Arg parsing: strip quotes from arguments only if the argument begins and ends with quotes

[brcrista]

Describe the enhancement
We saw an issue where a secret appeared to be leaked in a run's logs. What actually happened was that the secret contained a " in the middle. The " was stripped out, and then the secret value minus the quote was "leaked."

Here's the line from the offending action.

Code Snippet
Repro per @ericsciple:

$ npm install @actions/exec .
$ node -e 'var exec = require("@actions/exec"); exec.exec(`bash -c echo foo="hi"`);'
[command]/bin/bash -c echo foo=hi

[hross]

I don't think we should strip quotes and alter intent in args. Instead we should handle a specific masking case if needed.

[waldobronchart]

@hross Isn't that what brcrista is proposing? (not stripping any quotes from the input cmd string)

Not sure why this is closed