Best-practices scanner

This is a regex-based check for API usage that can pose security, performance or
maintainability issues, or that may already be provided by Cinnamon. Having code flagged
by it doesn't automatically disqualify a pull request.

This check is not perfect will not replace a normal review.

Found 7 potential issue(s):

⚠️ sync_spawn_command_line

CrosshairCursor@BMarkley/files/CrosshairCursor@BMarkley/applet.js:64

let [ok, stdout, stderr, status] = GLib.spawn_command_line_sync(`pgrep -x ${programName}`);

Synchronous process spawning blocks the main loop.
Use GLib.spawn_command_line_async() or Gio.Subprocess instead.

⚠️ hardcoded_data_dir

CrosshairCursor@BMarkley/files/CrosshairCursor@BMarkley/applet.js:7

const APPLET_DIR = HOME + "/.local/share/cinnamon/applets/" + UUID;

Avoid hardcoding .local/share in paths. Use GLib.get_user_data_dir() instead,
which respects the XDG_DATA_HOME environment variable.

CrosshairCursor@BMarkley/files/CrosshairCursor@BMarkley/applet.js:24

Gettext.bindtextdomain(UUID, HOME + "/.local/share/locale");

Avoid hardcoding .local/share in paths. Use GLib.get_user_data_dir() instead,
which respects the XDG_DATA_HOME environment variable.

ℹ️ shell_string_spawn

CrosshairCursor@BMarkley/files/CrosshairCursor@BMarkley/applet.js:42

Util.spawnCommandLine(`/usr/bin/env bash -c 'chmod +x ${CROSSHAIR_SCRIPT}'`);

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

CrosshairCursor@BMarkley/files/CrosshairCursor@BMarkley/applet.js:44

Util.spawnCommandLine(`/usr/bin/env bash -c 'chmod +x ${CROSSHAIR_EXEC}'`);

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

CrosshairCursor@BMarkley/files/CrosshairCursor@BMarkley/applet.js:49

GLib.spawn_command_line_async(CROSSHAIR_SCRIPT);

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

CrosshairCursor@BMarkley/files/CrosshairCursor@BMarkley/applet.js:64

let [ok, stdout, stderr, status] = GLib.spawn_command_line_sync(`pgrep -x ${programName}`);

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

Automated pattern check.

If I'm not mistaken, compiled binaries are not allowed. @rcalixte ?

Best-practices scanner

This is a regex-based check for API usage that can pose security, performance or
maintainability issues, or that may already be provided by Cinnamon. Having code flagged
by it doesn't automatically disqualify a pull request.

This check is not perfect will not replace a normal review.

Found 5 potential issue(s):

⚠️ sync_spawn_command_line

CrosshairCursor@BMarkley/files/CrosshairCursor@BMarkley/applet.js:65

let [ok, stdout, stderr, status] = GLib.spawn_command_line_sync(`pgrep -x ${programName}`);

Synchronous process spawning blocks the main loop.
Use GLib.spawn_command_line_async() or Gio.Subprocess instead.

ℹ️ shell_string_spawn

CrosshairCursor@BMarkley/files/CrosshairCursor@BMarkley/applet.js:43

Util.spawnCommandLine(`/usr/bin/env bash -c 'chmod +x ${CROSSHAIR_SCRIPT}'`);

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

CrosshairCursor@BMarkley/files/CrosshairCursor@BMarkley/applet.js:45

Util.spawnCommandLine(`/usr/bin/env bash -c 'chmod +x ${CROSSHAIR_EXEC}'`);

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

CrosshairCursor@BMarkley/files/CrosshairCursor@BMarkley/applet.js:50

GLib.spawn_command_line_async(CROSSHAIR_SCRIPT);

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

CrosshairCursor@BMarkley/files/CrosshairCursor@BMarkley/applet.js:65

let [ok, stdout, stderr, status] = GLib.spawn_command_line_sync(`pgrep -x ${programName}`);

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

Automated pattern check.

If I'm not mistaken, compiled binaries are not allowed. @rcalixte ?

