spotify-widget@suleman: Spotify desktop widget with ad blocking

[suleman-dawood]

New Desklet: spotify-widget@suleman

A minimal Spotify desktop widget for Cinnamon with playback controls and ad blocking support.

Features

• Album art, track title, artist display
• Play/pause, next, previous, seekable progress bar
• Volume slider, open/kill Spotify controls
• Auto-relaunches Spotify if window is closed
• Ad blocking via spotify-adblock (LD_PRELOAD)
• Configurable colors, font scale, widget width
• Works with both Flatpak and native Spotify

MPRIS Integration

All controls use the standard MPRIS2 D-Bus interface (org.mpris.MediaPlayer2.spotify). No API keys or external services required.

[github-actions]

Best-practices scanner

This is a regex-based check for API usage that can pose security, performance or
maintainability issues, or that may already be provided by Cinnamon. Most findings
are advisory and do not automatically disqualify a pull request.

This check is not perfect and will not replace a normal review.

---

Found 12 potential issue(s):

⚠️ WARNING

⚠️ sync_file_query_exists

spotify-widget@suleman/files/spotify-widget@suleman/desklet.js:563

if (file.query_exists(null)) {

query_exists() is a synchronous call that can block on slow/network filesystems.
Prefer attempting the operation and handling a Gio.IOErrorEnum.NOT_FOUND error instead.

spotify-widget@suleman/files/spotify-widget@suleman/desklet.js:925

if (file.query_exists(null)) {

query_exists() is a synchronous call that can block on slow/network filesystems.
Prefer attempting the operation and handling a Gio.IOErrorEnum.NOT_FOUND error instead.

⚠️ hardcoded_xdg_user_dir

spotify-widget@suleman/files/spotify-widget@suleman/desklet.js:918

GLib.get_home_dir() + "/Documents/Projects/Desktop_Projects/SpotifyWidget/launcher/spotify-launcher.sh",

Do not construct paths to standard user directories using get_home_dir() with
a hardcoded folder name — these directories can have different names depending on
the user's language. Use GLib.get_user_special_dir() instead:

• GLib.get_user_special_dir(GLib.UserDirectory.DIRECTORY_DESKTOP)
• GLib.get_user_special_dir(GLib.UserDirectory.DIRECTORY_DOCUMENTS)
• GLib.get_user_special_dir(GLib.UserDirectory.DIRECTORY_DOWNLOAD)
• GLib.get_user_special_dir(GLib.UserDirectory.DIRECTORY_MUSIC)
• GLib.get_user_special_dir(GLib.UserDirectory.DIRECTORY_PICTURES)
• GLib.get_user_special_dir(GLib.UserDirectory.DIRECTORY_VIDEOS)
• GLib.get_user_special_dir(GLib.UserDirectory.DIRECTORY_TEMPLATES)
• GLib.get_user_special_dir(GLib.UserDirectory.DIRECTORY_PUBLIC_SHARE)

⚠️ hardcoded_data_dir

spotify-widget@suleman/files/spotify-widget@suleman/desklet.js:919

GLib.get_home_dir() + "/.local/share/spotify-widget/spotify-launcher.sh",

Avoid hardcoding .local/share in paths. Use GLib.get_user_data_dir() instead,
which respects the XDG_DATA_HOME environment variable.

ℹ️ INFO

ℹ️ shell_string_spawn

spotify-widget@suleman/files/spotify-widget@suleman/desklet.js:728

Util.spawnCommandLine(

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

spotify-widget@suleman/files/spotify-widget@suleman/desklet.js:762

Util.spawnCommandLine(

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

spotify-widget@suleman/files/spotify-widget@suleman/desklet.js:863

Util.spawnCommandLine(launcherPath + " show");

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

spotify-widget@suleman/files/spotify-widget@suleman/desklet.js:865

Util.spawnCommandLine(

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

spotify-widget@suleman/files/spotify-widget@suleman/desklet.js:876

Util.spawnCommandLine("bash -c 'flatpak kill com.spotify.Client 2>/dev/null; pkill -x spotify 2>/dev/null'");

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

spotify-widget@suleman/files/spotify-widget@suleman/desklet.js:886

Util.spawnCommandLine(

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

spotify-widget@suleman/files/spotify-widget@suleman/desklet.js:896

Util.spawnCommandLine(launcherPath + " launch");

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

spotify-widget@suleman/files/spotify-widget@suleman/desklet.js:899

Util.spawnCommandLine("bash -c 'flatpak run com.spotify.Client 2>/dev/null || spotify'");

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

---

Automated pattern check.

[github-actions]

Best-practices scanner

This is a regex-based check for API usage that can pose security, performance or
maintainability issues, or that may already be provided by Cinnamon. Most findings
are advisory and do not automatically disqualify a pull request.

This check is not perfect and will not replace a normal review.

---

Found 5 potential issue(s):

⚠️ WARNING

⚠️ sync_file_query_info

spotify-widget@suleman/files/spotify-widget@suleman/desklet.js:924

file.query_info("standard::type", Gio.FileQueryInfoFlags.NONE, null);

Synchronous query_info() blocks the main loop.
Use query_info_async() instead.

ℹ️ INFO

ℹ️ shell_string_spawn

spotify-widget@suleman/files/spotify-widget@suleman/desklet.js:865

Util.spawnCommandLine(

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

spotify-widget@suleman/files/spotify-widget@suleman/desklet.js:876

Util.spawnCommandLine("bash -c 'flatpak kill com.spotify.Client 2>/dev/null; pkill -x spotify 2>/dev/null'");

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

spotify-widget@suleman/files/spotify-widget@suleman/desklet.js:886

Util.spawnCommandLine(

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

spotify-widget@suleman/files/spotify-widget@suleman/desklet.js:899

Util.spawnCommandLine("bash -c 'flatpak run com.spotify.Client 2>/dev/null || spotify'");

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

---

Automated pattern check.

[github-actions]

Best-practices scanner

This is a regex-based check for API usage that can pose security, performance or
maintainability issues, or that may already be provided by Cinnamon. Most findings
are advisory and do not automatically disqualify a pull request.

This check is not perfect and will not replace a normal review.

---

Found 4 potential issue(s):

⚠️ WARNING

⚠️ sync_file_query_info

spotify-widget@suleman/files/spotify-widget@suleman/desklet.js:914

file.query_info("standard::type", Gio.FileQueryInfoFlags.NONE, null);

Synchronous query_info() blocks the main loop.
Use query_info_async() instead.

ℹ️ INFO

ℹ️ shell_string_spawn

spotify-widget@suleman/files/spotify-widget@suleman/desklet.js:860

Util.spawnCommandLine(

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

spotify-widget@suleman/files/spotify-widget@suleman/desklet.js:874

Util.spawnCommandLine("bash -c 'flatpak kill com.spotify.Client 2>/dev/null; pkill -x spotify 2>/dev/null; rm -f /tmp/.spotify-widget-wids'");

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

spotify-widget@suleman/files/spotify-widget@suleman/desklet.js:889

Util.spawnCommandLine("bash -c 'flatpak run com.spotify.Client 2>/dev/null || spotify'");

Prefer argument vector spawn functions over shell command strings.
This is especially important when arguments include untrusted input (user data,
filenames, settings values, etc.) as shell strings are vulnerable to injection.
Static command strings are generally fine, but argv is always safer.
Use Util.spawn(["cmd", "arg1", "arg2"]) or Util.trySpawn() instead.

---

Automated pattern check.