valitydev/osquery-1
14
0
Fork 0
mirror of https://github.com/valitydev/osquery-1.git synced 2024-11-06 17:45:22 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge pull request #1493 from theopolis/fix_1492

Browse Source 
[Fix #1492] Fix firefox key counting and spec typo
This commit is contained in:
Teddy Reed 2015-09-02 23:49:55 -07:00
commit ba7cef3f78
4 changed files with 20 additions and 22 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
osquery/tables/applications/browser_firefox.cpp
View File

@ -14,6 +14,8 @@
#include <osquery/logger.h> #include <osquery/logger.h>
#include <osquery/tables.h> #include <osquery/tables.h>
#include "osquery/tables/applications/browser_utils.h"
namespace fs = boost::filesystem; namespace fs = boost::filesystem;
namespace pt = boost::property_tree; namespace pt = boost::property_tree;
@ -61,24 +63,16 @@ void genFirefoxAddonsFromExtensions(const std::string& path,
Row r; Row r;
// Most of the keys are in the top-level JSON dictionary. // Most of the keys are in the top-level JSON dictionary.
for (const auto& it : kFirefoxAddonKeys) { for (const auto& it : kFirefoxAddonKeys) {
if (addon.second.count(it.first)) { r[it.second] = addon.second.get(it.first, "");
r[it.second] = addon.second.get<std::string>(it.first, "");
}
// Convert bool-types to an integer. // Convert bool-types to an integer.
if (r[it.second] == "true" || r[it.second] == "YES" || jsonBoolAsInt(r[it.second]);
r[it.first] == "Yes") {
r[it.second] = INTEGER(1);
} else if (r[it.second] == "false" || r[it.second] == "NO" ||
r[it.second] == "No") {
r[it.second] = INTEGER(0);
}
} }
// There are several ways to disabled the addon, check each. // There are several ways to disabled the addon, check each.
if (addon.second.get<std::string>("softDisable", "false") == "true" || if (addon.second.get("softDisable", "false") == "true" ||
addon.second.get<std::string>("appDisabled", "false") == "true" || addon.second.get("appDisabled", "false") == "true" ||
addon.second.get<std::string>("userDisabled", "false") == "true") { addon.second.get("userDisabled", "false") == "true") {
r["disabled"] = INTEGER(1); r["disabled"] = INTEGER(1);
} else { } else {
r["disabled"] = INTEGER(0); r["disabled"] = INTEGER(0);

8
osquery/tables/applications/browser_utils.h
View File

@ -20,5 +20,13 @@ namespace tables {
QueryData genChromeBasedExtensions(QueryContext& context, const fs::path sub_dir); QueryData genChromeBasedExtensions(QueryContext& context, const fs::path sub_dir);
/// A helper check to rename bool-type values as 1 or 0.
inline void jsonBoolAsInt(std::string& s) {
if (s == "true" || s == "YES" || s == "Yes") {
s = "1";
} else if (s == "false" || s == "NO" || s == "No") {
s = "0";
}
}
} }
} }

12
osquery/tables/applications/darwin/browser_plugins.cpp
View File

@ -15,6 +15,8 @@
#include <archive.h> #include <archive.h>
#include <archive_entry.h> #include <archive_entry.h>
#include "osquery/tables/applications/browser_utils.h"
namespace fs = boost::filesystem; namespace fs = boost::filesystem;
namespace pt = boost::property_tree; namespace pt = boost::property_tree;
@ -57,14 +59,8 @@ void genBrowserPlugin(const std::string& path, QueryData& results) {
for (const auto& it : kBrowserPluginKeys) { for (const auto& it : kBrowserPluginKeys) {
r[it.second] = tree.get(it.first, ""); r[it.second] = tree.get(it.first, "");
// Convert Plist bool-types to an integer. // Convert bool-types to an integer.
if (r.at(it.second) == "true" || r.at(it.second) == "YES" || jsonBoolAsInt(r[it.second]);
r.at(it.second) == "Yes") {
r[it.second] = "1";
} else if (r.at(it.second) == "false" || r.at(it.second) == "NO" ||
r.at(it.second) == "No") {
r[it.second] = "0";
}
} }
} }

2
specs/firefox_addons.table
View File

@ -3,7 +3,7 @@ description("Firefox browser extensions, webapps, and addons.")
schema([ schema([
Column("name", TEXT, "Addon display name"), Column("name", TEXT, "Addon display name"),
Column("identifier", TEXT, "Addon identifier"), Column("identifier", TEXT, "Addon identifier"),
Column("creator", TEXT< "Addon-supported creator string"), Column("creator", TEXT, "Addon-supported creator string"),
Column("type", TEXT, "Extension, addon, webapp"), Column("type", TEXT, "Extension, addon, webapp"),
Column("version", TEXT, "Addon-supplied version string"), Column("version", TEXT, "Addon-supplied version string"),
Column("description", TEXT, "Addon-supplied description string"), Column("description", TEXT, "Addon-supplied description string"),