Skip to content

Commit b67d371

Browse files
sebhildebrandtsebhildebrandt
committed
versions() fix Command Injection issue (linux), added smartmontools support (macOS)
1 parent 612d97e commit b67d371

8 files changed

Lines changed: 115 additions & 44 deletions

File tree

‎CHANGELOG.md‎

Lines changed: 34 additions & 32 deletions
Large diffs are not rendered by default.

‎README.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -539,8 +539,8 @@ Full function reference with examples can be found at
539539
| | [0].serialNum | X | | X | X | | serial number |
540540
| | [0].interfaceType | X | | X | X | | SATA, PCIe, ... |
541541
| | [0].smartStatus | X | | X | X | | S.M.A.R.T Status (see Known Issues) |
542-
| | [0].temperature | X | | | | | S.M.A.R.T temperature |
543-
| | [0].smartData | X | | | X | | full S.M.A.R.T data from smartctl<br>requires at least smartmontools 7.0 |
542+
| | [0].temperature | X | | X | X | | S.M.A.R.T temperature |
543+
| | [0].smartData | X | | X | X | | full S.M.A.R.T data from smartctl<br>requires at least smartmontools 7.0 |
544544
| si.blockDevices(cb) | [{...}] | X | | X | X | | returns array of disks, partitions,<br>raids and roms |
545545
| | [0].name | X | | X | X | | name |
546546
| | [0].type | X | | X | X | | type |

‎docs/filesystem.html‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -242,8 +242,8 @@ <h2>Disk Layout, Block Devices and Disks IO</h2>
242242
<td>[0].temperature</td>
243243
<td>X</td>
244244
<td></td>
245-
<td></td>
246-
<td></td>
245+
<td>X</td>
246+
<td>X</td>
247247
<td></td>
248248
<td>S.M.A.R.T temperature (if available)</td>
249249
</tr>
@@ -252,7 +252,7 @@ <h2>Disk Layout, Block Devices and Disks IO</h2>
252252
<td>[0].smartData</td>
253253
<td>X</td>
254254
<td></td>
255-
<td></td>
255+
<td>X</td>
256256
<td>X</td>
257257
<td></td>
258258
<td>full S.M.A.R.T data from smartctl<br>requires at least smartmontools 7.0<br>(see Known Issues)</td>

‎docs/history.html‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,12 @@ <h3>Full version history</h3>
5757
</tr>
5858
</thead>
5959
<tbody>
60+
<tr>
61+
<th scope="row">5.31.0
62+
</th>
63+
<td>2026-02-15</td>
64+
<td><span class="code">diskLayout()</span> added smartmontools support (macOS)</td>
65+
</tr>
6066
<tr>
6167
<th scope="row">5.30.8
6268
</th>

‎docs/index.html‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -170,7 +170,7 @@
170170
<img class="logo" src="assets/logo.png" alt="logo">
171171
<div class="title">systeminformation</div>
172172
<div class="subtitle"><span id="typed"></span>&nbsp;</div>
173-
<div class="version">New Version: <span id="version">5.30.8</span></div>
173+
<div class="version">New Version: <span id="version">5.31.0</span></div>
174174
<button class="btn btn-light" onclick="location.href='https://github.com/sebhildebrandt/systeminformation'">View on Github <i class=" fab fa-github"></i></button>
175175
</div>
176176
<div class="down">
@@ -212,7 +212,7 @@
212212
<div class="title">Downloads last month</div>
213213
</div>
214214
<div class="col-xl-4 col-lg-4 col-md-4 col-12">
215-
<div class="numbers">969</div>
215+
<div class="numbers">973</div>
216216
<div class="title">Dependents</div>
217217
</div>
218218
</div>

‎docs/issues.html‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -73,10 +73,14 @@ <h4>Windows, macOS - CPU Speed</h4>
7373
<p><span class="code">node.js</span> and <span class="code">get-WmiObject</span> are not able to determine correct CPU current speed on windows and macOS.
7474
This means, you will have constant values here on both platforms for all processor cores in <span class="code">cpuCurrentSpeed()</span>.</p>
7575

76-
<h4>Linux S.M.A.R.T. Status</h4>
76+
<h4>Linux, Windows, macOS - S.M.A.R.T. Status</h4>
7777

78-
<p>To be able to detect S.M.A.R.T. status on Linux you need to install <span class="code">smartmontools</span>. On DEBIAN based linux distributions you can install it by running:</p>
78+
<p>To be able to detect S.M.A.R.T. status on macOS, Windows and Linux you need to install <span class="code">smartmontools</span>.</p>
79+
<p>On DEBIAN based linux distributions you can install it by running:</p>
7980
<pre>$ sudo apt-get install smartmontools</pre>
81+
<p>On macOS you can install it using <span class="code">brew</span>:</p>
82+
<pre>$ brew install smartmontools</pre>
83+
<p>On windows you can download it from <a href="https://www.smartmontools.org/">https://www.smartmontools.org/</a></p>
8084
<p>If you have smartmontools version >= 7.0 then you will get also full smart data in diskLayout()</p>
8185

