arunoda / node-usage

process usage lookup with nodejs
MIT License
389 stars 93 forks source link

pid parameter subject to command injection #49

Open astanciu opened 9 years ago

astanciu commented 9 years ago

You should probably validate that pid is a digit only string. This line in ps.js is not very secure: exec('ps -o "rss,vsize,pcpu" -p ' + pid, function(err, stdout, stderr) {

I got this to work on OSX: usage.lookup("123; say foobar", options, function(err, result, p) {