fix Unsafe shell command constructed from library input index

[odaysec]

amplify-cli/packages/amplify-e2e-core/src/utils/index.ts

Line 81 in c85ed14

execa.commandSync(`yarn add ${dependencies.join(' ')}`, { cwd: indexPath });

fix the issue should avoid constructing the shell command as a single string and instead pass the command and its arguments as an array to execa.commandSync. This approach prevents the shell from interpreting special characters in the input, mitigating the risk of command injection. Specifically:

1. Replace the string concatenation with an array of arguments.
2. Use execa's execa.sync method with the command and arguments passed as separate parameters.

Checklist

• PR description included
• yarn test passes
• Tests are changed or added
• Relevant documentation is changed or added (and PR referenced)
• New AWS SDK calls or CloudFormation actions have been added to relevant test and service IAM policies
• Pull request labels are added

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.