fix: remote-execution with upload permissions on mac+linux. Thanks to @charmindoge for reporting (CVE requested)
Massimo Melina committed
Jul 2, 2024 at 21:25 UTC
305381bd36eee074fb238b64302a252668daad1d
1 file changed
+2
-2
src/util-os.ts
+2
-2
@@ -1,6 +1,6 @@
1
import { dirname, resolve } from 'path'
2
import { existsSync } from 'fs'
3
-import { exec, execSync } from 'child_process'
3
+import { exec, execSync, spawnSync } from 'child_process'
4
import { onlyTruthy, splitAt, try_ } from './misc'
5
import _ from 'lodash'
6
import { pid } from 'node:process'
@@ -18,7 +18,7 @@ export function getDiskSpaceSync(path: string) {
18
}
19
while (path && !existsSync(path))
20
path = dirname(path)
21
- const out = try_(() => execSync(`df -k "${path}"`).toString(),
21
+ const out = try_(() => spawnSync('df', ['-k', path]).stdout.toString(),
22
err => { throw err.status === 1 ? Error('miss') : err.status === 127 ? Error('unsupported') : err })
23
if (!out?.startsWith('Filesystem'))
24
throw Error('unsupported')