fix(adhoc-sweep-fixes): CU-86akhf8u2 27 review findings across 21 files

openframe/openframe_authorization_manager.h

@@ -45,4 +45,4 @@ class OpenframeAuthorizationManager : private boost::noncopyable {
   friend class OpenframeAuthorizationManagerProvider;
 };
 
-} // namespace osquery 
+} // namespace osquery 

openframe/openframe_encryption_service.h

@@ -8,6 +8,10 @@
 #include <openssl/err.h>
 #include <stdexcept>
 
+#include "osquery/core/status.h"
+
+namespace osquery {
+
 class OpenframeEncryptionService {
 public:
     explicit OpenframeEncryptionService(const std::string& secret);
@@ -16,10 +20,10 @@ class OpenframeEncryptionService {
     /**
      * Decrypts data using AES-GCM
      * @param data Base64 encoded encrypted data
-     * @return Decrypted data as string
-     * @throws std::runtime_error if decryption fails
+     * @param decrypted Output parameter for decrypted data
+     * @return Status indicating success or failure of decryption
      */
-    std::string decrypt(const std::string& data);
+    Status decrypt(const std::string& data, std::string& decrypted);
 
     std::vector<unsigned char> base64Decode(const std::string& encoded);
 
@@ -31,4 +35,6 @@ class OpenframeEncryptionService {
     void handleOpenSSLError();
 
     std::string secret_;
-}; 
+};
+
+} // namespace osquery

osquery/database/ephemeral.cpp

@@ -165,15 +165,20 @@ Status EphemeralDatabasePlugin::removeRange(const std::string& domain,
     return Status::failure("Invalid range: low > high");
   }
 
+  auto domainIterator = db_.find(domain);
+  if (domainIterator == db_.end()) {
+    return Status(0);
+  }
+
   std::vector<std::string> keys;
-  for (const auto& it : db_[domain]) {
+  for (const auto& it : domainIterator->second) {
     if (it.first >= low && it.first <= high) {
       keys.push_back(it.first);
     }
   }
 
   for (const auto& key : keys) {
-    db_[domain].erase(key);
+    domainIterator->second.erase(key);
   }
   return Status(0);
 }

