Skip to content

Security: refactor disk resource lookup logic #5666

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Aug 13, 2025
Merged

Conversation

shamoon
Copy link
Collaborator

@shamoon shamoon commented Aug 13, 2025

Proposed change

Addresses GHSA-c4qv-fm8g-wm67

With 184fd65 the changes are:

  1. No longer check the passed string for existence, just check it against the drives returned from systeminformation using the same unchanged logic as before.
  2. Remove the fallback where previously if a drive wasn’t found it would just show / which isn’t really all that helpful.

So again, the logic of matching a drive hasn’t changed, we still just pull the list of drives from systeminformation and match them against the drive requested in the config. If you are now seeing “not available” you were previously seeing the root / and just didn’t realize.

A helpful tip, if you enable DEBUG and re-create the container you will see the output of the drives that are "visible" to homepage, e.g.:

[2025-08-16T16:24:28.741Z] debug: <resources> fsSize: [{"fs":"/dev/disk3s1s1","type":"APFS","size":1995218165760,"used":11264335872,"available":1276571226112,"use":0.87,"mount":"/","rw":false},{"fs":"/dev/disk3s6","type":"APFS","size":1995218165760,"used":20480,"available":1276571226112,"use":0,"mount":"/System/Volumes/VM","rw":true}]

It is the mount property that homepage matches against.

Additionally now, drives that aren't found will show:

[2025-08-16T16:24:28.742Z] warn: <resources> Drive not found for target: /etc/passwd

Type of change

  • New service widget
  • Bug fix (non-breaking change which fixes an issue)
  • New feature or enhancement (non-breaking change which adds functionality)
  • Documentation only
  • Other (please explain)

Checklist:

  • If applicable, I have added corresponding documentation changes.
  • If applicable, I have reviewed the feature / enhancement and / or service widget guidelines.
  • I have checked that all code style checks pass using pre-commit hooks and linting checks.
  • If applicable, I have tested my code for new features & regressions on both mobile & desktop devices, using the latest version of major browsers.

@shamoon shamoon merged commit d300163 into dev Aug 13, 2025
4 checks passed
@shamoon shamoon deleted the fix/c4qv-fm8g-wm67 branch August 13, 2025 13:16
tfoks pushed a commit to tfoks/homepage that referenced this pull request Aug 21, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant