From 5860b8c2ed79cd3fdd045fa3cc44c07ddba22bc6 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 28 Sep 2026 05:20:13 +0000 Subject: [PATCH 01/21] fix(adhoc-sweep-fixes): 27 review findings across 21 files --- tests/integration/tables/azure_instance_metadata.cpp | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/tests/integration/tables/azure_instance_metadata.cpp b/tests/integration/tables/azure_instance_metadata.cpp index 016c2a5f527..3e35d56683b 100644 --- a/tests/integration/tables/azure_instance_metadata.cpp +++ b/tests/integration/tables/azure_instance_metadata.cpp @@ -28,7 +28,8 @@ TEST_F(azureInstanceMetadata, test_sanity) { {"architecture", NormalType}, {"offer", NormalType}, {"publisher", NormalType}, - {"sku", NormalType} {"version", NormalType}, + {"sku", NormalType}, + {"version", NormalType}, {"os_type", NormalType}, {"platform_update_domain", NormalType}, {"platform_fault_domain", NormalType}, @@ -42,6 +43,7 @@ TEST_F(azureInstanceMetadata, test_sanity) { }; validate_rows(data, row_map); } +} } // namespace table_tests -} // namespace table_tests +} // namespace osquery From f68b6586a8f3bafe8c65fa41dc0ee1ab3f599dd5 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 28 Sep 2026 05:20:14 +0000 Subject: [PATCH 02/21] fix(adhoc-sweep-fixes): 27 review findings across 21 files --- openframe/openframe_encryption_service.h | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/openframe/openframe_encryption_service.h b/openframe/openframe_encryption_service.h index d37760ab918..2acc7eb05fc 100644 --- a/openframe/openframe_encryption_service.h +++ b/openframe/openframe_encryption_service.h @@ -8,6 +8,10 @@ #include #include +#include "osquery/core/status.h" + +namespace osquery { + class OpenframeEncryptionService { public: explicit OpenframeEncryptionService(const std::string& secret); @@ -16,10 +20,10 @@ class OpenframeEncryptionService { /** * Decrypts data using AES-GCM * @param data Base64 encoded encrypted data - * @return Decrypted data as string - * @throws std::runtime_error if decryption fails + * @param decrypted Output parameter for decrypted data + * @return Status indicating success or failure of decryption */ - std::string decrypt(const std::string& data); + Status decrypt(const std::string& data, std::string& decrypted); std::vector base64Decode(const std::string& encoded); @@ -31,4 +35,6 @@ class OpenframeEncryptionService { void handleOpenSSLError(); std::string secret_; -}; \ No newline at end of file +}; + +} // namespace osquery From 6ceef4a58cbf2d4707fbf01103329ab936c27684 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 28 Sep 2026 05:20:15 +0000 Subject: [PATCH 03/21] fix(adhoc-sweep-fixes): 27 review findings across 21 files --- tools/tests/test_windows_service.py | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/tools/tests/test_windows_service.py b/tools/tests/test_windows_service.py index ae0f6a48ebb..35b5638816b 100644 --- a/tools/tests/test_windows_service.py +++ b/tools/tests/test_windows_service.py @@ -103,11 +103,11 @@ def sc(*args): ['sc.exe'] + list(args), stderr=subprocess.PIPE, stdout=subprocess.PIPE) - except subprocess.CalledProcessError, err: + except subprocess.CalledProcessError as err: return (err.returncode, err.output) out, _ = p.communicate() - out = [x.strip() for x in out.split('\r\n') if x.strip() is not ''] + out = [x.strip() for x in out.split('\r\n') if x.strip() != ''] if len(out) >= 1: if 'SUCCESS' in out[0]: @@ -246,10 +246,10 @@ def setUp(self): self.flagfile = os.path.join(self.tmp_dir, 'osquery.flags') # Write out our mock configuration files - with open(self.config_path, 'wb') as fd: + with open(self.config_path, 'w') as fd: fd.write(CONFIG_FILE) - with open(self.flagfile, 'wb') as fd: + with open(self.flagfile, 'w') as fd: fd.write( FLAGS_FILE.format(self.log_path, self.pidfile, test_http_server.HTTP_SERVER_CA, From 1a273b0d21824d339c14287e131fc6d23695223f Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 28 Sep 2026 05:20:17 +0000 Subject: [PATCH 04/21] fix(adhoc-sweep-fixes): 27 review findings across 21 files --- osquery/remote/transports/tls.cpp | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/osquery/remote/transports/tls.cpp b/osquery/remote/transports/tls.cpp index d56761ecd77..61cb0786b34 100644 --- a/osquery/remote/transports/tls.cpp +++ b/osquery/remote/transports/tls.cpp @@ -98,7 +98,9 @@ void TLSTransport::decorateRequest(http::Request& r) { r << http::Request::Header("Accept", serializer_->getContentType()); r << http::Request::Header("User-Agent", kTLSUserAgentBase + kVersion); - if (FLAGS_openframe_mode) { + if (FLAGS_openframe_mode && + (FLAGS_tls_hostname.empty() || + destination_.find(FLAGS_tls_hostname) != std::string::npos)) { auto& auth_manager = OpenframeAuthorizationManagerProvider::getInstance(); std::string token = auth_manager.getToken(); if (!token.empty()) { @@ -117,11 +119,6 @@ http::Client::Options TLSTransport::getOptions() { options.follow_redirects(true).timeout(16); - if (FLAGS_openframe_mode) { - options.always_verify_peer(false); - return options; - } - options.always_verify_peer(verify_peer_); if (server_certificate_file_.size() > 0) { if (!osquery::isReadable(server_certificate_file_).ok()) { @@ -314,3 +311,4 @@ Status TLSTransport::sendRequest(const std::string& params, bool compress) { return response_status_; } } // namespace osquery + From 7af484e81f297b2d67d85566580a687855e26ec7 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 28 Sep 2026 05:20:18 +0000 Subject: [PATCH 05/21] fix(adhoc-sweep-fixes): 27 review findings across 21 files --- openframe/openframe_authorization_manager.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/openframe/openframe_authorization_manager.h b/openframe/openframe_authorization_manager.h index d61ae28e26e..f729defd4fa 100644 --- a/openframe/openframe_authorization_manager.h +++ b/openframe/openframe_authorization_manager.h @@ -45,4 +45,4 @@ class OpenframeAuthorizationManager : private boost::noncopyable { friend class OpenframeAuthorizationManagerProvider; }; -} // namespace osquery \ No newline at end of file +} // namespace osquery From 68f256f86eccdaad8e6615ed0dc160c6ea0c3ae1 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 28 Sep 2026 05:20:19 +0000 Subject: [PATCH 06/21] fix(adhoc-sweep-fixes): 27 review findings across 21 files --- plugins/logger/filesystem_logger.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/plugins/logger/filesystem_logger.h b/plugins/logger/filesystem_logger.h index b45c501631a..fd399fd5ac3 100644 --- a/plugins/logger/filesystem_logger.h +++ b/plugins/logger/filesystem_logger.h @@ -55,5 +55,5 @@ class FilesystemLoggerPlugin : public LoggerPlugin { std::unique_ptr pimpl_{nullptr}; }; -REGISTER(FilesystemLoggerPlugin, "logger", "filesystem"); -} +} // namespace osquery + From 10f1a5d9d9b0faf45a159884ce7d5d6bdf840ae8 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 28 Sep 2026 05:20:20 +0000 Subject: [PATCH 07/21] fix(adhoc-sweep-fixes): 27 review findings across 21 files --- .../events/tests/windows/etw_process_events_tests.cpp | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/osquery/tables/events/tests/windows/etw_process_events_tests.cpp b/osquery/tables/events/tests/windows/etw_process_events_tests.cpp index d1c08537d41..d704ac410c0 100644 --- a/osquery/tables/events/tests/windows/etw_process_events_tests.cpp +++ b/osquery/tables/events/tests/windows/etw_process_events_tests.cpp @@ -49,8 +49,8 @@ TEST_F(ETWProcessEventsTests, test_subscriber_exists) { ASSERT_TRUE(Registry::get().exists("event_subscriber", ETW_SUBSCRIBER_NAME)); auto plugin = Registry::get().plugin("event_subscriber", ETW_SUBSCRIBER_NAME); - auto* subscriber = - reinterpret_cast*>(&plugin); + auto subscriber = + std::dynamic_pointer_cast(plugin); EXPECT_NE(subscriber, nullptr); } @@ -58,8 +58,8 @@ TEST_F(ETWProcessEventsTests, test_publisher_exists) { ASSERT_TRUE(Registry::get().exists("event_publisher", ETW_PUBLISHER_NAME)); auto plugin = Registry::get().plugin("event_publisher", ETW_PUBLISHER_NAME); - auto* publisher = - reinterpret_cast*>(&plugin); + auto publisher = + std::dynamic_pointer_cast(plugin); EXPECT_NE(publisher, nullptr); } From 163d38f3b74186698baf0ed5c808d4e05192c4f9 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 28 Sep 2026 05:20:21 +0000 Subject: [PATCH 08/21] fix(adhoc-sweep-fixes): 27 review findings across 21 files --- osquery/tables/applications/posix/carbon_black.cpp | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/osquery/tables/applications/posix/carbon_black.cpp b/osquery/tables/applications/posix/carbon_black.cpp index 52586cf8005..02eb015dcfb 100644 --- a/osquery/tables/applications/posix/carbon_black.cpp +++ b/osquery/tables/applications/posix/carbon_black.cpp @@ -42,9 +42,13 @@ void getSensorId(Row& r) { } unsigned int sensor_id; - std::string hex_sensor_id = file_contents.substr(11, 16); + std::string hex_sensor_id = file_contents.substr(8, 8); std::stringstream converter(hex_sensor_id); converter >> std::hex >> sensor_id; + if (converter.fail() || !converter.eof()) { + LOG(ERROR) << "Error parsing sensor id from " << kCbSensorIdFile; + return; + } r["sensor_id"] = INTEGER(sensor_id); } @@ -135,3 +139,4 @@ QueryData genCarbonBlackInfo(QueryContext& context) { } } // namespace tables } // namespace osquery + From 3933580c107cc7efa35fd1af929d0447a66d6885 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 28 Sep 2026 05:20:22 +0000 Subject: [PATCH 09/21] fix(adhoc-sweep-fixes): 27 review findings across 21 files --- osquery/tables/system/system_utils.cpp | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/osquery/tables/system/system_utils.cpp b/osquery/tables/system/system_utils.cpp index 4f934caeb59..30b73b9d5c4 100644 --- a/osquery/tables/system/system_utils.cpp +++ b/osquery/tables/system/system_utils.cpp @@ -37,7 +37,7 @@ QueryData pidsFromContext(const QueryContext& context, bool all) { context.iteritems("pid", EQUALS, ([&procs](const std::string& expr) { auto proc = SQL::selectAllFrom( "processes", "pid", EQUALS, expr); - procs.insert(procs.end(), procs.begin(), procs.end()); + procs.insert(procs.end(), proc.begin(), proc.end()); })); } else if (!all) { procs = SQL::selectAllFrom( @@ -49,3 +49,4 @@ QueryData pidsFromContext(const QueryContext& context, bool all) { } } } + From d8a302d198f80d2c0de752594596e6fd1e9f075c Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 28 Sep 2026 05:20:24 +0000 Subject: [PATCH 10/21] fix(adhoc-sweep-fixes): 27 review findings across 21 files --- osquery/tables/system/darwin/sharing_preferences.cpp | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/osquery/tables/system/darwin/sharing_preferences.cpp b/osquery/tables/system/darwin/sharing_preferences.cpp index 5bc3ebd6422..41fe5417e84 100644 --- a/osquery/tables/system/darwin/sharing_preferences.cpp +++ b/osquery/tables/system/darwin/sharing_preferences.cpp @@ -172,7 +172,7 @@ int getBluetoothSharingStatus() { continue; } for (const auto& r : bluetoothSharingStatus) { - if (r.find("key") == row.end() || row.find("value") == r.end()) { + if (r.find("key") == r.end() || r.find("value") == r.end()) { continue; } if (r.at("key") == "PrefKeyServicesEnabled" && @@ -220,3 +220,4 @@ QueryData genSharingPreferences(QueryContext& context) { } // namespace tables } // namespace osquery + From ea384fc3e0f1d603ea9a4c29cc837a40e510831b Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 28 Sep 2026 05:20:25 +0000 Subject: [PATCH 11/21] fix(adhoc-sweep-fixes): 27 review findings across 21 files --- osquery/database/ephemeral.cpp | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/osquery/database/ephemeral.cpp b/osquery/database/ephemeral.cpp index 2edeb3b5d17..ca2e6c1c949 100644 --- a/osquery/database/ephemeral.cpp +++ b/osquery/database/ephemeral.cpp @@ -165,15 +165,20 @@ Status EphemeralDatabasePlugin::removeRange(const std::string& domain, return Status::failure("Invalid range: low > high"); } + auto domainIterator = db_.find(domain); + if (domainIterator == db_.end()) { + return Status(0); + } + std::vector keys; - for (const auto& it : db_[domain]) { + for (const auto& it : domainIterator->second) { if (it.first >= low && it.first <= high) { keys.push_back(it.first); } } for (const auto& key : keys) { - db_[domain].erase(key); + domainIterator->second.erase(key); } return Status(0); } From b77efd9194db5736fc7d54c8d46214d4dac2d522 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 28 Sep 2026 05:20:26 +0000 Subject: [PATCH 12/21] fix(adhoc-sweep-fixes): 27 review findings across 21 files --- osquery/events/windows/windowseventlogpublisher.cpp | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/osquery/events/windows/windowseventlogpublisher.cpp b/osquery/events/windows/windowseventlogpublisher.cpp index b76b479446c..d774f7d200a 100644 --- a/osquery/events/windows/windowseventlogpublisher.cpp +++ b/osquery/events/windows/windowseventlogpublisher.cpp @@ -208,6 +208,10 @@ double WindowsEventLogPublisher::cosineSimilarity( std::vector buffer_freqs(kCharFreqVectorLen, 0.0); auto buffer_size = buffer.size(); + if (buffer_size == 0) { + return 0.0; + } + for (unsigned char chr : buffer) { if (chr < kCharFreqVectorLen) { buffer_freqs[chr] += 1.0 / buffer_size; From 77eb33caebb19a5c546cdbd346a8f4f6e24c9b29 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 28 Sep 2026 05:20:28 +0000 Subject: [PATCH 13/21] fix(adhoc-sweep-fixes): 27 review findings across 21 files --- osquery/extensions/extensions.cpp | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/osquery/extensions/extensions.cpp b/osquery/extensions/extensions.cpp index 3376101e899..b259974fe0f 100644 --- a/osquery/extensions/extensions.cpp +++ b/osquery/extensions/extensions.cpp @@ -184,7 +184,9 @@ Status extensionPathActive(const std::string& path, bool use_timeout = false) { // Create a client with a 10-second receive timeout. ExtensionManagerClient client(path, 10); auto status = client.ping(); - return Status::success(); + if (status.ok()) { + return Status::success(); + } } catch (const std::exception& /* e */) { // Path might exist without a connected extension or extension manager. } From 4e0ffcc903dc9cee5f9b9c708978e7919bb91302 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 28 Sep 2026 05:20:29 +0000 Subject: [PATCH 14/21] fix(adhoc-sweep-fixes): 27 review findings across 21 files --- osquery/tables/system/darwin/iokit_registry.cpp | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/osquery/tables/system/darwin/iokit_registry.cpp b/osquery/tables/system/darwin/iokit_registry.cpp index d50ec121c79..aecf676e779 100644 --- a/osquery/tables/system/darwin/iokit_registry.cpp +++ b/osquery/tables/system/darwin/iokit_registry.cpp @@ -56,9 +56,13 @@ void genIOKitFirmware(const io_service_t& device, r["device"] = std::string(name); } - CFMutableDictionaryRef details; - IORegistryEntryCreateCFProperties( + CFMutableDictionaryRef details = nullptr; + kr = IORegistryEntryCreateCFProperties( device, &details, kCFAllocatorDefault, kNilOptions); + if (kr != KERN_SUCCESS || details == nullptr) { + return; + } + CFDictionaryApplyFunction(details, &genFirmware, &r); if (r.count("version") != 0) { // If the version is filled in from the dictionary walk callback then From 7035c45f2186e1801c74b4592a6a6f8cda97eabe Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 28 Sep 2026 05:20:30 +0000 Subject: [PATCH 15/21] fix(adhoc-sweep-fixes): 27 review findings across 21 files --- osquery/tables/system/windows/registry.