Remove the usage of exec for variable cases

[dxvladislavvolkov]

Fix the eslint rule - security/detect-child-process

[Copilot]

Pull request overview

This PR aims to address ESLint security/detect-child-process warnings by replacing child_process.exec usage (especially with variable input) with child_process.spawn in demo utility scripts.

Changes:

• Switched TypeScript compilation in the TS→JS converter from exec("tsc ...") to spawn("tsc", [...]).
• Switched Angular demo build invocation from exec("npm run ...") to spawn("npm", [...]).

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
apps/demos/utils/ts-to-js-converter/converter.ts	Replaces exec-based tsc invocation with spawn and updates call site to pass arguments as an array.
apps/demos/utils/create-bundles/Angular/bundler.ts	Replaces exec-based Angular build command with spawn('npm', [...]).

Comments suppressed due to low confidence (1)

apps/demos/utils/create-bundles/Angular/bundler.ts:55

• spawn('npm', ...) should handle the child process error event. If spawning fails, the unhandled error event can crash the process and res() will never be called (hanging the batch). Add an ngBuildProcess.on('error', ...) handler (and consider treating non-zero exit codes as failures rather than always calling res() as success).

    const ngBuildProcess = spawn('npm', ['run', 'build-angular', '--', getProjectNameByDemo(demo)]);
    ngBuildProcess.stdout.on('data', (data) => {
      console.log(`stdout: ${data}`);
    });
    ngBuildProcess.stderr.on('data', (data) => {
      console.error(`stderr: ${data}`);
    });
    ngBuildProcess.on('close', (code) => {
      console.log(`child process exited with code ${code}`);
      res();
    });

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

apps/demos/utils/create-bundles/Angular/bundler.ts:55

• spawn('npm', ...) can emit an error event (e.g., if npm is not found). Right now there is no error handler, which can crash the process and also leave res() never called. Add an error listener that logs/reports the failure and completes the callback (and consider failing the build when the exit code is non-zero).

    const ngBuildProcess = spawn('npm', ['run', 'build-angular', '--', getProjectNameByDemo(demo)]);
    ngBuildProcess.stdout.on('data', (data) => {
      console.log(`stdout: ${data}`);
    });
    ngBuildProcess.stderr.on('data', (data) => {
      console.error(`stderr: ${data}`);
    });
    ngBuildProcess.on('close', (code) => {
      console.log(`child process exited with code ${code}`);
      res();
    });

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

Comments suppressed due to low confidence (1)

apps/demos/utils/create-bundles/Angular/bundler.ts:52

• There is no 'error' handler for the spawned process. If the process fails to start (e.g., missing npm/PATH issues), neither 'close' nor stdout/stderr handlers will guarantee res() is called, which can leave the caller hanging. Add an 'error' listener that logs and calls res() (or rejects, depending on expected control flow).

    const ngBuildProcess = spawn('npm', ['run', 'build-angular', '--', getProjectNameByDemo(demo)]);
    ngBuildProcess.stdout.on('data', (data) => {
      console.log(`stdout: ${data}`);
    });
    ngBuildProcess.stderr.on('data', (data) => {
      console.error(`stderr: ${data}`);
    });
    ngBuildProcess.on('close', (code) => {

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

Comments suppressed due to low confidence (1)

apps/demos/utils/create-bundles/Angular/bundler.ts:55

• The spawned process has no 'error' handler. If npm cannot be spawned (e.g., PATH issues), Node will emit an error event that can crash the script or leave the demo build promise unresolved. Add an ngBuildProcess.on('error', ...) handler and ensure res() (or an error propagation path) is triggered.

    const ngBuildProcess = spawn('npm', ['run', 'build-angular', '--', getProjectNameByDemo(demo)], { shell: process.platform === 'win32' });
    ngBuildProcess.stdout.on('data', (data) => {
      console.log(`stdout: ${data}`);
    });
    ngBuildProcess.stderr.on('data', (data) => {
      console.error(`stderr: ${data}`);
    });
    ngBuildProcess.on('close', (code) => {
      console.log(`child process exited with code ${code}`);
      res();
    });

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 5 comments.