Fix Arbitary Code Execution using execFile and spawn

[alromh87]

openjtalk is vulnerable to Command Injection. It is possible to inject arbitrary commands by using a semicolon char in any of the key values, using the talk() fucntion.

Comand use pipe to comunicate betwen process, this was replaced with spawn to link stout to stdin.

🐛 Proof of Concept (PoC) *

1. Install the package
2. Check there aren't files called HACKED
3. Execute the following js script:

var OpenJTalk = require('openjtalk');
var mei = new OpenJTalk();
mei.talk(' "; touch HACKED; #//');

4. It will create a file HACKED in the working directory.

After fix no HACKED file is created

Commands can be executed normally, and audio fles are correctly erased