mirror of
https://github.com/angular/angular
synced 2026-05-24 09:28:37 +00:00
Currently, the exec() utility uses childProcess.spawn() with shell: true. This commit changes the spawn option to shell: false to prevent OS command injection vulnerabilities and quotes the benchmark target in the github action.
(cherry picked from commit
|
||
|---|---|---|
| .. | ||
| adev-preview-build.yml | ||
| adev-preview-deploy.yml | ||
| assistant-to-the-branch-manager.yml | ||
| benchmark-compare.yml | ||
| ci.yml | ||
| cross-repo-adev-docs.yml | ||
| dev-infra.yml | ||
| google-internal-tests.yml | ||
| manual.yml | ||
| merge-ready-status.yml | ||
| perf.yml | ||
| pr.yml | ||
| scorecard.yml | ||