8286
<h4>Stats Functions</h4>

‎lib/filesystem.js‎

Lines changed: 55 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1349,6 +1349,7 @@ function diskLayout(callback) {
13491349
resolve(result);
13501350
}
13511351
if (_darwin) {
1352+
let cmdFullSmart = '';
13521353
exec('system_profiler SPSerialATADataType SPNVMeDataType SPUSBDataType', { maxBuffer: 1024 * 1024 }, (error, stdout) => {
13531354
if (!error) {
13541355
// split by type:
@@ -1420,6 +1421,7 @@ function diskLayout(callback) {
14201421
BSDName: BSDName
14211422
});
14221423
cmd = cmd + 'printf "\n' + BSDName + '|"; diskutil info /dev/' + BSDName + ' | grep SMART;';
1424+
cmdFullSmart += `${cmdFullSmart ? 'printf ",";' : ''}smartctl -a -j ${BSDName};`;
14231425
}
14241426
}
14251427
});
@@ -1475,6 +1477,7 @@ function diskLayout(callback) {
14751477
BSDName: BSDName
14761478
});
14771479
cmd = `${cmd}printf "\n${BSDName}|"; diskutil info /dev/${BSDName} | grep SMART;`;
1480+
cmdFullSmart += `${cmdFullSmart ? 'printf ",";' : ''}smartctl -a -j ${BSDName};`;
14781481
}
14791482
}
14801483
});
@@ -1527,13 +1530,64 @@ function diskLayout(callback) {
15271530
BSDName: BSDName
15281531
});
15291532
cmd = cmd + 'printf "\n' + BSDName + '|"; diskutil info /dev/' + BSDName + ' | grep SMART;';
1533+
cmdFullSmart += `${cmdFullSmart ? 'printf ",";' : ''}smartctl -a -j ${BSDName};`;
15301534
}
15311535
}
15321536
});
15331537
} catch {
15341538
util.noop();
15351539
}
1536-
if (cmd) {
1540+
// check S.M.A.R.T. status
1541+
if (cmdFullSmart) {
1542+
exec(cmdFullSmart, { maxBuffer: 1024 * 1024 }, (error, stdout) => {
1543+
try {
1544+
const data = JSON.parse(`[${stdout}]`);
1545+
data.forEach((disk) => {
1546+
const diskBSDName = disk.smartctl.argv[disk.smartctl.argv.length - 1];
1547+
1548+
for (let i = 0; i < result.length; i++) {
1549+
if (result[i].BSDName === diskBSDName) {
1550+
result[i].smartStatus = disk.smart_status.passed ? 'Ok' : disk.smart_status.passed === false ? 'Predicted Failure' : 'unknown';
1551+
if (disk.temperature && disk.temperature.current) {
1552+
result[i].temperature = disk.temperature.current;
1553+
}
1554+
result[i].smartData = disk;
1555+
}
1556+
}
1557+
});
1558+
commitResult(result);
1559+
} catch (e) {
1560+
if (cmd) {
1561+
cmd = cmd + 'printf "\n"';
1562+
exec(cmd, { maxBuffer: 1024 * 1024 }, (error, stdout) => {
1563+
const lines = stdout.toString().split('\n');
1564+
lines.forEach((line) => {
1565+
if (line) {
1566+
const parts = line.split('|');
1567+
if (parts.length === 2) {
1568+
const BSDName = parts[0];
1569+
parts[1] = parts[1].trim();
1570+
const parts2 = parts[1].split(':');
1571+
if (parts2.length === 2) {
1572+
parts2[1] = parts2[1].trim();
1573+
const status = parts2[1].toLowerCase();
1574+
for (let i = 0; i < result.length; i++) {
1575+
if (result[i].BSDName === BSDName) {
1576+
result[i].smartStatus = status === 'passed' ? 'Ok' : status === 'failed!' ? 'Predicted Failure' : 'unknown';
1577+
}
1578+
}
1579+
}
1580+
}
1581+
}
1582+
});
1583+
commitResult(result);
1584+
});
1585+
} else {
1586+
commitResult(result);
1587+
}
1588+
}
1589+
});
1590+
} else if (cmd) {
15371591
cmd = cmd + 'printf "\n"';
15381592
exec(cmd, { maxBuffer: 1024 * 1024 }, (error, stdout) => {
15391593
const lines = stdout.toString().split('\n');

‎lib/osinfo.js‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -769,9 +769,14 @@ function versions(apps, callback) {
769769
if (_linux) {
770770
exec('locate bin/postgres', (error, stdout) => {
771771
if (!error) {
772-
const postgresqlBin = stdout.toString().split('\n').sort();
772+
const safePath = /^[a-zA-Z0-9/_.-]+$/;
773+
const postgresqlBin = stdout
774+
.toString()
775+
.split('\n')
776+
.filter((p) => safePath.test(p.trim()))
777+
.sort();
773778
if (postgresqlBin.length) {
774-
exec(postgresqlBin[postgresqlBin.length - 1] + ' -V', (error, stdout) => {
779+
execFile(postgresqlBin[postgresqlBin.length - 1], ['-V'], (error, stdout) => {
775780
if (!error) {
776781
const postgresql = stdout.toString().split('\n')[0].split(' ') || [];
777782
appsObj.versions.postgresql = postgresql.length ? postgresql[postgresql.length - 1] : '';

0 commit comments

Comments
 (0)