Don't concatenate shell arguments.

[brendandburns]

Fixes https://github.com/kubernetes-client/javascript/security/code-scanning/17

To fix the problem, we should avoid using proc.execSync with a dynamically constructed command string. Instead, we can use child_process.execFileSync, which takes the command and its arguments as separate parameters, thus avoiding shell interpretation of the arguments. This change will ensure that the arguments are passed safely to the command without the risk of command injection.

Steps to fix:

1. Replace the use of proc.execSync with proc.execFileSync.
2. Split the command and its arguments into separate parameters for execFileSync.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[mstruebing]

Seems like the tests are failing for a weird reason.

It's a buffer: '{"token":{"accessToken":"token"}}' and it seems like the leading and trailing ' are responsible.

I've pushed a commit which fixes one of the failing tests.
I did not look to deep into it, but the "fix" seems hacky and weird to me.
Just want to save you some time if you have a look later, feel free to drop/change that commit in any way you want.

[brendandburns]

@mstruebing I added a fix which I think is more correct, removing leading/trailing quote marks for each arg.

[k8s-ci-robot]

Keywords which can automatically close issues and at(@) or hashtag(#) mentions are not allowed in commit messages.

The list of commits with invalid commit messages:

• aa6e2e3 Don't concatenate the string arguments.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[mstruebing]

/lgtm
/approve

Thanks 🚀

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: brendandburns, mstruebing

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [brendandburns,mstruebing]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment