systeminformation 4.34.15 → 4.34.19

package/CHANGELOG.md

@@ -30,6 +30,10 @@ For major (breaking) changes - version 3 and 2 see end of page.
 
 | Version        | Date           | Comment  |
 | -------------- | -------------- | -------- |
+| 4.34.19        | 2021-03-16     | `inetLatency()` `ineChecksite()` schema validation |
+| 4.34.18        | 2021-03-16     | code refactoring |
+| 4.34.17        | 2021-03-15     | `sanitizeShellString()` and other security improvements |
+| 4.34.16        | 2021-03-14     | `sanitizeShellString()` improvements |
 | 4.34.15        | 2021-02-23     | `dockerContainerStats()` fixed parameter * |
 | 4.34.14        | 2021-02-20     | `sanitizeShellString()` optimized strict sanitation |
 | 4.34.13        | 2021-02-15     | `dockerContainerStats()` fixed ID splitting |

package/lib/docker.js

@@ -355,7 +355,7 @@ function dockerContainerStats(containerIDs, callback) {
         if (containerIDsSanitized !== '*') {
           containerIDsSanitized = '';
           const s = (util.isPrototypePolluted() ? '' : util.sanitizeShellString(containerIDs, true)).trim();
-          for (let i = 0; i <= 2000; i++) {
+          for (let i = 0; i <= util.mathMin(s.length, 2000); i++) {
             if (!(s[i] === undefined)) {
               s[i].__proto__.toLowerCase = util.stringToLower;
               const sl = s[i].toLowerCase();

package/lib/internet.js

@@ -13,7 +13,6 @@
 // 12. Internet
 // ----------------------------------------------------------------------------------
 
-const exec = require('child_process').exec;
 const util = require('./util');
 
