From f6b48625786d0c0b51be1c0e63494eadaa5b638a Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 05:20:25 +0000 Subject: [PATCH 01/40] fix(adhoc-sweep-fixes): 58 review findings across 40 files --- plugins/database/sqlite.cpp | 84 +++++++++++++++++++++++++++---------- 1 file changed, 61 insertions(+), 23 deletions(-) diff --git a/plugins/database/sqlite.cpp b/plugins/database/sqlite.cpp index 9423b266451..8da15de22ed 100644 --- a/plugins/database/sqlite.cpp +++ b/plugins/database/sqlite.cpp @@ -115,19 +115,27 @@ static int getData(void* argument, int argc, char* argv[], char* column[]) { Status SQLiteDatabasePlugin::get(const std::string& domain, const std::string& key, std::string& value) const { - QueryData results; - char* err = nullptr; - std::string q = "select value from " + domain + " where key = '" + key + "';"; - sqlite3_exec(db_, q.c_str(), getData, &results, &err); - if (err != nullptr) { - sqlite3_free(err); + sqlite3_stmt* stmt = nullptr; + std::string q = "select value from " + domain + " where key = ?1;"; + auto rc = sqlite3_prepare_v2(db_, q.c_str(), -1, &stmt, nullptr); + if (rc != SQLITE_OK || stmt == nullptr) { + if (stmt != nullptr) { + sqlite3_finalize(stmt); + } + return Status(1); } - // Only assign value if the query found a result. - if (results.size() > 0) { - value = std::move(results[0]["value"]); + sqlite3_bind_text(stmt, 1, key.c_str(), -1, SQLITE_STATIC); + + rc = sqlite3_step(stmt); + if (rc == SQLITE_ROW) { + const auto* text = sqlite3_column_text(stmt, 0); + value = (text != nullptr) ? reinterpret_cast(text) : ""; + sqlite3_finalize(stmt); return Status(0); } + + sqlite3_finalize(stmt); return Status(1); } @@ -195,7 +203,13 @@ Status SQLiteDatabasePlugin::putBatch(const std::string& domain, // Bind each value from the rows we got sqlite3_stmt* stmt = nullptr; - sqlite3_prepare_v2(db_, q.c_str(), -1, &stmt, nullptr); + auto prc = sqlite3_prepare_v2(db_, q.c_str(), -1, &stmt, nullptr); + if (prc != SQLITE_OK || stmt == nullptr) { + if (stmt != nullptr) { + sqlite3_finalize(stmt); + } + return Status(1); + } { int i = 1; @@ -213,6 +227,7 @@ Status SQLiteDatabasePlugin::putBatch(const std::string& domain, auto rc = sqlite3_step(stmt); if (rc != SQLITE_DONE) { + sqlite3_finalize(stmt); return Status(1); } @@ -228,11 +243,18 @@ Status SQLiteDatabasePlugin::remove(const std::string& domain, const std::string& key) { sqlite3_stmt* stmt = nullptr; std::string q = "delete from " + domain + " where key IN (?1);"; - sqlite3_prepare_v2(db_, q.c_str(), -1, &stmt, nullptr); + auto prc = sqlite3_prepare_v2(db_, q.c_str(), -1, &stmt, nullptr); + if (prc != SQLITE_OK || stmt == nullptr) { + if (stmt != nullptr) { + sqlite3_finalize(stmt); + } + return Status(1); + } sqlite3_bind_text(stmt, 1, key.c_str(), -1, SQLITE_STATIC); auto rc = sqlite3_step(stmt); if (rc != SQLITE_DONE) { + sqlite3_finalize(stmt); return Status(1); } @@ -252,12 +274,19 @@ Status SQLiteDatabasePlugin::removeRange(const std::string& domain, sqlite3_stmt* stmt = nullptr; std::string q = "delete from " + domain + " where key >= ?1 and key <= ?2;"; - sqlite3_prepare_v2(db_, q.c_str(), -1, &stmt, nullptr); + auto prc = sqlite3_prepare_v2(db_, q.c_str(), -1, &stmt, nullptr); + if (prc != SQLITE_OK || stmt == nullptr) { + if (stmt != nullptr) { + sqlite3_finalize(stmt); + } + return Status(1); + } sqlite3_bind_text(stmt, 1, low.c_str(), -1, SQLITE_STATIC); sqlite3_bind_text(stmt, 2, high.c_str(), -1, SQLITE_STATIC); auto rc = sqlite3_step(stmt); if (rc != SQLITE_DONE) { + sqlite3_finalize(stmt); return Status(1); } @@ -272,24 +301,33 @@ Status SQLiteDatabasePlugin::scan(const std::string& domain, std::vector& results, const std::string& prefix, uint64_t max) const { - QueryData _results; - char* err = nullptr; - - std::string q = - "select key from " + domain + " where key LIKE '" + prefix + "%'"; + sqlite3_stmt* stmt = nullptr; + std::string q = "select key from " + domain + " where key LIKE ?1 || '%'"; if (max > 0) { q += " limit " + std::to_string(max); } - sqlite3_exec(db_, q.c_str(), getData, &_results, &err); - if (err != nullptr) { - sqlite3_free(err); + q += ";"; + + auto prc = sqlite3_prepare_v2(db_, q.c_str(), -1, &stmt, nullptr); + if (prc != SQLITE_OK || stmt == nullptr) { + if (stmt != nullptr) { + sqlite3_finalize(stmt); + } + return Status::success(); } - // Only assign value if the query found a result. - for (auto& r : _results) { - results.push_back(std::move(r["key"])); + sqlite3_bind_text(stmt, 1, prefix.c_str(), -1, SQLITE_STATIC); + + int rc = 0; + while ((rc = sqlite3_step(stmt)) == SQLITE_ROW) { + const auto* text = sqlite3_column_text(stmt, 0); + results.push_back((text != nullptr) ? reinterpret_cast(text) + : ""); } + sqlite3_finalize(stmt); + return Status::success(); } } // namespace osquery + From cc1be12f865ea75dfc6d50ce335a3852f38a5e3f Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 05:20:27 +0000 Subject: [PATCH 02/40] fix(adhoc-sweep-fixes): 58 review findings across 40 files --- osquery/tables/events/darwin/socket_events.cpp | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/osquery/tables/events/darwin/socket_events.cpp b/osquery/tables/events/darwin/socket_events.cpp index e236ddcfc29..5a495e1f2e1 100644 --- a/osquery/tables/events/darwin/socket_events.cpp +++ b/osquery/tables/events/darwin/socket_events.cpp @@ -105,7 +105,7 @@ Status OpenBSMNetEvSubscriber::Callback( r["action"] = "connect"; } else if (tok.tt.hdr32_ex.e_type == AUE_BIND) { r["action"] = "bind"; - } else if (tok.tt.hdr32.e_type == AUE_ACCEPT) { + } else if (tok.tt.hdr32_ex.e_type == AUE_ACCEPT) { r["action"] = "accept"; } else { continue; @@ -118,7 +118,7 @@ Status OpenBSMNetEvSubscriber::Callback( r["action"] = "connect"; } else if (tok.tt.hdr64_ex.e_type == AUE_BIND) { r["action"] = "bind"; - } else if (tok.tt.hdr64.e_type == AUE_ACCEPT) { + } else if (tok.tt.hdr64_ex.e_type == AUE_ACCEPT) { r["action"] = "accept"; } else { continue; @@ -146,7 +146,7 @@ Status OpenBSMNetEvSubscriber::Callback( case AUT_SUBJECT64: r["auid"] = INTEGER(tok.tt.subj64.auid); r["pid"] = INTEGER(tok.tt.subj64.pid); - pid = tok.tt.subj32.pid; + pid = tok.tt.subj64.pid; break; case AUT_SUBJECT32_EX: r["auid"] = INTEGER(tok.tt.subj32_ex.auid); @@ -234,3 +234,4 @@ Status OpenBSMNetEvSubscriber::Callback( } } // namespace osquery + From d194e541516947814b5d04169207a1664b880532 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 05:20:28 +0000 Subject: [PATCH 03/40] fix(adhoc-sweep-fixes): 58 review findings across 40 files --- tests/integration/tables/azure_instance_metadata.cpp | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/tests/integration/tables/azure_instance_metadata.cpp b/tests/integration/tables/azure_instance_metadata.cpp index 016c2a5f527..3e35d56683b 100644 --- a/tests/integration/tables/azure_instance_metadata.cpp +++ b/tests/integration/tables/azure_instance_metadata.cpp @@ -28,7 +28,8 @@ TEST_F(azureInstanceMetadata, test_sanity) { {"architecture", NormalType}, {"offer", NormalType}, {"publisher", NormalType}, - {"sku", NormalType} {"version", NormalType}, + {"sku", NormalType}, + {"version", NormalType}, {"os_type", NormalType}, {"platform_update_domain", NormalType}, {"platform_fault_domain", NormalType}, @@ -42,6 +43,7 @@ TEST_F(azureInstanceMetadata, test_sanity) { }; validate_rows(data, row_map); } +} } // namespace table_tests -} // namespace table_tests +} // namespace osquery From af9ee8fe36877f5f1b3a1407d00ba81bbd5d20f6 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 05:20:29 +0000 Subject: [PATCH 04/40] fix(adhoc-sweep-fixes): 58 review findings across 40 files --- osquery/tables/system/windows/dns_cache.cpp | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) diff --git a/osquery/tables/system/windows/dns_cache.cpp b/osquery/tables/system/windows/dns_cache.cpp index 311ed6b42a3..fb66f258ff4 100644 --- a/osquery/tables/system/windows/dns_cache.cpp +++ b/osquery/tables/system/windows/dns_cache.cpp @@ -136,9 +136,23 @@ QueryData genDnsCache(QueryContext& context) { PDNSCACHEENTRY pEntry = (PDNSCACHEENTRY)malloc(sizeof(DNSCACHEENTRY)); HINSTANCE hLib = LoadLibraryExW(L"DNSAPI.dll", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32); + if (hLib == NULL) { + LOG(WARNING) << "Failed to load DNSAPI.dll, error code " << GetLastError(); + free(pEntry); + return results; + } + DNS_GET_CACHE_DATA_TABLE DnsGetCacheDataTable = (DNS_GET_CACHE_DATA_TABLE)GetProcAddress(hLib, "DnsGetCacheDataTable"); + if (DnsGetCacheDataTable == nullptr) { + LOG(WARNING) << "Failed to resolve DnsGetCacheDataTable, error code " + << GetLastError(); + free(pEntry); + FreeLibrary(hLib); + return results; + } + PDNSCACHEENTRY pHead = pEntry; int stat = DnsGetCacheDataTable(pEntry); pEntry = pEntry->pNext; while (pEntry != nullptr) { @@ -151,9 +165,11 @@ QueryData genDnsCache(QueryContext& context) { results.push_back(r); pEntry = pEntry->pNext; } - free(pEntry); + free(pHead); + FreeLibrary(hLib); return results; } } // namespace tables } // namespace osquery + From 70fb4e08a219a87a6ee1c9cfe452fa24932057ce Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 05:20:30 +0000 Subject: [PATCH 05/40] fix(adhoc-sweep-fixes): 58 review findings across 40 files --- osquery/tables/system/windows/prefetch.cpp | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/osquery/tables/system/windows/prefetch.cpp b/osquery/tables/system/windows/prefetch.cpp index 9f92f3fe9c3..f3edf658cae 100644 --- a/osquery/tables/system/windows/prefetch.cpp +++ b/osquery/tables/system/windows/prefetch.cpp @@ -346,7 +346,7 @@ void parsePrefetch(const std::string& file_path, RowYield& yield) { (std::istreambuf_iterator())); input_file.close(); - if (compressed_data.size() < sizeof(PPREFETCH_COMPRESSED_HEADER)) { + if (compressed_data.size() < sizeof(PREFETCH_COMPRESSED_HEADER)) { // Not enough data to determine header size. return; } @@ -366,7 +366,7 @@ void parsePrefetch(const std::string& file_path, RowYield& yield) { data = std::move(compressed_data); } - if (data.size() < sizeof(PPREFETCH_FILE_HEADER)) { + if (data.size() < sizeof(PREFETCH_FILE_HEADER)) { // Not enough data to determine signature. return; } @@ -414,3 +414,4 @@ void genPrefetch(RowYield& yield, QueryContext& context) { } } // namespace tables } // namespace osquery + From f18d91b83741b456aaab1c32e458a2a151441216 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 05:20:31 +0000 Subject: [PATCH 06/40] fix(adhoc-sweep-fixes): 58 review findings across 40 files --- osquery/utils/aws/aws_util.cpp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/osquery/utils/aws/aws_util.cpp b/osquery/utils/aws/aws_util.cpp index eec730abe4f..fb30a9eef95 100644 --- a/osquery/utils/aws/aws_util.cpp +++ b/osquery/utils/aws/aws_util.cpp @@ -165,10 +165,10 @@ bool validateIMDSV2RequestAttempts(const char* flagname, std::uint32_t value) { std::string error_message = "Only values higher than 0 are supported for " + std::string(flagname); osquery::systemLog(error_message); - std::cerr << error_message << std::endl; + LOG(ERROR) << error_message; return false; - } // namespace osquery + } return true; } From b55833d8a9958f020498049d7f47b2eca40efae6 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 05:20:32 +0000 Subject: [PATCH 07/40] fix(adhoc-sweep-fixes): 58 review findings across 40 files --- osquery/filesystem/file_compression.cpp | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/osquery/filesystem/file_compression.cpp b/osquery/filesystem/file_compression.cpp index 08a1f28976e..b7795db8275 100644 --- a/osquery/filesystem/file_compression.cpp +++ b/osquery/filesystem/file_compression.cpp @@ -48,8 +48,8 @@ Status compress(const boost::filesystem::path& in, size_t const buffInSize = ZSTD_CStreamInSize(); size_t const buffOutSize = ZSTD_CStreamOutSize(); - std::vector buffIn(buffInSize); - std::vector buffOut(buffOutSize); + std::vector buffIn(buffInSize); + std::vector buffOut(buffOutSize); auto read = buffInSize; auto toRead = buffInSize; size_t readSoFar = 0; @@ -114,8 +114,8 @@ Status decompress(const boost::filesystem::path& in, auto inFileSize = inFile.size(); size_t const buffInSize = ZSTD_DStreamInSize(); size_t const buffOutSize = ZSTD_DStreamOutSize(); - std::vector buffIn(buffInSize); - std::vector buffOut(buffOutSize); + std::vector buffIn(buffInSize); + std::vector buffOut(buffOutSize); ZSTD_DStream* const dstream = ZSTD_createDStream(); if (dstream == NULL) { From c3524c22a71f596355ae89f97009deb0c884b90d Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 05:20:33 +0000 Subject: [PATCH 08/40] fix(adhoc-sweep-fixes): 58 review findings across 40 files --- osquery/tables/system/windows/logon_sessions.cpp | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/osquery/tables/system/windows/logon_sessions.cpp b/osquery/tables/system/windows/logon_sessions.cpp index ffca7480c6f..9f70aa7c98c 100644 --- a/osquery/tables/system/windows/logon_sessions.cpp +++ b/osquery/tables/system/windows/logon_sessions.cpp @@ -62,9 +62,11 @@ QueryData queryLogonSessions(QueryContext& context) { r["logon_domain"] = wstringToString(session_data->LogonDomain.Buffer); r["authentication_package"] = wstringToString(session_data->AuthenticationPackage.Buffer); - r["logon_type"] = - kLogonTypeToStr.find(SECURITY_LOGON_TYPE(session_data->LogonType)) - ->second; + auto logon_type_it = + kLogonTypeToStr.find(SECURITY_LOGON_TYPE(session_data->LogonType)); + r["logon_type"] = logon_type_it != kLogonTypeToStr.end() + ? logon_type_it->second + : "Unknown"; r["session_id"] = INTEGER(session_data->Session); r["logon_sid"] = psidToString(session_data->Sid); r["logon_time"] = BIGINT(longIntToUnixtime(session_data->LogonTime)); @@ -78,9 +80,12 @@ QueryData queryLogonSessions(QueryContext& context) { r["home_directory_drive"] = wstringToString(session_data->HomeDirectoryDrive.Buffer); results.push_back(std::move(r)); + LsaFreeReturnBuffer(session_data); } + LsaFreeReturnBuffer(sessions); } return results; } // function queryLogonSessions } // namespace tables } // namespace osquery + From 9db52a0fa137fa1473d24d255a6e4c33f16bed2c Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 05:20:34 +0000 Subject: [PATCH 09/40] fix(adhoc-sweep-fixes): 58 review findings across 40 files --- osquery/events/darwin/scnetwork.cpp | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/osquery/events/darwin/scnetwork.cpp b/osquery/events/darwin/scnetwork.cpp index 9c2fa1b2b29..7f3698331d9 100644 --- a/osquery/events/darwin/scnetwork.cpp +++ b/osquery/events/darwin/scnetwork.cpp @@ -34,6 +34,7 @@ void SCNetworkEventPublisher::Callback(const SCNetworkReachabilityRef target, auto ec = createEventContext(); ec->subscription = *(SCNetworkSubscriptionContextRef*)info; ec->flags = flags; + EventFactory::fire(ec); } bool SCNetworkEventPublisher::shouldFire( @@ -116,14 +117,14 @@ void SCNetworkEventPublisher::configure() { if (sc->type == ADDRESS_TARGET) { auto existing_address = std::find( target_addresses_.begin(), target_addresses_.end(), sc->target); - if (existing_address != target_addresses_.end()) { + if (existing_address == target_addresses_.end()) { // Add the address target. addAddress(sc); } } else { auto existing_hostname = std::find(target_names_.begin(), target_names_.end(), sc->target); - if (existing_hostname != target_names_.end()) { + if (existing_hostname == target_names_.end()) { // Add the hostname target. addHostname(sc); } @@ -183,3 +184,4 @@ Status SCNetworkEventPublisher::run() { return Status::success(); } }; + From 4c76386c4db796c5ab467b3f4f3e48fefbcfcc2a Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 05:20:35 +0000 Subject: [PATCH 10/40] fix(adhoc-sweep-fixes): 58 review findings across 40 files --- osquery/events/tests/linux/bpf/utils.cpp | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/osquery/events/tests/linux/bpf/utils.cpp b/osquery/events/tests/linux/bpf/utils.cpp index 705b8b625d3..e160e27527c 100644 --- a/osquery/events/tests/linux/bpf/utils.cpp +++ b/osquery/events/tests/linux/bpf/utils.cpp @@ -168,8 +168,8 @@ bool validateSocketDescriptor(const ProcessContext& process_context, const auto& socket_info = std::get(fd_info.data); - if (!socket_info.opt_domain.has_value() || socket_info.opt_type.has_value() || - socket_info.opt_protocol.has_value()) { + if (!socket_info.opt_domain.has_value() || !socket_info.opt_type.has_value() || + !socket_info.opt_protocol.has_value()) { return false; } @@ -232,3 +232,4 @@ bool validateSocketDescriptor(const ProcessContextMap& process_context_map, } } // namespace osquery + From d9c7a0f34547a064b36b6f9005c312a0129951a2 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 05:20:36 +0000 Subject: [PATCH 11/40] fix(adhoc-sweep-fixes): 58 review findings across 40 files --- osquery/events/windows/etw/etw_provider_config.cpp | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/osquery/events/windows/etw/etw_provider_config.cpp b/osquery/events/windows/etw/etw_provider_config.cpp index 1cd5b597e5a..5e2805fe582 100644 --- a/osquery/events/windows/etw/etw_provider_config.cpp +++ b/osquery/events/windows/etw/etw_provider_config.cpp @@ -26,8 +26,8 @@ Status EtwProviderConfig::isValid() const { return Status::failure("Type handlers were not provided"); } - if (getPostProcessor() == nullptr) { - return Status::failure("Invalid Provider PostProcessor function"); + if (getPreProcessor() == nullptr) { + return Status::failure("Invalid Provider PreProcessor function"); } return Status::success(); @@ -166,4 +166,4 @@ void EtwProviderConfig::addEventTypeToHandle(const EtwEventType& value) { eventTypes_.push_back(value); } -} // namespace osquery \ No newline at end of file +} // namespace osquery From 73afb9feeb30d0699a02c1635c2518d4a52c3a6d Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 05:20:37 +0000 Subject: [PATCH 12/40] fix(adhoc-sweep-fixes): 58 review findings across 40 files --- osquery/tables/system/linux/portage.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/osquery/tables/system/linux/portage.cpp b/osquery/tables/system/linux/portage.cpp index 82b753b862c..7e3c5f33c82 100644 --- a/osquery/tables/system/linux/portage.cpp +++ b/osquery/tables/system/linux/portage.cpp @@ -314,7 +314,7 @@ QueryData genPortageKeywordSummary(QueryContext& context) { readFile(kPortageMask, masked); readFile(kPortageUnMask, unmasked); - if (!keywords.empty() || !masked.empty() || unmasked.empty()) { + if (!keywords.empty() || !masked.empty() || !unmasked.empty()) { return parsePortageKeywordSummaryContent(keywords, masked, unmasked); } else { return {}; From 5d2d2813c0be25389f9f76726e16a5fbc7bcd9fb Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 05:20:38 +0000 Subject: [PATCH 13/40] fix(adhoc-sweep-fixes): 58 review findings across 40 files --- osquery/events/darwin/fsevents.cpp | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/osquery/events/darwin/fsevents.cpp b/osquery/events/darwin/fsevents.cpp index 1b0ebe9c21b..c3baf6670bd 100644 --- a/osquery/events/darwin/fsevents.cpp +++ b/osquery/events/darwin/fsevents.cpp @@ -55,7 +55,7 @@ REGISTER(FSEventsEventPublisher, "event_publisher", "fsevents"); void FSEventsSubscriptionContext::requireAction(const std::string& action) { for (const auto& bit : kMaskActions) { if (action == bit.second) { - mask = mask & bit.first; + mask = mask | bit.first; } } } @@ -380,3 +380,4 @@ bool FSEventsEventPublisher::isStreamRunning() const { return CFRunLoopIsWaiting(run_loop_); } } + From 103ad073b22d5496c5e73dd764d53c38464af902 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 05:20:39 +0000 Subject: [PATCH 14/40] fix(adhoc-sweep-fixes): 58 review findings across 40 files --- osquery/tables/networking/curl_certificate.cpp | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/osquery/tables/networking/curl_certificate.cpp b/osquery/tables/networking/curl_certificate.cpp index 438433bd96a..f5aa4020412 100644 --- a/osquery/tables/networking/curl_certificate.cpp +++ b/osquery/tables/networking/curl_certificate.cpp @@ -302,7 +302,7 @@ Status getTLSCertificate(const std::string& hostname, std::string port = "443"; auto connect_hostname = hostname; auto delim = hostname.find(":"); - if (delim + 1 == hostname.length()) { + if (delim != std::string::npos && delim + 1 == hostname.length()) { // if no port specified use default port connect_hostname = hostname.substr(0, delim); } else if (delim != std::string::npos) { @@ -459,3 +459,4 @@ QueryData genTLSCertificate(QueryContext& context) { } } // namespace tables } // namespace osquery + From dd1d63ca677e5a1c8c9794d71d76f996a8255ecc Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 05:20:40 +0000 Subject: [PATCH 15/40] fix(adhoc-sweep-fixes): 58 review findings across 40 files --- .../windows/etw/etw_publisher_processes.cpp | 39 +++++++++++++++++-- 1 file changed, 35 insertions(+), 4 deletions(-) diff --git a/osquery/events/windows/etw/etw_publisher_processes.cpp b/osquery/events/windows/etw/etw_publisher_processes.cpp index 19b94c35330..ce16c280860 100644 --- a/osquery/events/windows/etw/etw_publisher_processes.cpp +++ b/osquery/events/windows/etw/etw_publisher_processes.cpp @@ -352,8 +352,13 @@ void EtwPublisherProcesses::providerPostProcessor( // Houskeeping of expired aggregation cache entries cleanOldAggregationCacheEntries(); + // Houskeeping of the process image cache to avoid unbounded growth + cleanOldProcessImageCacheEntries(); + // Caching image full path - processImageCache_.insert({searchKey, procStartData->ImageName}); + processImageCache_.insert( + {searchKey, + {procStartData->ImageName, std::time(nullptr)}}); } } } @@ -385,10 +390,31 @@ void EtwPublisherProcesses::cleanOldAggregationCacheEntries() { if ((eventTimestamp.QuadPart + expiredTime10secs) < currentTimestamp.QuadPart) { // event expire and should be deleted - processStartAggregationCache_.erase(it); + it = processStartAggregationCache_.erase(it); + } else { + ++it; } + } +} - ++it; +void EtwPublisherProcesses::cleanOldProcessImageCacheEntries() { + // Entries older than this many seconds are considered stale and removed + // to avoid unbounded growth of processImageCache_. + static constexpr std::time_t expiredTimeSecs = 300; + + if (processImageCache_.empty()) { + return; + } + + std::time_t currentTime = std::time(nullptr); + + auto it = processImageCache_.begin(); + while (it != processImageCache_.end()) { + if ((it->second.second + expiredTimeSecs) < currentTime) { + it = processImageCache_.erase(it); + } else { + ++it; + } } } @@ -399,7 +425,11 @@ void EtwPublisherProcesses::updateImagePath(const std::uint64_t& key1, std::uint64_t searchKey = getComposedKey(key1, key2); // Event specific post processing callback logic - imagePath = tryTake(processImageCache_, searchKey).takeOr(imagePath); + auto cachedEntryIt = processImageCache_.find(searchKey); + if (cachedEntryIt != processImageCache_.end()) { + imagePath = cachedEntryIt->second.first; + processImageCache_.erase(cachedEntryIt); + } } void EtwPublisherProcesses::updateTokenInfo(const std::uint32_t& tokenType, @@ -479,3 +509,4 @@ std::uint64_t EtwPublisherProcesses::getComposedKey(const std::uint64_t& key1, } } // namespace osquery + From b6935b8d0baebc9b052263bb90cd2f8b36edf99c Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 05:20:41 +0000 Subject: [PATCH 16/40] fix(adhoc-sweep-fixes): 58 review findings across 40 files --- tools/codegen/gentargets.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/tools/codegen/gentargets.py b/tools/codegen/gentargets.py index e3cbb81b0bd..bbd3f35ff74 100755 --- a/tools/codegen/gentargets.py +++ b/tools/codegen/gentargets.py @@ -11,6 +11,7 @@ import logging import os import shutil +import sys logging_format = '[%(levelname)s] %(message)s' logging.basicConfig(level=logging.INFO, format=logging_format) @@ -118,6 +119,7 @@ def get_files_to_compile(json_data): json_data = json.loads(f.read()) except ValueError: logging.critical("Error: %s is not valid JSON" % args.input) + sys.exit(1) source_files = get_files_to_compile(json_data) source_files.sort() @@ -129,7 +131,7 @@ def get_files_to_compile(json_data): p = os.path.join(args.output, source_file) if p.find("generated") < 0: try: - os.makedirs(os.path.dirname(p), 0755) + os.makedirs(os.path.dirname(p), 0o755) except: pass shutil.copyfile( @@ -138,3 +140,4 @@ def get_files_to_compile(json_data): except IOError as e: logging.critical("Error: %s doesn't exist: %s" % (args.input, str(e))) + From 8b6031962fb2768f5848c5361acff889e28bdd11 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 05:20:42 +0000 Subject: [PATCH 17/40] fix(adhoc-sweep-fixes): 58 review findings across 40 files --- tools/tests/utils.