Skip to content

Commit

Permalink
file: Add Shortcut metadata parsing on Windows (#8143)
Browse files Browse the repository at this point in the history
- Add 6 new columns to the file table on Windows,
  to display Shortcut metadata (.lnk files),
  and specifically the shortcut_target_path,
  shortcut_target_type, shortcut_target_location,
  shortcut_start_in, shortcut_run, shortcut_comment
  columns.

- Fix a small bug in the file integration test, where a comma was forgotten,
  and instead of creating and testing querying two files, the concatentation
  of both was tested

- Added logic to the integration test to create shortcuts to the created files,
  and test their content.

- Fix the expandConstraints function so that it can be const,
  since it's not supposed to modify the context.
  • Loading branch information
Smjert committed Nov 28, 2023
1 parent 222991a commit 1028f32
Show file tree
Hide file tree
Showing 9 changed files with 443 additions and 919 deletions.
12 changes: 9 additions & 3 deletions osquery/core/tables.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -561,14 +561,20 @@ Status QueryContext::expandConstraints(
ConstraintOperator op,
std::set<std::string>& output,
std::function<Status(const std::string& constraint,
std::set<std::string>& output)> predicate) {
for (const auto& constraint : constraints[column].getAll(op)) {
std::set<std::string>& output)> predicate) const {
auto constraint_it = constraints.find(column);

if (constraint_it == constraints.end()) {
return Status::success();
}

for (const auto& constraint : constraint_it->second.getAll(op)) {
auto status = predicate(constraint, output);
if (!status) {
return status;
}
}
return Status(0);
return Status::success();
}

Status deserializeQueryContextJSON(const JSON& json_helper,
Expand Down
2 changes: 1 addition & 1 deletion osquery/core/tables.h
Original file line number Diff line number Diff line change
Expand Up @@ -567,7 +567,7 @@ struct QueryContext {
ConstraintOperator op,
std::set<std::string>& output,
std::function<Status(const std::string& constraint,
std::set<std::string>& output)> predicate);
std::set<std::string>& output)> predicate) const;

/// Check if the given column is used by the query
bool isColumnUsed(const std::string& colName) const;
Expand Down

0 comments on commit 1028f32

Please sign in to comment.