valitydev/osquery-1
14
0
Fork 0
mirror of https://github.com/valitydev/osquery-1.git synced 2024-11-08 02:18:53 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge pull request #537 from eastebry/520_pt_json_workaround

Browse Source 
[Draft] - potential workaround for #520
This commit is contained in:
Teddy Reed 2014-12-21 21:57:41 -08:00
commit 3a4aa1eb91
3 changed files with 31 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
include/osquery/database/results.h
View File

@ -353,4 +353,18 @@ Status serializeScheduledQueryLogItemAsEventsJSON(
* @return true if the Row was added to the QueryData, false if it wasn't
*/
bool addUniqueRowToQueryData(QueryData& q, const Row& r);
/**
* @brief Construct a new QueryData from an existing one, replacing all
* non-ascii characters with their \u encoding.
*
* This function is intended as a workaround for
* https://svn.boost.org/trac/boost/ticket/8883,
* and will allow rows containing data with non-ascii characters to be stored in
* the database and parsed back into a property tree.
*
* @param oldData the old QueryData to copy
* @param newData the new escaped QueryData object
*/
void escapeQueryData(const osquery::QueryData &oldData, osquery::QueryData &newData);
}

9
osquery/database/query.cpp
View File

@ -100,11 +100,16 @@ osquery::Status Query::addNewResults(const osquery::QueryData& qd,
if (!hqr_status.ok() && hqr_status.toString() != kQueryNameNotFoundError) {
return hqr_status;
}
QueryData escaped_qd;
// remove all non-ascii characters from the string
escapeQueryData(qd, escaped_qd);
if (calculate_diff) {
dr = diff(hQR.mostRecentResults.second, qd);
dr = diff(hQR.mostRecentResults.second, escaped_qd);
}
hQR.mostRecentResults.first = unix_time;
hQR.mostRecentResults.second = qd;
hQR.mostRecentResults.second = escaped_qd;
std::string json;
auto serialize_status = serializeHistoricalQueryResultsJSON(hQR, json);
if (!serialize_status.ok()) {

10
osquery/database/results.cpp
View File

@ -33,6 +33,16 @@ namespace osquery {
// respective value
/////////////////////////////////////////////////////////////////////////////
void escapeQueryData(const QueryData &oldData, QueryData &newData) {
for (const auto& r : oldData) {
Row newRow;
for (auto& i : r) {
newRow[i.first] = pt::json_parser::create_escapes(i.second);
}
newData.push_back(newRow);
}
}
Status serializeRow(const Row& r, pt::ptree& tree) {
try {
for (auto& i : r) {