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/osquery/tables/system/windows/registry.cpp b/osquery/tables/system/windows/registry.cpp index 28dbbf31e34..f69241ebe58 100644 --- a/osquery/tables/system/windows/registry.cpp +++ b/osquery/tables/system/windows/registry.cpp @@ -471,7 +471,7 @@ static inline Status populateAllKeysRecursive( } auto size_pre = rKeys.size(); - auto ret = populateSubkeys(rKeys); + auto ret = populateSubkeys(rKeys, false); if (!ret.ok()) { return ret; } From c3d6d3a0a43810870f51c8f77a03af2e4fb97b15 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 28 Sep 2026 05:20:31 +0000 Subject: [PATCH 16/21] fix(adhoc-sweep-fixes): 27 review findings across 21 files --- osquery/tables/system/windows/wmi_bios_info.cpp | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/osquery/tables/system/windows/wmi_bios_info.cpp b/osquery/tables/system/windows/wmi_bios_info.cpp index 36be4f34d22..807016194c4 100644 --- a/osquery/tables/system/windows/wmi_bios_info.cpp +++ b/osquery/tables/system/windows/wmi_bios_info.cpp @@ -65,9 +65,10 @@ std::string getManufacturer(std::string manufacturer) { // If it's a Dell machine, we check if the legacy class exists or not and // accordingly return the corresponding manufacturer name. auto it = kVendorSpecificQueryMap.find("dell-legacy"); - const auto wmiBiosReq = WmiRequest::CreateWmiRequest( + auto exp_wmi_bios_req = WmiRequest::CreateWmiRequest( std::get<0>(it->second), std::get<1>(it->second)); - if (wmiBiosReq && !wmiBiosReq->results().empty()) { + if (!exp_wmi_bios_req.isError() && + !exp_wmi_bios_req.get().results().empty()) { manufacturer = "dell-legacy"; } else { manufacturer = "dell"; @@ -466,3 +467,4 @@ QueryData genBiosInfo(QueryContext& context) { } } // namespace tables } // namespace osquery + From 5b11498b96fef8d09467449b9c4898d1b5b66561 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 28 Sep 2026 05:20:32 +0000 Subject: [PATCH 17/21] fix(adhoc-sweep-fixes): 27 review findings across 21 files --- osquery/filesystem/file_compression.cpp | 22 ++++++++++++++++++++-- 1 file changed, 20 insertions(+), 2 deletions(-) diff --git a/osquery/filesystem/file_compression.cpp b/osquery/filesystem/file_compression.cpp index 08a1f28976e..ced5069bc0c 100644 --- a/osquery/filesystem/file_compression.cpp +++ b/osquery/filesystem/file_compression.cpp @@ -182,7 +182,15 @@ Status archive(const std::set& paths, archive_entry_set_size(entry, pFile.size()); archive_entry_set_filetype(entry, AE_IFREG); archive_entry_set_perm(entry, 0644); - archive_write_header(arch, entry); + auto headerRet = archive_write_header(arch, entry); + if (headerRet == ARCHIVE_FATAL || headerRet == ARCHIVE_WARN) { + std::string errMsg = "Failed to write tar header for file: " + + f.string() + " (" + + std::string(archive_error_string(arch)) + ")"; + archive_entry_free(entry); + archive_write_free(arch); + return Status(1, errMsg); + } auto blkCount = static_cast(ceil(static_cast(pFile.size()) / static_cast(block_size))); @@ -193,7 +201,16 @@ Status archive(const std::set& paths, // resize the buffer to size we read as last block is likely smaller block.resize(static_cast(r)); } - archive_write_data(arch, block.data(), block.size()); + auto writeRet = archive_write_data(arch, block.data(), block.size()); + if (writeRet < 0 || + static_cast(writeRet) != block.size()) { + std::string errMsg = "Failed to write tar data for file: " + + f.string() + " (" + + std::string(archive_error_string(arch)) + ")"; + archive_entry_free(entry); + archive_write_free(arch); + return Status(1, errMsg); + } } archive_entry_free(entry); } @@ -201,3 +218,4 @@ Status archive(const std::set& paths, return Status::success(); }; } // namespace osquery + From dfb73e232b3d8f65ae58ac458fd9816fa6a9f075 