fix(dart): Read Windows total physical memory via GlobalMemoryStatusEx instead of wmic.exe - #3894
Conversation
d5de069 to
26fc32f
Compare
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #3894 +/- ##
==========================================
+ Coverage 87.94% 88.06% +0.11%
==========================================
Files 347 347
Lines 12929 12906 -23
==========================================
- Hits 11371 11366 -5
+ Misses 1558 1540 -18
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. |
The IO device-context enricher shelled out to `wmic.exe` (falling back to PowerShell) to read `TotalPhysicalMemory` on Windows. WMIC is deprecated and absent on recent Windows installs, and spawning a child process for every enriched event is both slow and noisy for endpoint-security tooling that flags `wmic.exe` executions. Read the value directly from the kernel via `GlobalMemoryStatusEx` (`kernel32.dll`) using `dart:ffi`, matching the previous byte-valued semantics and removing the process spawn entirely. Adds the `ffi` package dependency, already used by `sentry_flutter`.
26fc32f to
6341cc4
Compare
lucas-zimerman
left a comment
There was a problem hiding this comment.
Looks good to me, CI passed with the changes in regard to windows, there are some failures on other platforms but probably unrelated to this PR.
@buenaflor Anything that you would like to point out? I checked locally, and the PR is working as intended, if there is nothing else to change from your part, LGTM!
|
LGTM if you tested it as well. CI failures are because of missing auth for E2E tests, but that's fine |
|
There seems to be Analyze errors |
📜 Description
On Windows, the pure-Dart IO device-context enricher (
PlatformMemory) readTotalPhysicalMemoryby shelling out towmic.exe(wmic ComputerSystem get TotalPhysicalMemory /VALUE), falling back topowershell.exewhen WMIC was absent. This replaces both process spawns with a direct kernel call toGlobalMemoryStatusExfromkernel32.dllviadart:ffi, readingMEMORYSTATUSEX.ullTotalPhys.The returned value keeps the previous semantics (bytes), so
device.memorySizeis unchanged. TheuseWindowsWmci/useWindowsPowerShellprobing, the WMIC/PowerShell helpers, and thewmic.exe/powershell.exeexistence checks are all removed. Addsffi: ^2.0.0as a dependency — already used bysentry_flutter.💡 Motivation and Context
WMIC is deprecated and being removed from current Windows installs. Two problems with the current approach:
wmic.exe(orpowershell.exe) child process under the host application. EDR/XDR tooling flags these spawns, and users ask why the app is invoking a deprecated Windows utility.GlobalMemoryStatusExis the documented Win32 API for this value, needs no child process, and works regardless of whether WMIC is installed. The library the current code was copied from (system_info2/onepub-dev/system_info) still uses WMIC on itsmasterbranch, so there's no upstream version to lean on here.💚 How did you test it?
Covered by the existing
test/event_processor/enricher/io_platform_memory_test.dart, which asserts a non-null, positiveTotalPhysicalMemoryon Windows and Linux andnullelsewhere.dart analyzeanddart formatare clean on the change.📝 Checklist
sendDefaultPiiis enabledChangelog Entry
Read Windows total physical memory via the native
GlobalMemoryStatusExAPI instead of spawning the deprecatedwmic.exe(or PowerShell) process.