Skip to content

Reduce dependencies on OS commands #977

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
eternal-flame-AD opened this issue Mar 10, 2025 · 0 comments
Open

Reduce dependencies on OS commands #977

eternal-flame-AD opened this issue Mar 10, 2025 · 0 comments

Comments

@eternal-flame-AD
Copy link

Is your feature request related to a problem? Please describe.

When deploying to minimal or Mandatory Access Controlled containers a lot of OS commands do not work and should not be required for the function of this library. Even without security concerns spawning processes to read a single file is not efficient.

A 100% replaceable example that is is this, which is completely equivalent to fs.readFileSync except it will be denied in a MAC environment due to the risk of being used as shell injection gadgets.

cmd = 'export LC_ALL=C; df -lkPTx squashfs; unset LC_ALL';
execSync('cat /proc/mounts 2>/dev/null', util.execOptsLinux).toString().split('\n').filter(line => {
return line.startsWith('/');
}).forEach((line) => {

Describe the solution you'd like

Only call OS commands when there are truly high maintenance overhead to write equivalent JS implementation (dmidecode, etc) not in commonly used APIs

Describe alternatives you've considered

Not use this package or whitelist commands the package uses.

Additional context

Calling code: https://github.com/misskey-dev/misskey/blob/5ed1101bbda9d6e9c03d39c106e0da868e1d419b/packages/backend/src/server/api/endpoints/admin/server-info.ts#L115-L118

Audit log (at the very least cat and grep should not be needed IMO):

DENIED  misskey-auto-deploy-entrypoint//js//node-only-shell exec owner @{bin}/cat comm=sh requested_mask=x denied_mask=x
DENIED  misskey-auto-deploy-entrypoint//js//node-only-shell exec owner @{bin}/df comm=sh requested_mask=x denied_mask=x
DENIED  misskey-auto-deploy-entrypoint//js//node-only-shell exec owner @{bin}/grep comm=sh requested_mask=x denied_mask=x
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant