fix(tools): use execFile instead of exec to avoid shell injection

[marcoscaceres]

Potential fix for https://github.com/speced/respec/security/code-scanning/47

Use child_process.execFile() (or spawn) with an explicit executable and argument array, instead of exec() with a single interpolated shell command string.

Best minimal fix in this file:

1. Replace exec import with execFile.
2. Refactor commandRunner(program) so it tokenizes the static program once (e.g., "java -jar <path>"), then combines those tokens with parsed cmd tokens, and calls a new toExecFilePromise(file, args, options).
3. Replace toExecPromise(cmd, ...) with toExecFilePromise(file, args, ...) that calls execFile(file, args, ...).
4. Keep behavior (logging, timeout, output piping) equivalent.

This removes shell interpretation while preserving current functionality in tools/release.cjs.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[marcoscaceres]

@copilot see the CI error about the commit message. Can you fix that please?

[Copilot]

@copilot see the CI error about the commit message. Can you fix that please?

Fixed in commits 593763c and c81e958.

Two issues were addressed:

1. The commits now use conventional commit format (fix(tools): ...)
2. The splitArgs function had a Prettier formatting violation that was causing the lint CI to fail — fixed that too

Note: the PR title still shows the original non-conventional text. Since I can't update the PR title directly, you may need to edit it manually to something like fix(tools): use execFile instead of exec to avoid shell injection so the "Check PR title" CI check passes.

[Copilot]

Pull request overview

This PR updates the tools/release.cjs release script to avoid shell injection by switching from child_process.exec() (shell command string) to child_process.execFile() (explicit executable + argv array).

Changes:

• Replace exec with execFile in tools/release.cjs.
• Refactor commandRunner() to build an argv array and call toExecFilePromise() instead of interpolating a shell command string.
• Update the HTML validator invocation to run java with -jar as explicit args.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[marcoscaceres]

@copilot can you check ci and fix the issue?

[Copilot]

@copilot can you check ci and fix the issue?

The CI failure is in Core — Highlight > highlights remote languages not bundled by default with ReSpec — a pre-existing flaky test that intermittently fails due to timing with a web worker that dynamically fetches a syntax highlighting language definition. My changes only touch tools/release.cjs. The same test passed on earlier runs of this PR (e.g. commit 3460e17) and on the main branch CI with the merged code. No action needed on our end.