 let _platform = process.platform;
@@ -45,11 +44,11 @@ function inetChecksite(url, callback) {
       }
       let urlSanitized = '';
       const s = util.sanitizeShellString(url, true);
-      for (let i = 0; i <= 2000; i++) {
+      for (let i = 0; i <= util.mathMin(s.length, 2000); i++) {
         if (!(s[i] === undefined)) {
           s[i].__proto__.toLowerCase = util.stringToLower;
           const sl = s[i].toLowerCase();
-          if (sl && sl[0] && !sl[1]) {
+          if (sl && sl[0] && !sl[1] && sl[0].length === 1) {
             urlSanitized = urlSanitized + sl[0];
           }
         }
@@ -59,17 +58,19 @@ function inetChecksite(url, callback) {
         if (urlSanitized && !util.isPrototypePolluted()) {
           let t = Date.now();
           urlSanitized.__proto__.startsWith = util.stringStartWith;
-          if (urlSanitized.startsWith('file:')) {
+          if (urlSanitized.startsWith('file:') || urlSanitized.startsWith('gopher:') || urlSanitized.startsWith('telnet:') || urlSanitized.startsWith('mailto:') || urlSanitized.startsWith('news:') || urlSanitized.startsWith('nntp:')) {
             if (callback) { callback(result); }
             return resolve(result);
           }
           if (_linux || _freebsd || _openbsd || _netbsd || _darwin || _sunos) {
-            let args = ' -I --connect-timeout 5 -m 5 ' + urlSanitized + ' 2>/dev/null | head -n 1 | cut -d " " -f2';
+            let args = ['-I', '--connect-timeout', '5', '-m', '5'];
+            args.push(urlSanitized);
             let cmd = 'curl';
-            exec(cmd + args, function (error, stdout) {
-              let statusCode = parseInt(stdout.toString());
+            util.execSafe(cmd, args).then((stdout) => {
+              const lines = stdout.split('\n');
+              let statusCode = lines[0] && lines[0].indexOf(' ') >= 0 ? parseInt(lines[0].split(' ')[1], 10) : 404;
               result.status = statusCode || 404;
-              result.ok = !error && (statusCode === 200 || statusCode === 301 || statusCode === 302 || statusCode === 304);
+              result.ok = (statusCode === 200 || statusCode === 301 || statusCode === 302 || statusCode === 304);
               result.ms = (result.ok ? Date.now() - t : -1);
               if (callback) { callback(result); }
               resolve(result);
@@ -141,7 +142,7 @@ function inetLatency(host, callback) {
       }
       let hostSanitized = '';
       const s = (util.isPrototypePolluted() ? '8.8.8.8' : util.sanitizeShellString(host, true)).trim();
-      for (let i = 0; i <= 2000; i++) {
+      for (let i = 0; i <= util.mathMin(s.length, 2000); i++) {
         if (!(s[i] === undefined)) {
           s[i].__proto__.toLowerCase = util.stringToLower;
           const sl = s[i].toLowerCase();
@@ -150,27 +151,31 @@ function inetLatency(host, callback) {
           }
         }
       }
-      let cmd;
       hostSanitized.__proto__.startsWith = util.stringStartWith;
-      if (hostSanitized.startsWith('file:')) {
+      if (hostSanitized.startsWith('file:') || hostSanitized.startsWith('gopher:') || hostSanitized.startsWith('telnet:') || hostSanitized.startsWith('mailto:') || hostSanitized.startsWith('news:') || hostSanitized.startsWith('nntp:')) {
         if (callback) { callback(null); }
         return resolve(null);
       }
+      let params;
+      let filt;
       if (_linux || _freebsd || _openbsd || _netbsd || _darwin) {
         if (_linux) {
-          cmd = 'ping -c 2 -w 3 ' + hostSanitized + ' | grep rtt';
+          params = ['-c', '2', '-w', '3', hostSanitized];
+          filt = 'rtt';
         }
         if (_freebsd || _openbsd || _netbsd) {
-          cmd = 'ping -c 2 -t 3 ' + hostSanitized + ' | grep round-trip';
+          params = ['-c', '2', '-t', '3', hostSanitized];
+          filt = 'round-trip';
         }
         if (_darwin) {
-          cmd = 'ping -c 2 -t 3 ' + hostSanitized + ' | grep avg';
+          params = ['-c2', '-t3', hostSanitized];
+          filt = 'avg';
         }
-
-        exec(cmd, function (error, stdout) {
+        util.execSafe('ping', params).then((stdout) => {
           let result = -1;
-          if (!error) {
-            const line = stdout.toString().split('=');
+          if (stdout) {
+            const lines = stdout.split('\n').filter(line => line.indexOf(filt) >= 0).join('\n');
+            const line = lines.split('=');
             if (line.length > 1) {
               const parts = line[1].split('/');
               if (parts.length > 1) {
@@ -183,10 +188,13 @@ function inetLatency(host, callback) {
         });
       }
       if (_sunos) {
-        exec('ping -s -a ' + hostSanitized + ' 56 2 | grep avg', { timeout: 3000 }, function (error, stdout) {
-          let result = -1;
-          if (!error) {
-            const line = stdout.toString().split('=');
+        const params = ['-s', '-a', hostSanitized, '56', '2'];
+        const filt = 'avg';
+        util.execSafe('ping', params, { timeout: 3000 }).then((stdout) => {
+          let result = null;
+          if (stdout) {
+            const lines = stdout.split('\n').filter(line => line.indexOf(filt) >= 0).join('\n');
+            const line = lines.split('=');
             if (line.length > 1) {
               const parts = line[1].split('/');
               if (parts.length > 1) {
@@ -201,9 +209,10 @@ function inetLatency(host, callback) {
       if (_windows) {
         let result = -1;
         try {
-          exec('ping ' + hostSanitized + ' -n 1', util.execOptsWin, function (error, stdout) {
-            if (!error) {
-              let lines = stdout.toString().split('\r\n');
+          const params = [hostSanitized, '-n', '1'];
+          util.execSafe('ping', params, util.execOptsWin).then((stdout) => {
+            if (stdout) {
+              let lines = stdout.split('\r\n');
               lines.shift();
               lines.forEach(function (line) {
                 if ((line.toLowerCase().match(/ms/g) || []).length === 3) {

package/lib/network.js

@@ -1057,7 +1057,7 @@ function networkStatsSingle(iface) {
     process.nextTick(() => {
       let ifaceSanitized = '';
       const s = util.isPrototypePolluted() ? '---' : util.sanitizeShellString(iface);
-      for (let i = 0; i <= 2000; i++) {
+      for (let i = 0; i <= util.mathMin(s.length, 2000); i++) {
         if (!(s[i] === undefined)) {
           ifaceSanitized = ifaceSanitized + s[i];
         }

package/lib/processes.js

@@ -109,7 +109,7 @@ function services(srv, callback) {
         srvString.__proto__.trim = util.stringTrim;
 
         const s = util.sanitizeShellString(srv);
-        for (let i = 0; i <= 2000; i++) {
+        for (let i = 0; i <= util.mathMin(s.length, 2000); i++) {
           if (!(s[i] === undefined)) {
             srvString = srvString + s[i];
           }
@@ -162,11 +162,15 @@ function services(srv, callback) {
               }
             }
           }
-          let comm = (_darwin) ? 'ps -caxo pcpu,pmem,pid,command' : 'ps -axo pcpu,pmem,pid,command';
+          if ((_darwin) && srvString === '*') { // service enumeration not yet suported on mac OS
+            if (callback) { callback(result); }
+            resolve(result);
+          }
+          let args = (_darwin) ? ['-caxo', 'pcpu,pmem,pid,command'] : ['-axo', 'pcpu,pmem,pid,command'];
           if (srvString !== '' && srvs.length > 0) {
-            exec(comm + ' | grep -v grep | grep -iE "' + srvString + '"', { maxBuffer: 1024 * 20000 }, function (error, stdout) {   // lgtm [js/shell-command-constructed-from-input]
-              if (!error) {
-                let lines = stdout.toString().replace(/ +/g, ' ').replace(/,+/g, '.').split('\n');
+            util.execSafe('ps', args).then((stdout) => {
+              if (stdout) {
+                let lines = stdout.replace(/ +/g, ' ').replace(/,+/g, '.').split('\n');
                 srvs.forEach(function (srv) {
                   let ps;
                   if (_darwin) {
@@ -261,9 +265,10 @@ function services(srv, callback) {
                   resolve(result);
                 }
               } else {
-                exec('ps -o comm | grep -v grep | egrep "' + srvString + '"', { maxBuffer: 1024 * 20000 }, function (error, stdout) {   // lgtm [js/shell-command-constructed-from-input]
-                  if (!error) {
-                    let lines = stdout.toString().replace(/ +/g, ' ').replace(/,+/g, '.').split('\n');
+                args = ['-o', 'comm'];
+                util.execSafe('ps', args).then((stdout) => {
+                  if (stdout) {
+                    let lines = stdout.replace(/ +/g, ' ').replace(/,+/g, '.').split('\n');
                     srvs.forEach(function (srv) {
                       let ps = lines.filter(function (e) {
                         return e.indexOf(srv) !== -1;

package/lib/util.js

@@ -57,6 +57,7 @@ const stringToString = new String().toString;
 const stringSubstr = new String().substr;
 const stringTrim = new String().trim;
 const stringStartWith = new String().startsWith;
+const mathMin = Math.min;
 
 function isFunction(functionToCheck) {
   let getType = {};
@@ -388,6 +389,42 @@ function powerShell(cmd) {
   });
 }
 
+function execSafe(cmd, args, options) {
+  let result = '';
+  options = options || {};
+
+  return new Promise((resolve) => {
+    process.nextTick(() => {
+      try {
+        const child = spawn(cmd, args, options);
+
+        if (child && !child.pid) {
+          child.on('error', function () {
+            resolve(result);
+          });
+        }
+        if (child && child.pid) {
+          child.stdout.on('data', function (data) {
+            result += data.toString();
+          });
+          child.on('close', function () {
+            child.kill();
+            resolve(result);
+          });
+          child.on('error', function () {
+            child.kill();
+            resolve(result);
+          });
+        } else {
+          resolve(result);
+        }
+      } catch (e) {
+        resolve(result);
+      }
+    });
+  });
+}
+
 function getCodepage() {
   if (_windows) {
     if (!codepage) {
@@ -502,7 +539,7 @@ function countLines(lines, startingWith) {
 function sanitizeShellString(str, strict = false) {
   const s = str || '';
   let result = '';
-  for (let i = 0; i <= 2000; i++) {
+  for (let i = 0; i <= mathMin(s.length, 2000); i++) {
     if (!(s[i] === undefined ||
       s[i] === '>' ||
       s[i] === '<' ||
@@ -525,10 +562,11 @@ function sanitizeShellString(str, strict = false) {
       s[i] === '\'' ||
       s[i] === '`' ||
       s[i] === '"' ||
-      strict && s[i] === '@' ||
-      strict && s[i] === ' ' ||
-      strict && s[i] == '{' ||
-      strict && s[i] == ')')) {
+      s[i].length > 1 ||
+      (strict && s[i] === '@') ||
+      (strict && s[i] === ' ') ||
+      (strict && s[i] == '{') ||
+      (strict && s[i] == ')'))) {
       result = result + s[i];
     }
   }
@@ -821,6 +859,7 @@ exports.wmic = wmic;
 exports.darwinXcodeExists = darwinXcodeExists;
 exports.getVboxmanage = getVboxmanage;
 exports.powerShell = powerShell;
+exports.execSafe = execSafe;
 exports.nanoSeconds = nanoSeconds;
 exports.countUniqueLines = countUniqueLines;
 exports.countLines = countLines;
@@ -836,4 +875,5 @@ exports.stringToString = stringToString;
 exports.stringSubstr = stringSubstr;
 exports.stringTrim = stringTrim;
 exports.stringStartWith = stringStartWith;
+exports.mathMin = mathMin;
 exports.WINDIR = WINDIR;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "systeminformation",
-  "version": "4.34.15",
+  "version": "4.34.19",
   "description": "Simple system and OS information library",
   "license": "MIT",
   "author": "Sebastian Hildebrandt <hildebrandt@plus-innovations.com> (https://plus-innovations.com)",