use safeWhich

lib/toolcache.js

@@ -13,6 +13,7 @@ const path = __importStar(require("path"));
 const toolrunner = __importStar(require("@actions/exec/lib/toolrunner"));
 const io = __importStar(require("@actions/io"));
 const actionsToolcache = __importStar(require("@actions/tool-cache"));
+const safeWhich = __importStar(require("@chrisgavin/safe-which"));
 const semver = __importStar(require("semver"));
 /*
  * This file acts as an interface to the functionality of the actions toolcache.
@@ -47,7 +48,7 @@ async function extractTar(file, mode, tempDir, logger) {
         // Determine whether GNU tar
         logger.debug("Checking tar --version");
         let versionOutput = "";
-        await new toolrunner.ToolRunner("tar", ["--version"], {
+        await new toolrunner.ToolRunner(await safeWhich.safeWhich("tar"), ["--version"], {
             ignoreReturnCode: true,
             silent: true,
             listeners: {

src/toolcache.ts

@@ -5,6 +5,7 @@ import * as path from "path";
 import * as toolrunner from "@actions/exec/lib/toolrunner";
 import * as io from "@actions/io";
 import * as actionsToolcache from "@actions/tool-cache";
+import * as safeWhich from "@chrisgavin/safe-which";
 import * as semver from "semver";
 
 import { Logger } from "./logging";
@@ -49,14 +50,18 @@ export async function extractTar(
     // Determine whether GNU tar
     logger.debug("Checking tar --version");
     let versionOutput = "";
-    await new toolrunner.ToolRunner("tar", ["--version"], {
-      ignoreReturnCode: true,
-      silent: true,
-      listeners: {
-        stdout: (data) => (versionOutput += data.toString()),
-        stderr: (data) => (versionOutput += data.toString()),
-      },
-    }).exec();
+    await new toolrunner.ToolRunner(
+      await safeWhich.safeWhich("tar"),
+      ["--version"],
+      {
+        ignoreReturnCode: true,
+        silent: true,
+        listeners: {
+          stdout: (data) => (versionOutput += data.toString()),
+          stderr: (data) => (versionOutput += data.toString()),
+        },
+      }
+    ).exec();
     logger.debug(versionOutput.trim());
     const isGnuTar = versionOutput.toUpperCase().includes("GNU TAR");
     // Initialize args