Fix audit in lockfile

2022-10-28 15:11:19 +00:00
4 changed files with 2623 additions and 1447 deletions
@@ -1,7 +1,5 @@
 # @actions/io Releases

-### 1.1.3
- [Fixed a security bug where we used child_proccess.exec instead of execFile for windows](https://github.com/actions/toolkit/pull/1255)
 ### 1.1.2
 - Update `lockfileVersion` to `v2` in `package-lock.json [#1020](https://github.com/actions/toolkit/pull/1020) 

@@ -1,6 +1,6 @@
 {
  "name": "@actions/io",
-  "version": "1.1.3",
+  "version": "1.1.2",
  "description": "Actions io lib",
  "keywords": [
    "github",
@@ -4,6 +4,7 @@ import * as path from 'path'
 import {promisify} from 'util'
 import * as ioUtil from './io-util'

+const exec = promisify(childProcess.exec)
 const execFile = promisify(childProcess.execFile)

 /**
@@ -128,11 +129,11 @@ export async function rmRF(inputPath: string): Promise<void> {
    try {
      const cmdPath = ioUtil.getCmdPath()
      if (await ioUtil.isDirectory(inputPath, true)) {
-        await execFile(`${cmdPath} /s /c "rd /s /q "%inputPath%""`, {
+        await exec(`${cmdPath} /s /c "rd /s /q "%inputPath%""`, {
          env: {inputPath}
        })
      } else {
-        await execFile(`${cmdPath} /s /c "del /f /a "%inputPath%""`, {
+        await exec(`${cmdPath} /s /c "del /f /a "%inputPath%""`, {
          env: {inputPath}
        })
      }