updated package locks

This reverts commit 7d70dafa7e, reversing
changes made to 6ece840fda.

package-lock.json

@@ -29852,4 +29852,4 @@
       "dev": true
     }
   }
-}
+}

package.json

@@ -29,4 +29,4 @@
     "ts-jest": "^27.0.5",
     "typescript": "^3.9.9"
   }
-}
+}

packages/io/RELEASES.md

@@ -1,5 +1,7 @@
 # @actions/io Releases
 
+### 1.1.3
+- [Fixed a security bug where we used child_proccess.exec instead of execFile for windows](https://github.com/actions/toolkit/pull/1255)
 ### 1.1.2
 - Update `lockfileVersion` to `v2` in `package-lock.json [#1020](https://github.com/actions/toolkit/pull/1020) 
 

packages/io/package-lock.json

@@ -1,13 +1,13 @@
 {
   "name": "@actions/io",
-  "version": "1.1.2",
+  "version": "1.1.3",
   "lockfileVersion": 2,
   "requires": true,
   "packages": {
     "": {
       "name": "@actions/io",
-      "version": "1.1.2",
+      "version": "1.1.3",
       "license": "MIT"
     }
   }
-}
+}

packages/io/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@actions/io",
-  "version": "1.1.2",
+  "version": "1.1.3",
   "description": "Actions io lib",
   "keywords": [
     "github",
@@ -34,4 +34,4 @@
   "bugs": {
     "url": "https://github.com/actions/toolkit/issues"
   }
-}
+}

packages/io/src/io.ts

@@ -4,10 +4,7 @@ import * as path from 'path'
 import {promisify} from 'util'
 import * as ioUtil from './io-util'
 
-// const exec = promisify(childProcess.exec)
 const execFile = promisify(childProcess.execFile)
-const spawn = childProcess.spawn
-const subprocess = spawn('bad_command')
 
 /**
  * Interface for cp/mv options
@@ -129,34 +126,13 @@ export async function rmRF(inputPath: string): Promise<void> {
       )
     }
     try {
-      const cmdPath = ioUtil.getCmdPath()
+      // const cmdPath = ioUtil.getCmdPath()
+      const cmdArgs = ['/s', '/q', `${inputPath}`]
       if (await ioUtil.isDirectory(inputPath, true)) {
-        // deletes a dir then sets output to quiet
-        spawn(cmdPath, ['/s', '/c', 'rd "%inputPath%"'], {
-          shell: true,
-          env: {inputPath},
-          timeout: 500
-        })
-        subprocess.on('error', err => {
-          throw new Error(`Failed to delete ${inputPath}: ${err}`)
-        })
-        // await exec(`${cmdPath} /s /c "rd /s /q "%inputPath%""`, {
-        //   env: {inputPath}
-        // })
+        await execFile('rd', cmdArgs)
       } else {
-        // deletes a file then pipes output 
-        spawn(cmdPath, ['/s', '/c', `del "%inputPath%"`], {
-          shell: false,
-          env: {inputPath},
-          timeout: 500
-        })
-
-        subprocess.on('error', err => {
-          throw new Error(`Failed to delete ${inputPath}: ${err}`)
-        })
-        // await exec(`${cmdPath} /s /c "del /f /a "%inputPath%""`, {
-        //   env: {inputPath}
-        // })
+        const cmdArgsDel = ['/f', '/a', `${inputPath}`]
+        await execFile('del', cmdArgsDel)
       }
     } catch (err) {
       // if you try to delete a file that doesn't exist, desired result is achieved