If not allowed, how would I best share this program with a wider audience? I think it might be very useful for people with vision impairments, and I find it helps a lot with eye strain - which is why I developed it. As such I'd like to get it out there so people that need something like this, can have easier access to it. Any advice would be appreciated.

I tried getting "util.spawn" to work for this application, but I can't seem to get it to work. I am not a js programmer so I am a bit stuck on how to use this spawn utility. I can't find documentation online to help me. I copied the applet.js script from the oneko launcher and modified it to be a launcher for my application. Perhaps someone can help me with that. It does work as it is though, and I am using it on my home system.

Best-practices scanner

This is a regex-based check for API usage that can pose security, performance or
maintainability issues, or that may already be provided by Cinnamon. Having code flagged
by it doesn't automatically disqualify a pull request.

This check is not perfect will not replace a normal review.

Found 5 potential issue(s):

⚠️ sync_spawn_command_line

CrosshairCursor@BMarkley/files/CrosshairCursor@BMarkley/applet.js:65

let [ok, stdout, stderr, status] = GLib.spawn_command_line_sync(`pgrep -x ${programName}`);

Synchronous process spawning blocks the main loop.
Use GLib.spawn_command_line_async() or Gio.Subprocess instead.

ℹ️ shell_string_spawn

CrosshairCursor@BMarkley/files/CrosshairCursor@BMarkley/applet.js:43

Util.spawnCommandLine(`/usr/bin/env bash -c 'chmod +x ${CROSSHAIR_SCRIPT}'`);

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

CrosshairCursor@BMarkley/files/CrosshairCursor@BMarkley/applet.js:45

Util.spawnCommandLine(`/usr/bin/env bash -c 'chmod +x ${CROSSHAIR_EXEC}'`);

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

CrosshairCursor@BMarkley/files/CrosshairCursor@BMarkley/applet.js:50

GLib.spawn_command_line_async(CROSSHAIR_SCRIPT);

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

CrosshairCursor@BMarkley/files/CrosshairCursor@BMarkley/applet.js:65

let [ok, stdout, stderr, status] = GLib.spawn_command_line_sync(`pgrep -x ${programName}`);

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

Automated pattern check.

Best-practices scanner

This is a regex-based check for API usage that can pose security, performance or
maintainability issues, or that may already be provided by Cinnamon. Having code flagged
by it doesn't automatically disqualify a pull request.

This check is not perfect will not replace a normal review.

Found 7 potential issue(s):

⚠️ sync_spawn_command_line

CrosshairCursor@BMarkley/files/CrosshairCursor@BMarkley/applet.js:70

let [ok, stdout, stderr, status] = GLib.spawn_command_line_sync(`pgrep -x ${programName}`);

Synchronous process spawning blocks the main loop.
Use GLib.spawn_command_line_async() or Gio.Subprocess instead.

ℹ️ shell_string_spawn

CrosshairCursor@BMarkley/files/CrosshairCursor@BMarkley/applet.js:45

Util.spawnCommandLine(`/usr/bin/env bash -c 'chmod +x ${CROSSHAIR_COMPILE}'`);

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

CrosshairCursor@BMarkley/files/CrosshairCursor@BMarkley/applet.js:46

Util.spawnCommandLine(CROSSHAIR_COMPILE);

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

CrosshairCursor@BMarkley/files/CrosshairCursor@BMarkley/applet.js:48

Util.spawnCommandLine(`/usr/bin/env bash -c 'chmod +x ${CROSSHAIR_SCRIPT}'`);

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

CrosshairCursor@BMarkley/files/CrosshairCursor@BMarkley/applet.js:50

Util.spawnCommandLine(`/usr/bin/env bash -c 'chmod +x ${CROSSHAIR_EXEC}'`);

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

CrosshairCursor@BMarkley/files/CrosshairCursor@BMarkley/applet.js:55

GLib.spawn_command_line_async(CROSSHAIR_SCRIPT);

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

CrosshairCursor@BMarkley/files/CrosshairCursor@BMarkley/applet.js:70

let [ok, stdout, stderr, status] = GLib.spawn_command_line_sync(`pgrep -x ${programName}`);

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

Automated pattern check.