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/tools/tests/utils.py b/tools/tests/utils.py index 19899c9c3ef..e0e88ed0e5d 100644 --- a/tools/tests/utils.py +++ b/tools/tests/utils.py @@ -121,7 +121,7 @@ def queries_from_pack(pack_path): exit(1) if "queries" not in pack: - print("%s parsed as JSON, but does not contain a 'queries' stanza. Is it really an osquery pack?" % config_path) + print("%s parsed as JSON, but does not contain a 'queries' stanza. Is it really an osquery pack?" % pack_path) exit(1) queries = {} @@ -228,9 +228,10 @@ def profile_cmd(cmd, proc=None, shell=False, timeout=0, count=1): "user_time": stats["cpu_times"].user, "system_time": stats["cpu_times"].system, "cpu_time": stats["cpu_times"].user + stats["cpu_times"].system, - "exit": p.wait(), + "exit": exit_code, } if stats.get("fds") is not None: rval["fds"] = stats["fds"] return rval + From 1783b0cc878884add8907902770f0bc43e9aa4a5 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 05:20:43 +0000 Subject: [PATCH 18/40] fix(adhoc-sweep-fixes): 58 review findings across 40 files --- osquery/events/darwin/es_utils.cpp | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/osquery/events/darwin/es_utils.cpp b/osquery/events/darwin/es_utils.cpp index 2d3afc38e32..5768caa3b7c 100644 --- a/osquery/events/darwin/es_utils.cpp +++ b/osquery/events/darwin/es_utils.cpp @@ -126,7 +126,7 @@ std::string getCDHash(const es_process_t* p) { << static_cast(i); } auto s = hash.str(); - return s.find_first_not_of(s.front()) == std::string::npos ? "" : s; + return s.find_first_not_of('0') == std::string::npos ? "" : s; } void getProcessProperties(const es_process_t* p, @@ -146,7 +146,7 @@ void getProcessProperties(const es_process_t* p, ec->cwd = getCwdPathFromPid(ec->pid); ec->uid = audit_token_to_ruid(audit_token); - ec->euid = audit_token_to_egid(audit_token); + ec->euid = audit_token_to_euid(audit_token); ec->gid = audit_token_to_rgid(audit_token); ec->egid = audit_token_to_egid(audit_token); @@ -171,3 +171,4 @@ void appendQuotedString(std::ostream& out, std::string s, char delim) { } } // namespace osquery + From c3c1bd363574a57c02f43e43f6d083742866ccdf Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 05:20:44 +0000 Subject: [PATCH 19/40] fix(adhoc-sweep-fixes): 58 review findings across 40 files --- osquery/tables/system/ssh_keys.cpp | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/osquery/tables/system/ssh_keys.cpp b/osquery/tables/system/ssh_keys.cpp index c379d146d2f..87e51ad13b1 100644 --- a/osquery/tables/system/ssh_keys.cpp +++ b/osquery/tables/system/ssh_keys.cpp @@ -47,6 +47,9 @@ bool isOpenSSHKey(const std::string& keys_content) { // `true` if the openssh key is encrypted, `false` otherwise. bool isOpenSSHKeyEncrypted(const std::string& keys_content) { + if (keys_content.size() <= kOpenSshHeader.size() + 1) { + return false; + } const std::string prefix = keys_content.substr( kOpenSshHeader.size() + 1, kOpenSshUnencryptedPrefix.size()); return prefix != kOpenSshUnencryptedPrefix; @@ -62,12 +65,12 @@ bool parsePrivateKey(const std::string& keys_content, int& key_security_bits, bool& is_encrypted) { BIO* bio_stream = BIO_new(BIO_s_mem()); - auto const bio_stream_guard = - scope_guard::create([bio_stream]() { BIO_free(bio_stream); }); - BIO_write(bio_stream, keys_content.c_str(), keys_content.size()); if (bio_stream == nullptr) { return false; } + auto const bio_stream_guard = + scope_guard::create([bio_stream]() { BIO_free(bio_stream); }); + BIO_write(bio_stream, keys_content.c_str(), keys_content.size()); // PEM_read_bio_PrivateKey calls passwordCallback // if the private key is encrypted. We don't care what the key is; @@ -220,3 +223,4 @@ QueryData getUserSshKeys(QueryContext& context) { } } // namespace tables } // namespace osquery + From 9e15dd6bdc5ec04b6e265a40c80d94141153f67b Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 05:20:45 +0000 Subject: [PATCH 20/40] fix(adhoc-sweep-fixes): 58 review findings across 40 files --- plugins/logger/kafka_producer.cpp | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/plugins/logger/kafka_producer.cpp b/plugins/logger/kafka_producer.cpp index 6c195ea0eb4..15954d5dc12 100644 --- a/plugins/logger/kafka_producer.cpp +++ b/plugins/logger/kafka_producer.cpp @@ -307,6 +307,7 @@ inline rd_kafka_topic_t* KafkaProducerPlugin::initTopic( LOG(ERROR) << "Could not initiate Kafka request.required.acks " "configuration: " << errstr; + rd_kafka_topic_conf_destroy(topicConf); return nullptr; } @@ -352,9 +353,17 @@ bool KafkaProducerPlugin::configureTopics() { topics_.push_back(std::unique_ptr>( topic, delKafkaTopic)); - } - queryToTopics_[kKafkaBaseTopic] = topic; + queryToTopics_[kKafkaBaseTopic] = topic; + } else { + LOG(ERROR) << "Could not configure base Kafka topic '" + << FLAGS_logger_kafka_topic << "'"; + if (topics_.empty()) { + return false; + } + + queryToTopics_[kKafkaBaseTopic] = nullptr; + } } else { /* If no previous topics successfully configured and no base topic is set * then configuration fails.*/ @@ -368,3 +377,4 @@ bool KafkaProducerPlugin::configureTopics() { return true; } } // namespace osquery + From 6515ffc58ca1cd51f390cc12a5b29282d88903cd Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 05:20:46 +0000 Subject: [PATCH 21/40] fix(adhoc-sweep-fixes): 58 review findings across 40 files --- osquery/events/windows/windowseventlogpublisher.cpp | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/osquery/events/windows/windowseventlogpublisher.cpp b/osquery/events/windows/windowseventlogpublisher.cpp index b76b479446c..133d2729678 100644 --- a/osquery/events/windows/windowseventlogpublisher.cpp +++ b/osquery/events/windows/windowseventlogpublisher.cpp @@ -147,8 +147,6 @@ Status WindowsEventLogPublisher::run() { auto last_fired_event_time = std::chrono::steady_clock::now(); while (!isEnding()) { - EvtSubscription::EventList event_list; - for (auto& subscription : d_->subscription_list) { auto event_list = subscription->getEvents(); @@ -208,6 +206,10 @@ double WindowsEventLogPublisher::cosineSimilarity( std::vector buffer_freqs(kCharFreqVectorLen, 0.0); auto buffer_size = buffer.size(); + if (buffer_size == 0) { + return 0.0; + } + for (unsigned char chr : buffer) { if (chr < kCharFreqVectorLen) { buffer_freqs[chr] += 1.0 / buffer_size; @@ -249,3 +251,4 @@ bool WindowsEventLogPublisher::shouldFire(const SCRef& subscription, return (subscription->channel_list.count(lowercase_channel) > 0U); } } // namespace osquery + From e46d6898747a654b8710365f0c3d6e7963b5ffb1 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 05:20:47 +0000 Subject: [PATCH 22/40] fix(adhoc-sweep-fixes): 58 review findings across 40 files --- osquery/sql/sqlite_operations.cpp | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/osquery/sql/sqlite_operations.cpp b/osquery/sql/sqlite_operations.cpp index 33689f7695f..9086a866c5b 100644 --- a/osquery/sql/sqlite_operations.cpp +++ b/osquery/sql/sqlite_operations.cpp @@ -56,13 +56,15 @@ static void executeCarve(sqlite3_context* ctx) { if (!FLAGS_carver_disable_function) { std::string new_carve_guid; carvePaths(kFunctionCarvePaths, createCarveGuid(), new_carve_guid); + std::string message = std::string("Carve Started: " + new_carve_guid); sqlite3_result_text(ctx, - std::string("Carve Started: " + new_carve_guid).c_str(), - 13, + message.c_str(), + static_cast(message.size()), SQLITE_TRANSIENT); } else { + std::string message = "Carve Failed: function disabled"; sqlite3_result_text( - ctx, "Carve Failed: function disabled", 13, SQLITE_TRANSIENT); + ctx, message.c_str(), static_cast(message.size()), SQLITE_TRANSIENT); } kFunctionCarvePaths.clear(); } @@ -97,3 +99,4 @@ void registerOperationExtensions(sqlite3* db) { db, "sleep", 1, SQLITE_UTF8, nullptr, sqlSleep, nullptr, nullptr); } } // namespace osquery + From 3c62da24a1042de54783204bfe4ef3d87752510d Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 05:20:48 +0000 Subject: [PATCH 23/40] fix(adhoc-sweep-fixes): 58 review findings across 40 files --- osquery/tables/system/system_utils.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/osquery/tables/system/system_utils.cpp b/osquery/tables/system/system_utils.cpp index 4f934caeb59..89ddb89efaf 100644 --- a/osquery/tables/system/system_utils.cpp +++ b/osquery/tables/system/system_utils.cpp @@ -37,7 +37,7 @@ QueryData pidsFromContext(const QueryContext& context, bool all) { context.iteritems("pid", EQUALS, ([&procs](const std::string& expr) { auto proc = SQL::selectAllFrom( "processes", "pid", EQUALS, expr); - procs.insert(procs.end(), procs.begin(), procs.end()); + procs.insert(procs.end(), proc.begin(), proc.end()); })); } else if (!all) { procs = SQL::selectAllFrom( From 20d960b69c1ddff89e46be02e6ec7ac152edb752 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 05:20:49 +0000 Subject: [PATCH 24/40] fix(adhoc-sweep-fixes): 58 review findings across 40 files --- osquery/events/tests/events_tests.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/osquery/events/tests/events_tests.cpp b/osquery/events/tests/events_tests.cpp index 0ca7007cd00..3b95c82cfdf 100644 --- a/osquery/events/tests/events_tests.cpp +++ b/osquery/events/tests/events_tests.cpp @@ -375,7 +375,7 @@ class FakeEventSubscriber : public EventSubscriber { explicit FakeEventSubscriber(bool skip_name) { if (!skip_name) { - FakeEventSubscriber(); + setName("fake_events"); } } From 920b1334ff058eaf3be5a0aeff5f23146f5505e8 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 05:20:50 +0000 Subject: [PATCH 25/40] fix(adhoc-sweep-fixes): 58 review findings across 40 files --- osquery/tables/system/windows/scheduled_tasks.cpp | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/osquery/tables/system/windows/scheduled_tasks.cpp b/osquery/tables/system/windows/scheduled_tasks.cpp index d17719ceacf..241446371af 100644 --- a/osquery/tables/system/windows/scheduled_tasks.cpp +++ b/osquery/tables/system/windows/scheduled_tasks.cpp @@ -110,10 +110,6 @@ void enumerateTasksForFolder(std::string path, QueryData& results) { r["path"] = ret == S_OK ? wstringToString(wTaskPath) : std::string(); ::SysFreeString(taskPath); - VARIANT_BOOL hidden = false; - pRegisteredTask->get_Enabled(&hidden); - r["hidden"] = hidden ? INTEGER(1) : INTEGER(0); - HRESULT lastTaskRun = E_FAIL; pRegisteredTask->get_LastTaskResult(&lastTaskRun); _com_error err(lastTaskRun); @@ -141,10 +137,18 @@ void enumerateTasksForFolder(std::string path, QueryData& results) { ITaskDefinition* taskDef = nullptr; IActionCollection* tActionCollection = nullptr; pRegisteredTask->get_Definition(&taskDef); + VARIANT_BOOL hidden = false; if (taskDef != nullptr) { + ITaskSettings* tSettings = nullptr; + taskDef->get_Settings(&tSettings); + if (tSettings != nullptr) { + tSettings->get_Hidden(&hidden); + tSettings->Release(); + } taskDef->get_Actions(&tActionCollection); taskDef->Release(); } + r["hidden"] = hidden ? INTEGER(1) : INTEGER(0); pRegisteredTask->Release(); long actionCount = 0; @@ -231,3 +235,4 @@ QueryData genScheduledTasks(QueryContext& context) { } } // namespace tables } // namespace osquery + From d3feee6e3841ffc7c72535246f56a61a389433bf Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 05:20:51 +0000 Subject: [PATCH 26/40] fix(adhoc-sweep-fixes): 58 review findings across 40 files --- osquery/core/plugins/logger.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/osquery/core/plugins/logger.h b/osquery/core/plugins/logger.h index a6e21d4c4c8..cebe86c0a5e 100644 --- a/osquery/core/plugins/logger.h +++ b/osquery/core/plugins/logger.h @@ -219,7 +219,7 @@ class LoggerPlugin : public Plugin { if (error_count != 0) { return Status::failure("logEventBatch has failed to log " + - std::to_string(error_count) + "events"); + std::to_string(error_count) + " events"); } return Status::success(); @@ -252,3 +252,4 @@ class LoggerPlugin : public Plugin { }; } // namespace osquery + From 8da901907e9f5a0819ddd98ca460338f8f3f17bc Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 05:20:52 +0000 Subject: [PATCH 27/40] fix(adhoc-sweep-fixes): 58 review findings across 40 files --- osquery/tables/applications/chrome/utils.cpp | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/osquery/tables/applications/chrome/utils.cpp b/osquery/tables/applications/chrome/utils.cpp index d68282dca83..3063bc5b9af 100644 --- a/osquery/tables/applications/chrome/utils.cpp +++ b/osquery/tables/applications/chrome/utils.cpp @@ -104,7 +104,7 @@ const std::unordered_map {ChromeBrowserType::Yandex, "yandex"}, {ChromeBrowserType::Opera, "opera"}, {ChromeBrowserType::Edge, "edge"}, - {ChromeBrowserType::Edge, "edge_beta"}, + {ChromeBrowserType::EdgeBeta, "edge_beta"}, {ChromeBrowserType::Vivaldi, "vivaldi"}, {ChromeBrowserType::Arc, "arc"}, }; @@ -1264,3 +1264,4 @@ ExpectedExtensionKey computeExtensionIdentifier( } // namespace tables } // namespace osquery + From 7808ddf5a44d9e8454b2021a741cb3d903da7616 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 05:20:53 +0000 Subject: [PATCH 28/40] fix(adhoc-sweep-fixes): 58 review findings across 40 files --- osquery/tables/system/cpuid.cpp | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/osquery/tables/system/cpuid.cpp b/osquery/tables/system/cpuid.cpp index 847ab6633a0..365932e2a36 100644 --- a/osquery/tables/system/cpuid.cpp +++ b/osquery/tables/system/cpuid.cpp @@ -143,7 +143,7 @@ inline Status genStrings(QueryData& results) { // Do the same to grab the optional hypervisor ID. cpuid(0x40000000, 0, regs); - if (regs[0] && 0xFF000000 != 0) { + if ((regs[0] & 0xFF000000) != 0) { std::stringstream hypervisor; hypervisor << std::hex << std::setw(8) << std::setfill('0') << static_cast(regs[0]); @@ -279,3 +279,4 @@ QueryData genCPUID(QueryContext& context) { } } // namespace tables } // namespace osquery + From a687fa7b557b1f7dba2d6ee0c1cbb8c135581cd4 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 05:20:54 +0000 Subject: [PATCH 29/40] fix(adhoc-sweep-fixes): 58 review findings across 40 files --- osquery/tables/system/darwin/sharing_preferences.cpp | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/osquery/tables/system/darwin/sharing_preferences.cpp b/osquery/tables/system/darwin/sharing_preferences.cpp index 5bc3ebd6422..41fe5417e84 100644 --- a/osquery/tables/system/darwin/sharing_preferences.cpp +++ b/osquery/tables/system/darwin/sharing_preferences.cpp @@ -172,7 +172,7 @@ int getBluetoothSharingStatus() { continue; } for (const auto& r : bluetoothSharingStatus) { - if (r.find("key") == row.end() || row.find("value") == r.end()) { + if (r.find("key") == r.end() || r.find("value") == r.end()) { continue; } if (r.at("key") == "PrefKeyServicesEnabled" && @@ -220,3 +220,4 @@ QueryData genSharingPreferences(QueryContext& context) { } // namespace tables } // namespace osquery + From f2bba78dabd2730d9bf1573a0313c4e8d32c3570 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 05:20:55 +0000 Subject: [PATCH 30/40] fix(adhoc-sweep-fixes): 58 review findings across 40 files --- osquery/system/usersgroups/windows/users_groups_cache.cpp | 1 + 1 file changed, 1 insertion(+) diff --git a/osquery/system/usersgroups/windows/users_groups_cache.cpp b/osquery/system/usersgroups/windows/users_groups_cache.cpp index 1362735558b..e18f1243b98 100644 --- a/osquery/system/usersgroups/windows/users_groups_cache.cpp +++ b/osquery/system/usersgroups/windows/users_groups_cache.cpp @@ -111,6 +111,7 @@ std::vector UsersCache::getAllUsers() const { } void GroupsCache::initializeCache(std::vector initial_groups) { + std::lock_guard lock(cache_mutex_); cached_groups_ = std::move(initial_groups); if (cached_groups_.size() > 0) { From 6e4950b9a3a9a7c2c8662b8cc1e51596b5a281e9 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 05:20:56 +0000 Subject: [PATCH 31/40] fix(adhoc-sweep-fixes): 58 review findings across 40 files --- osquery/tables/events/darwin/openbsm_events.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/osquery/tables/events/darwin/openbsm_events.cpp b/osquery/tables/events/darwin/openbsm_events.cpp index bfc061b2a51..5741862ee52 100644 --- a/osquery/tables/events/darwin/openbsm_events.cpp +++ b/osquery/tables/events/darwin/openbsm_events.cpp @@ -151,7 +151,7 @@ Status OpenBSMProcEvSubscriber::handleExec(const OpenBSMEventContextRef& ec) { r["egid"] = INTEGER(tok.tt.subj64.egid); r["uid"] = INTEGER(tok.tt.subj64.ruid); r["gid"] = INTEGER(tok.tt.subj64.rgid); - pid = tok.tt.subj32.pid; + pid = tok.tt.subj64.pid; break; case AUT_SUBJECT32_EX: OpenBSM_AUT_SUBJECT32_EX(r, tok); From 34255b1a93880088dfac037450e62ef340cc9f8b Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 05:20:57 +0000 Subject: [PATCH 32/40] fix(adhoc-sweep-fixes): 58 review findings across 40 files --- osquery/tables/system/linux/block_devices.cpp | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/osquery/tables/system/linux/block_devices.cpp b/osquery/tables/system/linux/block_devices.cpp index 13cd58d163b..3c8f45e41f3 100644 --- a/osquery/tables/system/linux/block_devices.cpp +++ b/osquery/tables/system/linux/block_devices.cpp @@ -97,14 +97,18 @@ static void getBlockDevice(struct udev_device* dev, subdev = udev_device_get_parent_with_subsystem_devtype(dev, "scsi", nullptr); if (subdev != nullptr) { const char *model = udev_device_get_sysattr_value(subdev, "model"); - std::string model_string = std::string(model); - boost::algorithm::trim(model_string); - r["model"] = model_string; + if (model != nullptr) { + std::string model_string = std::string(model); + boost::algorithm::trim(model_string); + r["model"] = model_string; + } model = udev_device_get_sysattr_value(subdev, "vendor"); - model_string = std::string(model); - boost::algorithm::trim(model_string); - r["vendor"] = model_string; + if (model != nullptr) { + std::string model_string = std::string(model); + boost::algorithm::trim(model_string); + r["vendor"] = model_string; + } } blkid_probe pr = blkid_new_probe_from_filename(name); From 6b0ca8b041f2b803213240912c7d6962cbfcd657 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 05:20:58 +0000 Subject: [PATCH 33/40] fix(adhoc-sweep-fixes): 58 review findings across 40 files --- tests/integration/tables/safari_extensions.cpp | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/tests/integration/tables/safari_extensions.cpp b/tests/integration/tables/safari_extensions.cpp index 201148d9e6e..e1b8ba458a5 100644 --- a/tests/integration/tables/safari_extensions.cpp +++ b/tests/integration/tables/safari_extensions.cpp @@ -23,8 +23,15 @@ class safariExtensions : public testing::Test { }; TEST_F(safariExtensions, test_sanity) { + // NOTE: This is currently a smoke-test-only stub. Full row validation is + // deferred because the presence and contents of Safari extensions are + // highly dependent on the specific test machine's user state (installed + // extensions vary per host and per CI runner), making a stable + // ValidationMap and size assertions impractical in this environment. + // At minimum, this confirms the query executes without error. // 1. Query data auto const data = execute_query("select * from safari_extensions"); + (void)data; // 2. Check size before validation // ASSERT_GE(data.size(), 0ul); // ASSERT_EQ(data.size(), 1ul); @@ -50,3 +57,4 @@ TEST_F(safariExtensions, test_sanity) { } // namespace table_tests } // namespace osquery + From 3022797114bf3174a0c50592e36508ca4656ed58 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 05:20:59 +0000 Subject: [PATCH 34/40] fix(adhoc-sweep-fixes): 58 review findings across 40 files --- tools/codegen/gentable.