fix shell command built from environment values

[odaysec]

Cap/scripts/setup.js

Line 5 in b1094ab

import { exec as execCb } from "node:child_process";

Cap/scripts/setup.js

Line 111 in b1094ab

await exec(`tar xf ${ffmpegZipPath} -C ${targetDir}`);

Fix the issue, the shell command should be refactored to avoid dynamic string construction and instead use execFile or execFileSync, which allows passing arguments separately to the command. This approach ensures that the paths are treated as literal arguments and not interpreted by the shell.

Specifically:

1. Replace the exec call on line 111 with execFile or execFileSync.
2. Pass the tar command and its arguments as separate parameters, ensuring that ffmpegZipPath and targetDir are treated as literal values.

---