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 28 Sep 2026 05:20:33 +0000 Subject: [PATCH 18/21] fix(adhoc-sweep-fixes): 27 review findings across 21 files --- .../events/windows/etw/etw_publisher_dns.h | 249 +++++++++--------- 1 file changed, 125 insertions(+), 124 deletions(-) diff --git a/osquery/events/windows/etw/etw_publisher_dns.h b/osquery/events/windows/etw/etw_publisher_dns.h index 5a3ed88947f..382509e554c 100644 --- a/osquery/events/windows/etw/etw_publisher_dns.h +++ b/osquery/events/windows/etw/etw_publisher_dns.h @@ -1,124 +1,125 @@ -/** - * Copyright (c) 2014-present, The osquery authors - * - * This source code is licensed as defined by the LICENSE file found in the - * root directory of this source tree. - * - * SPDX-License-Identifier: (Apache-2.0 OR GPL-2.0-only) - */ - -#pragma once - -#include - -namespace osquery { - -/** - * @brief Subscription details for EtwPublisherDNS events. - */ -struct EtwDNSEventSubContext : public SubscriptionContext { - private: - friend class EtwPublisherDNS; -}; - -/** - * @brief Event details for EtwPublisherDNS events. - */ -struct EtwDNSEventContext : public EventContext { - EtwEventDataRef data; -}; - -using EtwDNSEventContextRef = std::shared_ptr; -using EtwDNSEventSubContextRef = std::shared_ptr; - -/** - * @brief Publisher Name - */ -const std::string kEtwDNSPublisherName = "etw_dns_publisher"; - -/** - * @brief Implements an EtwPublisher that collects and - * dispatches ETW events with process-start and process-stop OS information. - */ -class EtwPublisherDNS - : public EtwPublisherBase, - public EventPublisher { - /** - * @brief Publisher constants - */ - static const USHORT etwDefaultKernelID = 0; - static const USHORT etwDNSStartID = 1; - static const USHORT etwDNSStopID = 2; - - /** - * @brief Supported User Start DNS Events versions - */ - const enum class etwUserDNSStartVersion { - Version0 = 0, - Version1, - Version2, - Version3 - }; - - /** - * @brief Supported User Stop DNS Events versions - */ - enum class etwUserDNSStopVersion { Version0 = 0, Version1, Version2 }; - - /** - * @brief Supported Kernel DNS Events versions - */ - enum class etwKernelDNSVersion { Version3 = 3, Version4 }; - - /** - * @brief Publisher type declaration - */ - DECLARE_PUBLISHER(kEtwDNSPublisherName); - - public: - EtwPublisherDNS(); - - /** - * @brief Used to configure the ETW providers to listen, along with - * its configuration parameters and processing callbacks. - * - * @return Status of the provider setup process. - */ - Status setUp() override; - - private: - /** - * @brief Provides the c-function callback in charge of performing the pre - * processing logic. This is the entry point for the event arriving from the - * ETW OS interface. This callback gets called from the OS for every new ETW - * event. There should be lightweight logic here, with no significant - * performance implications. - * - * @param rawEvent is the RAW ETW event obtained from OS ETW provider. It - * comprises an EVENT_HEADER common to all ETW providers and a UserData field - * with provider-specific content. - * https://learn.microsoft.com/en-us/windows/win32/api/evntcons/ns-evntcons-event_record - * - * @param traceCtx This is a helper class that it is used to parse the ETW - * event manifest when needed. - */ - static void providerPreProcessor(const EVENT_RECORD& rawEvent, - const krabs::trace_context& traceCtx); - - /** - * @brief Provides the std::function callback in charge of performing the - * post processing logic. This logic is used to enrich, aggregate and modify - * the event data before dispatching it to the event subscribers. - */ - void providerPostProcessor(const EtwEventDataRef& data) override; - - private: - using HardVolumeDriveCollection = - std::unordered_map; - using UsernameBySIDCollection = std::unordered_map; - - HardVolumeDriveCollection