Now instead of having an executable binary, the applet has the source files for the binary, and the binary is compiled inside the applet.js constructor. I hope this is sufficient to meet requirements.

-Brian

Best-practices scanner

This is a regex-based check for API usage that can pose security, performance or
maintainability issues, or that may already be provided by Cinnamon. Having code flagged
by it doesn't automatically disqualify a pull request.

This check is not perfect will not replace a normal review.

Found 7 potential issue(s):

⚠️ sync_spawn_command_line

CrosshairCursor@BMarkley/files/CrosshairCursor@BMarkley/applet.js:70

let [ok, stdout, stderr, status] = GLib.spawn_command_line_sync(`pgrep -x ${programName}`);

Synchronous process spawning blocks the main loop.
Use GLib.spawn_command_line_async() or Gio.Subprocess instead.

ℹ️ shell_string_spawn

CrosshairCursor@BMarkley/files/CrosshairCursor@BMarkley/applet.js:45

Util.spawnCommandLine(`/usr/bin/env bash -c 'chmod +x ${CROSSHAIR_COMPILE}'`);

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

CrosshairCursor@BMarkley/files/CrosshairCursor@BMarkley/applet.js:46

Util.spawnCommandLine(CROSSHAIR_COMPILE);

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

CrosshairCursor@BMarkley/files/CrosshairCursor@BMarkley/applet.js:48

Util.spawnCommandLine(`/usr/bin/env bash -c 'chmod +x ${CROSSHAIR_SCRIPT}'`);

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

CrosshairCursor@BMarkley/files/CrosshairCursor@BMarkley/applet.js:50

Util.spawnCommandLine(`/usr/bin/env bash -c 'chmod +x ${CROSSHAIR_EXEC}'`);

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

CrosshairCursor@BMarkley/files/CrosshairCursor@BMarkley/applet.js:55

GLib.spawn_command_line_async(CROSSHAIR_SCRIPT);

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

CrosshairCursor@BMarkley/files/CrosshairCursor@BMarkley/applet.js:70

let [ok, stdout, stderr, status] = GLib.spawn_command_line_sync(`pgrep -x ${programName}`);

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

Automated pattern check.

Best-practices scanner

This is a regex-based check for API usage that can pose security, performance or
maintainability issues, or that may already be provided by Cinnamon. Having code flagged
by it doesn't automatically disqualify a pull request.

This check is not perfect will not replace a normal review.

Found 7 potential issue(s):

⚠️ sync_spawn_command_line

CrosshairCursor@BMarkley/files/CrosshairCursor@BMarkley/applet.js:70

let [ok, stdout, stderr, status] = GLib.spawn_command_line_sync(`pgrep -x ${programName}`);

Synchronous process spawning blocks the main loop.
Use GLib.spawn_command_line_async() or Gio.Subprocess instead.

ℹ️ shell_string_spawn

CrosshairCursor@BMarkley/files/CrosshairCursor@BMarkley/applet.js:45

Util.spawnCommandLine(`/usr/bin/env bash -c 'chmod +x ${CROSSHAIR_COMPILE}'`);

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

CrosshairCursor@BMarkley/files/CrosshairCursor@BMarkley/applet.js:46

Util.spawnCommandLine(CROSSHAIR_COMPILE);

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

CrosshairCursor@BMarkley/files/CrosshairCursor@BMarkley/applet.js:48

Util.spawnCommandLine(`/usr/bin/env bash -c 'chmod +x ${CROSSHAIR_SCRIPT}'`);

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

CrosshairCursor@BMarkley/files/CrosshairCursor@BMarkley/applet.js:50

Util.spawnCommandLine(`/usr/bin/env bash -c 'chmod +x ${CROSSHAIR_EXEC}'`);

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

CrosshairCursor@BMarkley/files/CrosshairCursor@BMarkley/applet.js:55

GLib.spawn_command_line_async(CROSSHAIR_SCRIPT);

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

CrosshairCursor@BMarkley/files/CrosshairCursor@BMarkley/applet.js:70

let [ok, stdout, stderr, status] = GLib.spawn_command_line_sync(`pgrep -x ${programName}`);

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

Automated pattern check.