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/codegen/gentable.py b/tools/codegen/gentable.py index 7e2b622d92b..dc6239eca61 100644 --- a/tools/codegen/gentable.py +++ b/tools/codegen/gentable.py @@ -240,7 +240,7 @@ def generate(self, path, template="default"): column_options.append("ColumnOptions::" + COLUMN_OPTIONS[option]) all_options.append(COLUMN_OPTIONS[option]) else: - print(yellow( + print(lightred( "Table %s column %s contains an unknown option: %s" % ( self.table_name, column.name, option))) column.options_set = " | ".join(column_options) From 810fc417239c5632cfc1a4671e0bdf4d195aa5cf Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 05:21:00 +0000 Subject: [PATCH 35/40] fix(adhoc-sweep-fixes): 58 review findings across 40 files --- osquery/profiler/windows/code_profiler.cpp | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/osquery/profiler/windows/code_profiler.cpp b/osquery/profiler/windows/code_profiler.cpp index 77e2c71f458..b88a7ca9a77 100644 --- a/osquery/profiler/windows/code_profiler.cpp +++ b/osquery/profiler/windows/code_profiler.cpp @@ -51,6 +51,7 @@ CodeProfiler::~CodeProfiler() { code_profiler_data_end.getWallTime() - code_profiler_data_->getWallTime()); - record(names_, ".time.wall.millis", query_duration.count()); + record(names_, "time.wall.millis", query_duration.count()); } } // namespace osquery + From c551568af72d638ccb1db49cb1a5809a4bcd188c Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 05:21:01 +0000 Subject: [PATCH 36/40] fix(adhoc-sweep-fixes): 58 review findings across 40 files --- osquery/tables/networking/darwin/routes.cpp | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/osquery/tables/networking/darwin/routes.cpp b/osquery/tables/networking/darwin/routes.cpp index 9e8e3b4d21b..2c27c9d4cd3 100644 --- a/osquery/tables/networking/darwin/routes.cpp +++ b/osquery/tables/networking/darwin/routes.cpp @@ -119,7 +119,7 @@ Status genArp(const struct rt_msghdr *route, // The cache will always know the address. r["address"] = ipAsString(addr_map[RTAX_DST]); - auto sdl = (struct sockaddr_dl *)addr_map[RTA_DST]; + auto sdl = (struct sockaddr_dl *)addr_map[RTAX_DST]; if (sdl->sdl_alen > 0) { r["mac"] = macAsString(LLADDR(sdl)); } else { @@ -220,3 +220,4 @@ QueryData genRoutes(QueryContext &context) { } } } + From de74453ac229c72d8a3e7c009ee19ee9643e665f Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 05:21:02 +0000 Subject: [PATCH 37/40] fix(adhoc-sweep-fixes): 58 review findings across 40 files --- osquery/tables/system/darwin/gatekeeper.cpp | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/osquery/tables/system/darwin/gatekeeper.cpp b/osquery/tables/system/darwin/gatekeeper.cpp index 716928b04fe..9a0c0658d8d 100644 --- a/osquery/tables/system/darwin/gatekeeper.cpp +++ b/osquery/tables/system/darwin/gatekeeper.cpp @@ -172,6 +172,14 @@ QueryData genGateKeeperApprovedApps(QueryContext& context) { "label is NULL"; sqlite3_stmt* stmt = nullptr; rc = sqlite3_prepare_v2(db, query.c_str(), -1, &stmt, nullptr); + if (rc != SQLITE_OK || stmt == nullptr) { + if (stmt != nullptr) { + sqlite3_finalize(stmt); + } + sqlite3_close(db); + return results; + } + while ((sqlite3_step(stmt)) == SQLITE_ROW) { Row r; genGateKeeperApprovedAppRow(stmt, r); @@ -186,3 +194,4 @@ QueryData genGateKeeperApprovedApps(QueryContext& context) { } } // namespace tables } // namespace osquery + From 4413fda8b1eb270f5ef5e943568f33bdb394d875 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 05:21:03 +0000 Subject: [PATCH 38/40] fix(adhoc-sweep-fixes): 58 review findings across 40 files --- osquery/tables/system/darwin/nvram.cpp | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/osquery/tables/system/darwin/nvram.cpp b/osquery/tables/system/darwin/nvram.cpp index d46ab82b073..b79992c0d8d 100644 --- a/osquery/tables/system/darwin/nvram.cpp +++ b/osquery/tables/system/darwin/nvram.cpp @@ -130,7 +130,7 @@ QueryData genNVRAM(QueryContext& context) { genSingleVariable(options, key, results); })); } else { - CFMutableDictionaryRef options_dict; + CFMutableDictionaryRef options_dict = nullptr; kr = IORegistryEntryCreateCFProperties( options, &options_dict, kCFAllocatorDefault, 0); if (kr != KERN_SUCCESS) { @@ -140,7 +140,9 @@ QueryData genNVRAM(QueryContext& context) { } // Cleanup (registry entry context). - CFRelease(options_dict); + if (options_dict != nullptr) { + CFRelease(options_dict); + } } IOObjectRelease(options); @@ -148,3 +150,4 @@ QueryData genNVRAM(QueryContext& context) { } } } + From 8f5e1b4a603db0611a199ef71ae31e22a99d0ac5 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 05:21:04 +0000 Subject: [PATCH 39/40] fix(adhoc-sweep-fixes): 58 review findings across 40 files --- osquery/tables/system/windows/security_profile_info_utils.cpp | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/osquery/tables/system/windows/security_profile_info_utils.cpp b/osquery/tables/system/windows/security_profile_info_utils.cpp index cb4adb294d3..bc3738d15ca 100644 --- a/osquery/tables/system/windows/security_profile_info_utils.cpp +++ b/osquery/tables/system/windows/security_profile_info_utils.cpp @@ -114,7 +114,7 @@ Status SceClientHelper::isValidSceProfileData(const PVOID& profileData) { } // Checking that input pointer points to an accessible SceProfileInfo layout - if (IsBadReadPtr(&profileData, sizeof(SceProfileInfo))) { + if (IsBadReadPtr(profileData, sizeof(SceProfileInfo))) { return Status::failure("profileData layout is invalid."); } @@ -245,3 +245,4 @@ int SceProfileData::getNormalizedInt(const DWORD& input) { } // namespace tables } // namespace osquery + From 66bf5af5cc313816359edc3020f10a46f2a1c947 Mon Sep 17 00:00:00 2001 From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 05:21:05 +0000 Subject: [PATCH 40/40] fix(adhoc-sweep-fixes): 58 review findings across 40 files --- osquery/events/linux/bpf/filesystem.cpp | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/osquery/events/linux/bpf/filesystem.cpp b/osquery/events/linux/bpf/filesystem.cpp index dab3a77606f..e1ef24a8cfe 100644 --- a/osquery/events/linux/bpf/filesystem.cpp +++ b/osquery/events/linux/bpf/filesystem.cpp @@ -125,16 +125,16 @@ bool Filesystem::enumFiles(int dirfd, EnumFilesCallback callback) const { continue; } - bool directory; + bool is_directory; if (entry->d_type == DT_DIR) { - directory = true; + is_directory = true; } else if (entry->d_type == DT_LNK || entry->d_type == DT_REG) { - directory = false; + is_directory = false; } else { continue; } - callback(string_fd, directory); + callback(string_fd, is_directory); } return true; @@ -171,3 +171,4 @@ Status IFilesystem::create(Ref& obj) { } } // namespace osquery +