Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

os-locale calls wmic with no extension and without explicit path #35

Open
stuartbrussell-intuit opened this issue Feb 19, 2019 · 6 comments

Comments

@stuartbrussell-intuit
Copy link

Our Windows app that uses os-locale has been flagged as a security risk because it will launch any file named "wmic", regardless of extension, and the file can be anywhere on the PATH, including the app's own directory. It could be a vbs file, for example.

The suggested secure way (if you have to use wmic):

  1. Always use the exe extension.
  2. Always use the full standard path to wmic.exe.
@sindresorhus
Copy link
Owner

  1. Is this path the same for all Windows version and locales?

@sindresorhus
Copy link
Owner

// @MarkTiedemann Idea for a Windows binary, if you need project ideas. A simple binary to get the locale on Windows. So we don't have to use wmic.

@MarkTiedemann
Copy link

@sindresorhus Done. See: locale. Note that it prints en-US instead of en_US.

@MarkTiedemann
Copy link

Updated locale (v0.2.0) to work for Windows < Windows Vista, too.

:: If Windows Vista or greater
$ locale
{"locale":"en-US"}

:: Else
$ locale
{"lcid":1033}

@sindresorhus Let me know if you need anything else. :)

@sindresorhus
Copy link
Owner

I don't really see the point of supporting older than Vista. Those are ancient versions and not worth our time. I'm not going to support them anyway, so I personally preferred the first version that only printed a string, but I can work with this too and only use the locale property :)

@MarkTiedemann
Copy link

MarkTiedemann commented Mar 16, 2019

I don't really see the point of supporting older than Vista.

All right. I'll switch back to locale only then. This also simplifies the build process a lot.

locale v1.0.0 now only prints en-US again.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants