osquery-1/specs/chrome_extension_content_scripts.table
Rachel Cipkins 3de799ef07
Support for "matches" and "js" keys from "content_scripts" in the chrome_extensions table (#6140)
Co-authored-by: William Woodruff <william@yossarian.net>
2020-02-21 18:13:41 -05:00

21 lines
811 B
Plaintext

table_name("chrome_extension_content_scripts")
description("Chrome browser extension content scripts.")
schema([
Column("uid", BIGINT, "The local user that owns the extension",
index=True),
Column("identifier", TEXT, "Extension identifier"),
Column("version", TEXT, "Extension-supplied version"),
Column("script", TEXT, "The content script used by the extension"),
Column("match", TEXT, "The pattern that the script is matched against"),
ForeignKey(column="uid", table="users"),
])
attributes(user_data=True)
implementation("applications/browser_chrome@genChromeExtensionContentScripts")
examples([
"select * from chrome_extensions join chrome_extension_content_scripts using (identifier)",
])
fuzz_paths([
"/Library/Application Support/Google/Chrome/",
"/Users",
])