@mtwebster @clefebvre This applet contains a c source and binary. Is that ok?

@BMarkley

Now instead of having an executable binary, the applet has the source files for the binary, and the binary is compiled inside the applet.js constructor...

The compiled binary is still there though I don't know if this is a problem or not. Also I tried compiling the source (gcc (GCC) 15.2.1 20260209 (manjaro linux)) and there were a few small errors.

gcc -g -O2 -fno-strict-aliasing         -Dlinux -D__amd64__ -D_POSIX_C_SOURCE=199309L 				-D_POSIX_SOURCE -D_XOPEN_SOURCE 		-D_BSD_SOURCE -D_SVID_SOURCE                                 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 				  				  -DFUNCPROTO=15 -DNARROWPROTO   -DSHAPE    -c -o CrosshairCursor.o CrosshairCursor.c
In file included from /usr/include/sys/types.h:25,
                 from /usr/include/X11/Xlib.h:38,
                 from /usr/include/X11/Xutil.h:53,
                 from /usr/include/X11/extensions/shape.h:34,
                 from CrosshairCursor.c:12:
/usr/include/features.h:205:3: warning: #warning "_BSD_SOURCE and _SVID_SOURCE are deprecated, use _DEFAULT_SOURCE" [-Wcpp]
  205 | # warning "_BSD_SOURCE and _SVID_SOURCE are deprecated, use _DEFAULT_SOURCE"
      |   ^~~~~~~
CrosshairCursor.c: In function ‘InitScreen’:
CrosshairCursor.c:170:1: warning: old-style function definition [-Wold-style-definition]
  170 | InitScreen(DisplayName)
      | ^~~~~~~~~~
CrosshairCursor.c: In function ‘DrawNeko’:
CrosshairCursor.c:282:1: warning: old-style function definition [-Wold-style-definition]
  282 | DrawNeko(x, y)
      | ^~~~~~~~
CrosshairCursor.c: In function ‘RedrawNeko’:
CrosshairCursor.c:340:1: warning: old-style function definition [-Wold-style-definition]
  340 | RedrawNeko(x, y)
      | ^~~~~~~~~~
CrosshairCursor.c: In function ‘NekoErrorHandler’:
CrosshairCursor.c:477:1: warning: old-style function definition [-Wold-style-definition]
  477 | NekoErrorHandler(dpy, err)
      | ^~~~~~~~~~~~~~~~
CrosshairCursor.c: In function ‘GetArguments’:
CrosshairCursor.c:539:1: warning: old-style function definition [-Wold-style-definition]
  539 | GetArguments(argc, argv, theDisplayName)
      | ^~~~~~~~~~~~
CrosshairCursor.c: In function ‘main’:
CrosshairCursor.c:679:1: warning: old-style function definition [-Wold-style-definition]
  679 | main(argc, argv)
      | ^~~~
CrosshairCursor.c:697:19: error: passing argument 2 of ‘signal’ from incompatible pointer type [-Wincompatible-pointer-types]
  697 |   signal(SIGALRM, NullFunction);
      |                   ^~~~~~~~~~~~
      |                   |
      |                   void (*)(void)
In file included from CrosshairCursor.c:18:
/usr/include/signal.h:88:57: note: expected ‘__sighandler_t’ {aka ‘void (*)(int)’} but argument is of type ‘void (*)(void)’
