Function runSpeedtestCommand

speedlink/speedlink.ts:82–116

* Execute a remote or local speedtest command safely using spawn/execFile * to prevent shell injection via user-supplied server config fields.

(
  command: string,
  args: string[],
  options: { timeout: number; env?: NodeJS.ProcessEnv },
  label: string
)

/**
 * Execute a remote or local speedtest command safely using spawn/execFile
 * to prevent shell injection via user-supplied server config fields.
 */
async function runSpeedtestCommand(
  command: string,
  args: string[],
  options: { timeout: number; env?: NodeJS.ProcessEnv },
  label: string
): Promise<{ stdout: string; stderr: string }> {
  return new Promise<{ stdout: string; stderr: string }>((resolve, reject) => {
    const child = spawn(command, args, {
      timeout: options.timeout,
      env: options.env,
      killSignal: "SIGKILL" as const,
      shell: false,
    });
    let stdout = "";
    let stderr = "";
    child.stdout?.on("data", (data: Buffer) => { stdout += data.toString(); });
    child.stderr?.on("data", (data: Buffer) => { stderr += data.toString(); });
    child.on("error", (err: Error) => { reject(err); });
    child.on("close", (code: number | null) => {
      if (code === 0) {
        resolve({ stdout, stderr });
      } else {
        const err: any = new Error(`${label} exited with code ${code}: ${stderr || stdout}`);
        err.stderr = stderr;
        reject(err);
      }
    });
    // Force-kill on timeout (spawn timeout only signals, doesn't kill by default)
    const timer = setTimeout(() => {
      child.kill("SIGKILL");
      reject(new Error(`${label} timed out after ${options.timeout}ms`));
    }, options.timeout);
    child.on("close", () => { clearTimeout(timer); });
  });
}