hardVolumeDrives_; - UsernameBySIDCollection usernamesBySIDs_; -}; - -} // namespace osquery +/** + * Copyright (c) 2014-present, The osquery authors + * + * This source code is licensed as defined by the LICENSE file found in the + * root directory of this source tree. + * + * SPDX-License-Identifier: (Apache-2.0 OR GPL-2.0-only) + */ + +#pragma once + +#include + +namespace osquery { + +/** + * @brief Subscription details for EtwPublisherDNS events. + */ +struct EtwDNSEventSubContext : public SubscriptionContext { + private: + friend class EtwPublisherDNS; +}; + +/** + * @brief Event details for EtwPublisherDNS events. + */ +struct EtwDNSEventContext : public EventContext { + EtwEventDataRef data; +}; + +using EtwDNSEventContextRef = std::shared_ptr; +using EtwDNSEventSubContextRef = std::shared_ptr; + +/** + * @brief Publisher Name + */ +const std::string kEtwDNSPublisherName = "etw_dns_publisher"; + +/** + * @brief Implements an EtwPublisher that collects and + * dispatches ETW events with process-start and process-stop OS information. + */ +class EtwPublisherDNS + : public EtwPublisherBase, + public EventPublisher { + /** + * @brief Publisher constants + */ + static const USHORT kEtwDefaultKernelId = 0; + static const USHORT kEtwDnsStartId = 1; + static const USHORT kEtwDnsStopId = 2; + + /** + * @brief Supported User Start DNS Events versions + */ + const enum class etwUserDNSStartVersion { + Version0 = 0, + Version1, + Version2, + Version3 + }; + + /** + * @brief Supported User Stop DNS Events versions + */ + enum class etwUserDNSStopVersion { Version0 = 0, Version1, Version2 }; + + /** + * @brief Supported Kernel DNS Events versions + */ + enum class etwKernelDNSVersion { Version3 = 3, Version4 }; + + /** + * @brief Publisher type declaration + */ + DECLARE_PUBLISHER(kEtwDNSPublisherName); + + public: + EtwPublisherDNS(); + + /** + * @brief Used to configure the ETW providers to listen, along with + * its configuration parameters and processing callbacks. + * + * @return Status of the provider setup process. + */ + Status setUp() override; + + private: + /** + * @brief Provides the c-function callback in charge of performing the pre + * processing logic. This is the entry point for the event arriving from the + * ETW OS interface. This callback gets called from the OS for every new ETW + * event. There should be lightweight logic here, with no significant + * performance implications. + * + * @param rawEvent is the RAW ETW event obtained from OS ETW provider. It + * comprises an EVENT_HEADER common to all ETW providers and a UserData field + * with provider-specific content. + * https://learn.microsoft.com/en-us/windows/win32/api/evntcons/ns-evntcons-event_record + * + * @param traceCtx This is a helper class that it is used to parse the ETW + * event manifest when needed. + */ + static void providerPreProcessor(const EVENT_RECORD& rawEvent, + const krabs::trace_context& traceCtx); + + /** + * @brief Provides the std::function callback in charge of performing the + * post processing logic. This logic is used to enrich, aggregate and modify + * the event data before dispatching it to the event subscribers. + */ + void providerPostProcessor(const EtwEventDataRef& data) override; + + private: + using HardVolumeDriveCollection = + std::unordered_map; + using UsernameBySIDCollection = std::unordered_map; + + HardVolumeDriveCollection hardVolumeDrives_; + UsernameBySIDCollection usernamesBySIDs_; +}; + +} // namespace osquery + From 80e95d08ffd1f8e132893ab7fd43db5103203ed6 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 28 Sep 2026 05:20:35 +0000 Subject: [PATCH 19/21] fix(adhoc-sweep-fixes): 27 review findings across 21 files --- osquery/tables/system/windows/windows_update_history.cpp | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/osquery/tables/system/windows/windows_update_history.cpp b/osquery/tables/system/windows/windows_update_history.cpp index 770c4b3a1e6..84fdfa93cf5 100644 --- a/osquery/tables/system/windows/windows_update_history.cpp +++ b/osquery/tables/system/windows/windows_update_history.cpp @@ -297,7 +297,7 @@ Expected getAt( std::unique_ptr> entry(pEntry, InterfaceReleaser()); - return populateWindowsUpdateHistoryEntry(pEntry); + return populateWindowsUpdateHistoryEntry(entry.get()); } Expected @@ -379,3 +379,4 @@ QueryData genWindowsUpdateHistory(QueryContext& context) { } // namespace tables } // namespace osquery + From 664853d91bb75991221a19a17f82d2d2ce64dbca Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 28 Sep 2026 05:20:36 +0000 Subject: [PATCH 20/21] fix(adhoc-sweep-fixes): 27 review findings across 21 files --- plugins/logger/filesystem_logger.cpp | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/plugins/logger/filesystem_logger.cpp b/plugins/logger/filesystem_logger.cpp index f6004f0b6f7..052fc364c27 100644 --- a/plugins/logger/filesystem_logger.cpp +++ b/plugins/logger/filesystem_logger.cpp @@ -86,6 +86,11 @@ DEFINE_validator(logger_mode, &validateLoggerMode); const std::string kFilesystemLoggerFilename = "osqueryd.results.log"; const std::string kFilesystemLoggerSnapshots = "osqueryd.snapshots.log"; +/// Safe fallback mode used if the logger_mode flag somehow fails to convert +/// at runtime, even though validateLoggerMode() should have already rejected +/// any invalid value. +const std::int32_t kDefaultLoggerModeOctal = 0640; + bool LogRotate::shouldRotate() { return this->fileSize(path_) >= this->getRotateSize(); } @@ -178,12 +183,17 @@ struct FilesystemLoggerPlugin::impl { tryTo(FLAGS_logger_mode, 8); /* This is here as safety, but the logger_mode flag should be already - validated, so no exception should be really thrown here */ + validated, so no exception should be really thrown here. If this is + somehow reached (e.g. the validator was bypassed), log the error and + fall back to a safe default mode instead of throwing from the + constructor, since plugin setup code does not expect exceptions. */ if (logger_mode_octal_exp.isError()) { - throw std::runtime_error("Failed to convert logger_mode string to octal"); + LOG(ERROR) << kLoggerModeConversionFailureError + << "; falling back to default logger_mode"; + logger_mode_octal = kDefaultLoggerModeOctal; + } else { + logger_mode_octal = logger_mode_octal_exp.get(); } - - logger_mode_octal = logger_mode_octal_exp.get(); } /// The folder where Glog and the result/snapshot files are written. From 985959d3292280c20a6188709fe32b24250450a5 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 28 Sep 2026 05:20:37 +0000 Subject: [PATCH 21/21] fix(adhoc-sweep-fixes): 27 review findings across 21 files --- osquery/tables/system/windows/scheduled_tasks.cpp | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/osquery/tables/system/windows/scheduled_tasks.cpp b/osquery/tables/system/windows/scheduled_tasks.cpp index d17719ceacf..71b00c5eda6 100644 --- a/osquery/tables/system/windows/scheduled_tasks.cpp +++ b/osquery/tables/system/windows/scheduled_tasks.cpp @@ -76,8 +76,13 @@ void enumerateTasksForFolder(std::string path, QueryData& results) { } long numTasks = 0; - pTaskCollection->get_Count(&numTasks); - for (size_t i = 0; i < numTasks; i++) { + ret = pTaskCollection->get_Count(&numTasks); + if (FAILED(ret) || numTasks < 0) { + VLOG(1) << "Failed to get task count for root folder " << ret; + pTaskCollection->Release(); + return; + } + for (long i = 0; i < numTasks; i++) { IRegisteredTask* pRegisteredTask = nullptr; // Collections are 1-based lists ret = pTaskCollection->get_Item(_variant_t(i + 1), &pRegisteredTask); @@ -231,3 +236,4 @@ QueryData genScheduledTasks(QueryContext& context) { } } // namespace tables } // namespace osquery +