remove backslash from 'header' column when short line

osquery · Jan 8, 2022 · e2cdc6a · e2cdc6a
1 parent 2fb0ab1
commit e2cdc6a
Showing 1 changed file with 9 additions and 3 deletions.
diff --git a/osquery/tables/system/posix/sudoers.cpp b/osquery/tables/system/posix/sudoers.cpp
@@ -63,11 +63,17 @@ void genSudoersFile(const std::string& filename,
     }
 
     // if last line contains a backslash as the last character,
-    // treat current line as part of long line.
+    // treat current line as part of previous line and
+    // append it to appropriate column.
     if (isLongLine) {
       isLongLine = (line.at(line.size() - 1) == '\\');
-      results.back()["rule_details"].pop_back();
-      results.back()["rule_details"].append(line);
+      if (results.back()["rule_details"].empty()) {
+        results.back()["header"].pop_back();
+        results.back()["rule_details"].append(line);
+      } else {
+        results.back()["rule_details"].pop_back();
+        results.back()["rule_details"].append(line);
+      }
       continue;
     }