   88 | extern __sighandler_t signal (int __sig, __sighandler_t __handler)
      |                                          ~~~~~~~~~~~~~~~^~~~~~~~~
CrosshairCursor.c:461:1: note: ‘NullFunction’ declared here
  461 | NullFunction()
      | ^~~~~~~~~~~~
/usr/include/signal.h:72:16: note: ‘__sighandler_t’ declared here
   72 | typedef void (*__sighandler_t) (int);
      |                ^~~~~~~~~~~~~~
CrosshairCursor.c:698:18: error: passing argument 2 of ‘signal’ from incompatible pointer type [-Wincompatible-pointer-types]
  698 |   signal(SIGINT, RestoreCursor);
      |                  ^~~~~~~~~~~~~
      |                  |
      |                  void (*)(void)
/usr/include/signal.h:88:57: note: expected ‘__sighandler_t’ {aka ‘void (*)(int)’} but argument is of type ‘void (*)(void)’
   88 | extern __sighandler_t signal (int __sig, __sighandler_t __handler)
      |                                          ~~~~~~~~~~~~~~~^~~~~~~~~
CrosshairCursor.c:245:1: note: ‘RestoreCursor’ declared here
  245 | RestoreCursor()
      | ^~~~~~~~~~~~~
/usr/include/signal.h:72:16: note: ‘__sighandler_t’ declared here
   72 | typedef void (*__sighandler_t) (int);
      |                ^~~~~~~~~~~~~~
CrosshairCursor.c:699:19: error: passing argument 2 of ‘signal’ from incompatible pointer type [-Wincompatible-pointer-types]
  699 |   signal(SIGTERM, RestoreCursor);
      |                   ^~~~~~~~~~~~~
      |                   |
      |                   void (*)(void)
/usr/include/signal.h:88:57: note: expected ‘__sighandler_t’ {aka ‘void (*)(int)’} but argument is of type ‘void (*)(void)’
   88 | extern __sighandler_t signal (int __sig, __sighandler_t __handler)
      |                                          ~~~~~~~~~~~~~~~^~~~~~~~~
CrosshairCursor.c:245:1: note: ‘RestoreCursor’ declared here
  245 | RestoreCursor()
      | ^~~~~~~~~~~~~
/usr/include/signal.h:72:16: note: ‘__sighandler_t’ declared here
   72 | typedef void (*__sighandler_t) (int);
      |                ^~~~~~~~~~~~~~
CrosshairCursor.c:700:19: error: passing argument 2 of ‘signal’ from incompatible pointer type [-Wincompatible-pointer-types]
  700 |   signal(SIGQUIT, RestoreCursor);
      |                   ^~~~~~~~~~~~~
      |                   |
      |                   void (*)(void)
/usr/include/signal.h:88:57: note: expected ‘__sighandler_t’ {aka ‘void (*)(int)’} but argument is of type ‘void (*)(void)’
   88 | extern __sighandler_t signal (int __sig, __sighandler_t __handler)
      |                                          ~~~~~~~~~~~~~~~^~~~~~~~~
CrosshairCursor.c:245:1: note: ‘RestoreCursor’ declared here
  245 | RestoreCursor()
      | ^~~~~~~~~~~~~
/usr/include/signal.h:72:16: note: ‘__sighandler_t’ declared here
   72 | typedef void (*__sighandler_t) (int);
      |                ^~~~~~~~~~~~~~
make: *** [<builtin>: CrosshairCursor.o] Error 1