osquery/events/windows/etw/etw_publisher_dns.h

@@ -1,124 +1,125 @@
-/**
- * Copyright (c) 2014-present, The osquery authors
- *
- * This source code is licensed as defined by the LICENSE file found in the
- * root directory of this source tree.
- *
- * SPDX-License-Identifier: (Apache-2.0 OR GPL-2.0-only)
- */
-
-#pragma once
-
-#include <osquery/events/windows/etw/etw_publisher.h>
-
-namespace osquery {
-
-/**
- * @brief Subscription details for EtwPublisherDNS events.
- */
-struct EtwDNSEventSubContext : public SubscriptionContext {
- private:
-  friend class EtwPublisherDNS;
-};
-
-/**
- * @brief Event details for EtwPublisherDNS events.
- */
-struct EtwDNSEventContext : public EventContext {
-  EtwEventDataRef data;
-};
-
-using EtwDNSEventContextRef = std::shared_ptr<EtwDNSEventContext>;
-using EtwDNSEventSubContextRef = std::shared_ptr<EtwDNSEventSubContext>;
-
-/**
- * @brief Publisher Name
- */
-const std::string kEtwDNSPublisherName = "etw_dns_publisher";
-
-/**
- * @brief Implements an EtwPublisher that collects and
- * dispatches ETW events with process-start and process-stop OS information.
- */
-class EtwPublisherDNS
-    : public EtwPublisherBase,
-      public EventPublisher<EtwDNSEventSubContext, EtwDNSEventContext> {
-  /**
-   * @brief Publisher constants
-   */
-  static const USHORT etwDefaultKernelID = 0;
-  static const USHORT etwDNSStartID = 1;
-  static const USHORT etwDNSStopID = 2;
-
-  /**
-   * @brief Supported User Start DNS Events versions
-   */
-  const enum class etwUserDNSStartVersion {
-    Version0 = 0,
-    Version1,
-    Version2,
-    Version3
-  };
-
-  /**
-   * @brief Supported User Stop DNS Events versions
-   */
-  enum class etwUserDNSStopVersion { Version0 = 0, Version1, Version2 };
-
-  /**
-   * @brief Supported Kernel DNS Events versions
-   */
-  enum class etwKernelDNSVersion { Version3 = 3, Version4 };
-
-  /**
-   * @brief Publisher type declaration
-   */
-  DECLARE_PUBLISHER(kEtwDNSPublisherName);
-
- public:
-  EtwPublisherDNS();
-
-  /**
-   * @brief Used to configure the ETW providers to listen, along with
-   * its configuration parameters and processing callbacks.
-   *
-   * @return Status of the provider setup process.
-   */
-  Status setUp() override;
-
- private:
-  /**
-   * @brief Provides the c-function callback in charge of performing the pre
-   * processing logic. This is the entry point for the event arriving from the
-   * ETW OS interface. This callback gets called from the OS for every new ETW
-   * event. There should be lightweight logic here, with no significant
-   * performance implications.
-   *
-   * @param rawEvent is the RAW ETW event obtained from OS ETW provider. It
-   * comprises an EVENT_HEADER common to all ETW providers and a UserData field
-   * with provider-specific content.
-   * https://learn.microsoft.com/en-us/windows/win32/api/evntcons/ns-evntcons-event_record
-   *
-   * @param traceCtx This is a helper class that it is used to parse the ETW
-   * event manifest when needed.
-   */
-  static void providerPreProcessor(const EVENT_RECORD& rawEvent,
-                                   const krabs::trace_context& traceCtx);
-
-  /**
-   * @brief Provides the std::function callback in charge of performing the
-   * post processing logic. This logic is used to enrich, aggregate and modify
-   * the event data before dispatching it to the event subscribers.
-   */
-  void providerPostProcessor(const EtwEventDataRef& data) override;
-
- private:
-  using HardVolumeDriveCollection =
-      std::unordered_map<std::string, std::string>;
-  using UsernameBySIDCollection = std::unordered_map<std::string, std::string>;
-
-  HardVolumeDriveCollection hardVolumeDrives_;
-  UsernameBySIDCollection usernamesBySIDs_;
-};
-
-} // namespace osquery
+/**
+ * Copyright (c) 2014-present, The osquery authors
+ *
+ * This source code is licensed as defined by the LICENSE file found in the
+ * root directory of this source tree.
+ *
+ * SPDX-License-Identifier: (Apache-2.0 OR GPL-2.0-only)
+ */
+
+#pragma once
+
+#include <osquery/events/windows/etw/etw_publisher.h>
+
+namespace osquery {
+
+/**
+ * @brief Subscription details for EtwPublisherDNS events.
+ */
+struct EtwDNSEventSubContext : public SubscriptionContext {
+ private:
+  friend class EtwPublisherDNS;
+};
+
+/**
+ * @brief Event details for EtwPublisherDNS events.
+ */
+struct EtwDNSEventContext : public EventContext {
+  EtwEventDataRef data;
+};
+
+using EtwDNSEventContextRef = std::shared_ptr<EtwDNSEventContext>;
+using EtwDNSEventSubContextRef = std::shared_ptr<EtwDNSEventSubContext>;
+
+/**
+ * @brief Publisher Name
+ */
+const std::string kEtwDNSPublisherName = "etw_dns_publisher";
+
+/**
+ * @brief Implements an EtwPublisher that collects and
+ * dispatches ETW events with process-start and process-stop OS information.
+ */
+class EtwPublisherDNS
+    : public EtwPublisherBase,
+      public EventPublisher<EtwDNSEventSubContext, EtwDNSEventContext> {
+  /**
+   * @brief Publisher constants
+   */
+  static const USHORT kEtwDefaultKernelId = 0;
+  static const USHORT kEtwDnsStartId = 1;
+  static const USHORT kEtwDnsStopId = 2;
+
+  /**
+   * @brief Supported User Start DNS Events versions
+   */
+  const enum class etwUserDNSStartVersion {
+    Version0 = 0,
+    Version1,
+    Version2,
+    Version3
+  };
+
+  /**
+   * @brief Supported User Stop DNS Events versions
+   */
+  enum class etwUserDNSStopVersion { Version0 = 0, Version1, Version2 };
+
+  /**
+   * @brief Supported Kernel DNS Events versions
+   */
+  enum class etwKernelDNSVersion { Version3 = 3, Version4 };
+
+  /**
+   * @brief Publisher type declaration
+   */
+  DECLARE_PUBLISHER(kEtwDNSPublisherName);
+
+ public:
+  EtwPublisherDNS();
+
+  /**
+   * @brief Used to configure the ETW providers to listen, along with
+   * its configuration parameters and processing callbacks.
+   *
+   * @return Status of the provider setup process.
+   */
+  Status setUp() override;
+
+ private:
+  /**
+   * @brief Provides the c-function callback in charge of performing the pre
+   * processing logic. This is the entry point for the event arriving from the
+   * ETW OS interface. This callback gets called from the OS for every new ETW
+   * event. There should be lightweight logic here, with no significant
+   * performance implications.
+   *
+   * @param rawEvent is the RAW ETW event obtained from OS ETW provider. It
+   * comprises an EVENT_HEADER common to all ETW providers and a UserData field
+   * with provider-specific content.
+   * https://learn.microsoft.com/en-us/windows/win32/api/evntcons/ns-evntcons-event_record
+   *
+   * @param traceCtx This is a helper class that it is used to parse the ETW
+   * event manifest when needed.
+   */
+  static void providerPreProcessor(const EVENT_RECORD& rawEvent,
+                                   const krabs::trace_context& traceCtx);
+
+  /**
+   * @brief Provides the std::function callback in charge of performing the
+   * post processing logic. This logic is used to enrich, aggregate and modify
+   * the event data before dispatching it to the event subscribers.
+   */
+  void providerPostProcessor(const EtwEventDataRef& data) override;
+
+ private:
+  using HardVolumeDriveCollection =
+      std::unordered_map<std::string, std::string>;
+  using UsernameBySIDCollection = std::unordered_map<std::string, std::string>;
+
+  HardVolumeDriveCollection hardVolumeDrives_;
+  UsernameBySIDCollection usernamesBySIDs_;
+};
+
+} // namespace osquery
+

osquery/events/windows/windowseventlogpublisher.cpp

@@ -208,6 +208,10 @@ double WindowsEventLogPublisher::cosineSimilarity(
   std::vector<double> buffer_freqs(kCharFreqVectorLen, 0.0);
 
   auto buffer_size = buffer.size();
+  if (buffer_size == 0) {
+    return 0.0;
+  }
+
   for (unsigned char chr : buffer) {
     if (chr < kCharFreqVectorLen) {
       buffer_freqs[chr] += 1.0 / buffer_size;

osquery/extensions/extensions.cpp

@@ -184,7 +184,9 @@ Status extensionPathActive(const std::string& path, bool use_timeout = false) {
         // Create a client with a 10-second receive timeout.
         ExtensionManagerClient client(path, 10);
         auto status = client.ping();
-        return Status::success();
+        if (status.ok()) {
+          return Status::success();
+        }
       } catch (const std::exception& /* e */) {
         // Path might exist without a connected extension or extension manager.
       }

osquery/filesystem/file_compression.cpp

@@ -182,7 +182,15 @@ Status archive(const std::set<boost::filesystem::path>& paths,
     archive_entry_set_size(entry, pFile.size());
     archive_entry_set_filetype(entry, AE_IFREG);
     archive_entry_set_perm(entry, 0644);
-    archive_write_header(arch, entry);
+    auto headerRet = archive_write_header(arch, entry);
+    if (headerRet == ARCHIVE_FATAL || headerRet == ARCHIVE_WARN) {
+      std::string errMsg = "Failed to write tar header for file: " +
+                            f.string() + " (" +
+                            std::string(archive_error_string(arch)) + ")";
+      archive_entry_free(entry);
+      archive_write_free(arch);
+      return Status(1, errMsg);
+    }
 
     auto blkCount = static_cast<size_t>(ceil(static_cast<double>(pFile.size()) /
                                              static_cast<double>(block_size)));
@@ -193,11 +201,21 @@ Status archive(const std::set<boost::filesystem::path>& paths,
         // resize the buffer to size we read as last block is likely smaller
         block.resize(static_cast<std::size_t>(r));
       }
-      archive_write_data(arch, block.data(), block.size());
+      auto writeRet = archive_write_data(arch, block.data(), block.size());
+      if (writeRet < 0 ||
+          static_cast<std::size_t>(writeRet) != block.size()) {
+        std::string errMsg = "Failed to write tar data for file: " +
+                              f.string() + " (" +
+                              std::string(archive_error_string(arch)) + ")";
+        archive_entry_free(entry);
+        archive_write_free(arch);
+        return Status(1, errMsg);
+      }
     }
     archive_entry_free(entry);
   }
   archive_write_free(arch);
   return Status::success();
 };
 } // namespace osquery
+