 +00:00
Sampark Sharma	1ddac5e02f	Fix tests	2022-11-14 10:11:46 +00:00
Sampark Sharma	55484166d8	Address review comments	2022-11-14 08:12:15 +00:00
Sampark Sharma	7181b913f5	Remove export	2022-11-14 06:34:18 +00:00
Sampark Sharma	81cd5a5c2e	Revert "Add logs for cache version on miss" This reverts commit `4b348086a9`.	2022-11-14 06:33:53 +00:00
Sampark Sharma	4b348086a9	Add logs for cache version on miss	2022-11-14 05:24:09 +00:00
Sampark Sharma	436cf8d6ea	Fix tests	2022-11-10 15:50:06 +00:00
Sampark Sharma	e0aadb573c	Fix GNUtar path	2022-11-08 08:29:31 +00:00
Sampark Sharma	62a66a8ce9	Fix tests	2022-11-08 06:43:28 +00:00
Sampark Sharma	0c58e4113e	Fix gnutar check on windows	2022-11-07 13:43:54 +00:00
Sampark Sharma	9366237c90	Add gnuTar as default in windows	2022-11-07 13:39:07 +00:00