Skip to content

fix(OSQUERY-008): 3 review findings across 3 files #46

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
flamingo wants to merge 3 commits into
base: master
Choose a base branch
from
+23 −20
Draft

fix(OSQUERY-008): 3 review findings across 3 files #46

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
8b0a3a1
fix(OSQUERY-008): 3 review findings across 3 files
flamingo[bot] Aug 24, 2026
1d44dc1
fix(OSQUERY-008): 3 review findings across 3 files
flamingo[bot] Aug 24, 2026
c8a9abf
fix(OSQUERY-008): 3 review findings across 3 files
flamingo[bot] Aug 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions osquery/tables/events/linux/seccomp_events.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,14 +42,14 @@ class SeccompEventSubscriber final
: public EventSubscriber<AuditEventPublisher> {
/// Mapping from seccomp action codes from seccomp.h to seccomp action names

@flamingo flamingo Bot Aug 24, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🦩 🟠 SeccompEventSubscriber static maps use snake_case instead of the required kPascalCase constant naming

Renamed the three static const class members in SeccompEventSubscriber (declared in osquery/tables/events/linux/seccomp_events.h) from snake_case to kPascalCase: seccomp_actions_map -> kSeccompActionsMap, arch_codes_map -> kArchCodesMap, syscall_x86_64_map -> kSyscallX8664Map. This is a header-only change; the corresponding definitions in seccomp_events.cpp (not visible here) must be updated to match these new names or the build will fail to link/compile, so this fix is incomplete without a corresponding change to the .cpp file.

🤖 Prompt for AI agents 
In osquery/tables/events/linux/seccomp_events.h around line 43, review and complete this code-review fix: SeccompEventSubscriber static maps use snake_case instead of the required kPascalCase constant naming.
What the draft fix changed: Renamed the three static const class members in `SeccompEventSubscriber` (declared in `osquery/tables/events/linux/seccomp_events.h`) from snake_case to kPascalCase: `seccomp_actions_map` -> `kSeccompActionsMap`, `arch_codes_map` -> `kArchCodesMap`, `syscall_x86_64_map` -> `kSyscallX8664Map`. This is a header-only change; the corresponding definitions in `seccomp_events.cpp` (not visible here) must be updated to match these new names or the build will fail to link/compile, so this fix is incomplete without a corresponding change to the .cpp file.
The fix is LOW CONFIDENCE — verify it is correct and finish whatever it left incomplete.

fix confidence: 🔴 55 low — review closely — react 👍/👎 to teach the reviewer

static const std::unordered_map<std::uint64_t, std::string>
seccomp_actions_map;
kSeccompActionsMap;

/// Mapping from architecture codes from audit.h to architecture names
static const std::unordered_map<std::uint64_t, std::string> arch_codes_map;
static const std::unordered_map<std::uint64_t, std::string> kArchCodesMap;

/// Mapping from system call numbers to system call names for x86_64
static const std::unordered_map<std::uint64_t, std::string>
syscall_x86_64_map;
kSyscallX8664Map;

static void parseEvent(const AuditEvent& event, Row& parsed_event) noexcept;

Expand Down
31 changes: 16 additions & 15 deletions osquery/tables/system/windows/windows_search.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,27 +35,27 @@
namespace osquery {
namespace tables {

@flamingo flamingo Bot Aug 24, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🦩 🟠 windowsSearchTableName constant does not follow kPascalCase naming convention

Renamed the file-scope constant windowsSearchTableName to kWindowsSearchTableName at its declaration, and updated every use site throughout the file (in dateToUnixTime, writePropVariant, executeWindowsSearchQuery, generateSqlFromUserQuery, and genWindowsSearch) to reference the new name, satisfying the kPascalCase naming convention (OSQUERY-008) with no other behavioral changes.

🤖 Prompt for AI agents 
In osquery/tables/system/windows/windows_search.cpp around line 37, review and complete this code-review fix: windowsSearchTableName constant does not follow kPascalCase naming convention.
What the draft fix changed: Renamed the file-scope constant `windowsSearchTableName` to `kWindowsSearchTableName` at its declaration, and updated every use site throughout the file (in `dateToUnixTime`, `writePropVariant`, `executeWindowsSearchQuery`, `generateSqlFromUserQuery`, and `genWindowsSearch`) to reference the new name, satisfying the kPascalCase naming convention (OSQUERY-008) with no other behavioral changes.
Verify the change is correct and complete; do not refactor unrelated code.

fix confidence: 🟢 95 high — react 👍/👎 to teach the reviewer

const std::string windowsSearchTableName = "windows_search";
const std::string kWindowsSearchTableName = "windows_search";

LONGLONG dateToUnixTime(const DATE date) {
SYSTEMTIME st = {0};
FILETIME ft = {0};

if (!VariantTimeToSystemTime(date, &st)) {
LOG(ERROR) << windowsSearchTableName
LOG(ERROR) << kWindowsSearchTableName
<< ": failed to convert date to system time";
return 0;
}

if (!SystemTimeToFileTime(&st, &ft)) {
LOG(ERROR) << windowsSearchTableName
LOG(ERROR) << kWindowsSearchTableName
<< ": failed to convert system time to file time";
return 0;
}

