Skip to content

fix(OSQUERY-002): 3 review findings across 2 files #41

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
flamingo wants to merge 2 commits into
base: master
Choose a base branch
from
+10 −5
Draft

fix(OSQUERY-002): 3 review findings across 2 files #41

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
9b18b2d
fix(OSQUERY-002): 3 review findings across 2 files
flamingo[bot] Aug 24, 2026
c998b1f
fix(OSQUERY-002): 3 review findings across 2 files
flamingo[bot] Aug 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 6 additions & 3 deletions osquery/tables/system/windows/logged_in_users.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,10 @@
#include <osquery/utils/conversions/windows/windows_time.h>
#include <osquery/utils/system/windows/users_groups_helpers.h>

namespace osquery {
namespace tables {

namespace {
const std::map<int, std::string> kSessionStates = {
{WTSActive, "active"},
{WTSDisconnected, "disconnected"},

@flamingo flamingo Bot Aug 24, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🦩 🟠 logged_in_users.cpp declares kSessionStates at global (non-osquery) namespace scope

Moved the kSessionStates const std::map definition from global namespace scope into an anonymous namespace nested inside namespace osquery { namespace tables { ... } }, placed immediately before genLoggedInUsers. This resolves the global-scope pollution flagged in the finding while preserving usage at kSessionStates.at(pSessionInfo[i].State) inside genLoggedInUsers, which still resolves correctly via namespace lookup.

🤖 Prompt for AI agents 
In osquery/tables/system/windows/logged_in_users.cpp around line 26, review and complete this code-review fix: logged_in_users.cpp declares kSessionStates at global (non-osquery) namespace scope.
What the draft fix changed: Moved the `kSessionStates` const std::map definition from global namespace scope into an anonymous namespace nested inside `namespace osquery { namespace tables { ... } }`, placed immediately before `genLoggedInUsers`. This resolves the global-scope pollution flagged in the finding while preserving usage at `kSessionStates.at(pSessionInfo[i].State)` inside `genLoggedInUsers`, which still resolves correctly via namespace lookup.
Verify the change is correct and complete; do not refactor unrelated code.

fix confidence: 🟢 90 high — react 👍/👎 to teach the reviewer

Expand All @@ -32,9 +36,7 @@ const std::map<int, std::string> kSessionStates = {
{WTSReset, "reset"},
{WTSDown, "down"},
{WTSInit, "init"}};

namespace osquery {
namespace tables {
} // namespace

QueryData genLoggedInUsers(QueryContext& context) {
QueryData results;
Expand Down Expand Up @@ -179,3 +181,4 @@ QueryData genLoggedInUsers(QueryContext& context) {
}
} // namespace tables
} // namespace osquery

6 changes: 4 additions & 2 deletions osquery/utils/windows/shellitem.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,8 @@
#include <string>
#include <vector>

@flamingo flamingo Bot Aug 24, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🦩 🔴 Global constant arrays kNetworkShareIds and kPropertySets declared outside the osquery namespace

Moved kNetworkShareIds and kPropertySets declarations from file/global scope to inside the namespace osquery { ... } block (placed immediately after the opening brace, before guidParse). No other code was altered; all downstream usages (networkShareItem, propertyStore) remain valid since they are already within the same namespace block.

🤖 Prompt for AI agents 
In osquery/utils/windows/shellitem.cpp around line 21, review and complete this code-review fix: Global constant arrays kNetworkShareIds and kPropertySets declared outside the osquery namespace.
What the draft fix changed: Moved `kNetworkShareIds` and `kPropertySets` declarations from file/global scope to inside the `namespace osquery { ... }` block (placed immediately after the opening brace, before `guidParse`). No other code was altered; all downstream usages (`networkShareItem`, `propertyStore`) remain valid since they are already within the same namespace block.
Verify the change is correct and complete; do not refactor unrelated code.

fix confidence: 🟢 92 high — react 👍/👎 to teach the reviewer

@flamingo flamingo Bot Aug 24, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🦩 🟠 File-scope constant arrays in shellitem.cpp do not use the required kPascalCase naming for one array

Same relocation as above resolves the leaking-into-global-namespace concern; the array names already use kPascalCase, so no renaming was needed—only the scope was corrected by moving both declarations inside namespace osquery.

🤖 Prompt for AI agents 
In osquery/utils/windows/shellitem.cpp around line 21, review and complete this code-review fix: File-scope constant arrays in shellitem.cpp do not use the required kPascalCase naming for one array.
What the draft fix changed: Same relocation as above resolves the leaking-into-global-namespace concern; the array names already use kPascalCase, so no renaming was needed—only the scope was corrected by moving both declarations inside `namespace osquery`.
Verify the change is correct and complete; do not refactor unrelated code.

fix confidence: 🟢 90 high — react 👍/👎 to teach the reviewer

namespace osquery {

const std::string kNetworkShareIds[6] = {"41", "42", "46", "47", "4C", "C3"};

// Property set GUIDs associated with name entries
Expand All @@ -37,7 +39,7 @@ const std::string kPropertySets[15] = {"000214A1-0000-0000-C000-000000000046",
"D5CDD505-2E9C-101B-9397-08002B2CF9AE",
"EF6B490D-5CD8-437A-AFFC-DA8B60EE4A3C",
"F29F85E0-4FF9-1068-AB91-08002B27B3D9"};
namespace osquery {

std::string guidParse(const std::string& guid_little) {
std::vector<std::string> guids;
guids.push_back(guid_little.substr(0, 8));
Expand Down Expand Up @@ -487,4 +489,4 @@ std::string mtpRoot(const std::string& shell_data) {
}
return name;
}
} // namespace osquery
} // namespace osquery