Best-practices scanner

This is a regex-based check for API usage that can pose security, performance or
maintainability issues, or that may already be provided by Cinnamon. Having code flagged
by it doesn't automatically disqualify a pull request.

This check is not perfect will not replace a normal review.

Found 7 potential issue(s):

⚠️ sync_spawn_command_line

CrosshairCursor@BMarkley/files/CrosshairCursor@BMarkley/applet.js:70

let [ok, stdout, stderr, status] = GLib.spawn_command_line_sync(`pgrep -x ${programName}`);

Synchronous process spawning blocks the main loop.
Use GLib.spawn_command_line_async() or Gio.Subprocess instead.

ℹ️ shell_string_spawn

CrosshairCursor@BMarkley/files/CrosshairCursor@BMarkley/applet.js:45

Util.spawnCommandLine(`/usr/bin/env bash -c 'chmod +x ${CROSSHAIR_COMPILE}'`);

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

CrosshairCursor@BMarkley/files/CrosshairCursor@BMarkley/applet.js:46

Util.spawnCommandLine(CROSSHAIR_COMPILE);

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

CrosshairCursor@BMarkley/files/CrosshairCursor@BMarkley/applet.js:48

Util.spawnCommandLine(`/usr/bin/env bash -c 'chmod +x ${CROSSHAIR_SCRIPT}'`);

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

CrosshairCursor@BMarkley/files/CrosshairCursor@BMarkley/applet.js:50

Util.spawnCommandLine(`/usr/bin/env bash -c 'chmod +x ${CROSSHAIR_EXEC}'`);

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

CrosshairCursor@BMarkley/files/CrosshairCursor@BMarkley/applet.js:55

GLib.spawn_command_line_async(CROSSHAIR_SCRIPT);

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

CrosshairCursor@BMarkley/files/CrosshairCursor@BMarkley/applet.js:70

let [ok, stdout, stderr, status] = GLib.spawn_command_line_sync(`pgrep -x ${programName}`);

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

Automated pattern check.

Best-practices scanner

This is a regex-based check for API usage that can pose security, performance or
maintainability issues, or that may already be provided by Cinnamon. Having code flagged
by it doesn't automatically disqualify a pull request.

This check is not perfect will not replace a normal review.

Found 7 potential issue(s):

⚠️ sync_spawn_command_line

CrosshairCursor@BMarkley/files/CrosshairCursor@BMarkley/applet.js:70

let [ok, stdout, stderr, status] = GLib.spawn_command_line_sync(`pgrep -x ${programName}`);

Synchronous process spawning blocks the main loop.
Use GLib.spawn_command_line_async() or Gio.Subprocess instead.

ℹ️ shell_string_spawn

CrosshairCursor@BMarkley/files/CrosshairCursor@BMarkley/applet.js:45

Util.spawnCommandLine(`/usr/bin/env bash -c 'chmod +x ${CROSSHAIR_COMPILE}'`);

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

CrosshairCursor@BMarkley/files/CrosshairCursor@BMarkley/applet.js:46

Util.spawnCommandLine(CROSSHAIR_COMPILE);

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

CrosshairCursor@BMarkley/files/CrosshairCursor@BMarkley/applet.js:48

Util.spawnCommandLine(`/usr/bin/env bash -c 'chmod +x ${CROSSHAIR_SCRIPT}'`);

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

CrosshairCursor@BMarkley/files/CrosshairCursor@BMarkley/applet.js:50

Util.spawnCommandLine(`/usr/bin/env bash -c 'chmod +x ${CROSSHAIR_EXEC}'`);

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

CrosshairCursor@BMarkley/files/CrosshairCursor@BMarkley/applet.js:55

GLib.spawn_command_line_async(CROSSHAIR_SCRIPT);

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

CrosshairCursor@BMarkley/files/CrosshairCursor@BMarkley/applet.js:70

let [ok, stdout, stderr, status] = GLib.spawn_command_line_sync(`pgrep -x ${programName}`);

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

Automated pattern check.

Some major problems here...

• We don't allow compiled code or bundled binaries.
• This is well outside the scope of what an applet should do. If you want something like this, make it an extension and write it in javascript.

Some major problems here...

* We don't allow compiled code or bundled binaries.

* This is well outside the scope of what an applet should do. If you want something like this, make it an extension and write it in javascript.

Easier said than done. I do not know how to "write it in javascript"... if someone else wants to do so they are welcome to. I won't duplicate 3 weeks of work to port it to a different language. It is not something I am capable of doing even if I wanted to. If it doesn't meet the standards to be an applet I'd rather look to publish it in other ways. The program works.

How do I contribute an executable to the Linux Mint project if not as an applet? How do I get this published so people that need it have access to it? I've never pushed a project such as this onto a repository before, so I would appreciate some guidance.

Generally I don't actually care if anyone can find my stuff, but this is an accessibility tool, and as such I would like it to be accessible for people with impairments to install this. I don't think leaving it on my obscure github page is sufficient for an accessibility tool.

If anyone is willing to help me with this, it would be greatly appreciated. I've reached out on the discussion page and no one responded, so I submitted it here. If not here - then where?

Thanks
-Brian Markley PENG RSE