You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Is your feature request related to a problem? Please describe.
When deploying to minimal or Mandatory Access Controlled containers a lot of OS commands do not work and should not be required for the function of this library. Even without security concerns spawning processes to read a single file is not efficient.
A 100% replaceable example that is is this, which is completely equivalent to fs.readFileSync except it will be denied in a MAC environment due to the risk of being used as shell injection gadgets.
Is your feature request related to a problem? Please describe.
When deploying to minimal or Mandatory Access Controlled containers a lot of OS commands do not work and should not be required for the function of this library. Even without security concerns spawning processes to read a single file is not efficient.
A 100% replaceable example that is is this, which is completely equivalent to
fs.readFileSync
except it will be denied in a MAC environment due to the risk of being used as shell injection gadgets.systeminformation/lib/filesystem.js
Lines 141 to 144 in ddced76
Describe the solution you'd like
Only call OS commands when there are truly high maintenance overhead to write equivalent JS implementation (dmidecode, etc) not in commonly used APIs
Describe alternatives you've considered
Not use this package or whitelist commands the package uses.
Additional context
Calling code: https://github.com/misskey-dev/misskey/blob/5ed1101bbda9d6e9c03d39c106e0da868e1d419b/packages/backend/src/server/api/endpoints/admin/server-info.ts#L115-L118
Audit log (at the very least cat and grep should not be needed IMO):
The text was updated successfully, but these errors were encountered: