diff --git a/osquery/filesystem/filesystem.cpp b/osquery/filesystem/filesystem.cpp index d3543493..e3134cd2 100644 --- a/osquery/filesystem/filesystem.cpp +++ b/osquery/filesystem/filesystem.cpp @@ -281,7 +281,8 @@ Status resolveLastPathComponent(const fs::path& fs_path, try { // Is the path a file - if (setting == REC_LIST_FILES && fs::is_regular_file(fs_path)) { + if ((setting & (REC_EVENT_OPT | REC_LIST_FILES)) > 0 && + fs::is_regular_file(fs_path)) { results.push_back(fs_path.string()); return Status(0, "OK"); } diff --git a/osquery/filesystem/filesystem_tests.cpp b/osquery/filesystem/filesystem_tests.cpp index 651a0b52..fdf2e8e6 100644 --- a/osquery/filesystem/filesystem_tests.cpp +++ b/osquery/filesystem/filesystem_tests.cpp @@ -232,6 +232,17 @@ TEST_F(FilesystemTests, test_dotdot_relative) { EXPECT_TRUE(found); } +TEST_F(FilesystemTests, test_no_wild) { + std::vector all; + auto status = resolveFilePattern(kFakeDirectory + "/roto.txt", + all, REC_LIST_FILES); + EXPECT_TRUE(status.ok()); + EXPECT_EQ(all.size(), 1); + EXPECT_NE(std::find(all.begin(), all.end(), + kFakeDirectory + "/roto.txt"), + all.end()); +} + TEST_F(FilesystemTests, test_safe_permissions) { // For testing we can request a different directory path. EXPECT_TRUE(safePermissions("/", kFakeDirectory + "/door.txt"));