LONGLONG unixtime = filetimeToUnixtime(ft);
if (unixtime == 0) {
LOG(ERROR) << windowsSearchTableName
LOG(ERROR) << kWindowsSearchTableName
<< ": failed to convert file time to unix time";
return 0;
}
Expand All @@ -72,7 +72,7 @@ void writePropVariant(REFPROPVARIANT variant, std::wstringstream& wss) {
SafeArrayAccessData(variant.parray, reinterpret_cast<void**>(&pBStr));

if (FAILED(hr)) {
LOG(ERROR) << windowsSearchTableName << ": SafeArrayAccessData failed";
LOG(ERROR) << kWindowsSearchTableName << ": SafeArrayAccessData failed";
return;
}

Expand Down Expand Up @@ -220,7 +220,7 @@ osquery::QueryData executeWindowsSearchQuery(CSession& cSession,
hr = cCommand.Open(cSession, query.c_str());

if (FAILED(hr)) {
LOG(ERROR) << windowsSearchTableName << ": error executing query";
LOG(ERROR) << kWindowsSearchTableName << ": error executing query";
return results;
}

Expand Down Expand Up @@ -256,7 +256,7 @@ std::string generateSqlFromUserQuery(const std::string& userInput,
CLSCTX_LOCAL_SERVER,
IID_PPV_ARGS(&pSearchManager));
if (FAILED(hr)) {
LOG(ERROR) << windowsSearchTableName
LOG(ERROR) << kWindowsSearchTableName
<< ": failed to create ISearchManager instance";
return "";
}
Expand All @@ -269,7 +269,7 @@ std::string generateSqlFromUserQuery(const std::string& userInput,
// the ISearchCatalogManager
hr = pSearchManager->GetCatalog(L"SystemIndex", &pSearchCatalogManager);
if (FAILED(hr)) {
LOG(ERROR) << windowsSearchTableName << ": failed to get catalog manager";
LOG(ERROR) << kWindowsSearchTableName << ": failed to get catalog manager";
return "";
}
auto const pSearchCatalogManagerGuard = scope_guard::create(
Expand All @@ -280,15 +280,15 @@ std::string generateSqlFromUserQuery(const std::string& userInput,
ISearchQueryHelper* pQueryHelper = nullptr;
hr = pSearchCatalogManager->GetQueryHelper(&pQueryHelper);
if (FAILED(hr)) {
LOG(ERROR) << windowsSearchTableName << ": failed to get query helper";
LOG(ERROR) << kWindowsSearchTableName << ": failed to get query helper";
return "";
}
auto const pQueryHelperGuard =
scope_guard::create([pQueryHelper]() { pQueryHelper->Release(); });

hr = pQueryHelper->put_QueryMaxResults(maxResults);
if (FAILED(hr)) {
LOG(ERROR) << windowsSearchTableName << ": failed to set max results";
LOG(ERROR) << kWindowsSearchTableName << ": failed to set max results";
return "";
}

Expand All @@ -309,15 +309,15 @@ std::string generateSqlFromUserQuery(const std::string& userInput,
hr = pQueryHelper->put_QuerySelectColumns(
stringToWstring(selectColumns).c_str());
if (FAILED(hr)) {
LOG(ERROR) << windowsSearchTableName << ": failed to set columns";
LOG(ERROR) << kWindowsSearchTableName << ": failed to set columns";
return "";
}
}

if (!sort.empty()) {
hr = pQueryHelper->put_QuerySorting(stringToWstring(sort).c_str());
if (FAILED(hr)) {
LOG(ERROR) << windowsSearchTableName << ": failed to set sort";
LOG(ERROR) << kWindowsSearchTableName << ": failed to set sort";
return "";
}
}
Expand All @@ -326,7 +326,7 @@ std::string generateSqlFromUserQuery(const std::string& userInput,
hr = pQueryHelper->GenerateSQLFromUserQuery(
stringToWstring(userInput).c_str(), &sql);
if (FAILED(hr)) {
LOG(ERROR) << windowsSearchTableName
LOG(ERROR) << kWindowsSearchTableName
<< ": failed to generate SQL from user query";
return "";
}
Expand All @@ -347,7 +347,7 @@ QueryData genWindowsSearch(QueryContext& context) {
L"provider=Search.CollatorDSO.1;EXTENDED "
L"PROPERTIES=\"Application=Windows\"");
if (FAILED(hr)) {
LOG(ERROR) << windowsSearchTableName << ": error initializing CDataSource";
LOG(ERROR) << kWindowsSearchTableName << ": error initializing CDataSource";
return results;
}
auto const cDataSourceGuard =
Expand All @@ -356,7 +356,7 @@ QueryData genWindowsSearch(QueryContext& context) {
CSession cSession;
hr = cSession.Open(cDataSource);
if (FAILED(hr)) {
LOG(ERROR) << windowsSearchTableName << ": error opening CSession";
LOG(ERROR) << kWindowsSearchTableName << ": error opening CSession";
return results;
}
auto const cSessionGuard =
Expand Down Expand Up @@ -476,3 +476,4 @@ QueryData genWindowsSearch(QueryContext& context) {

} // namespace tables
} // namespace osquery

6 changes: 4 additions & 2 deletions osquery/utils/system/windows/errno.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,16 +10,17 @@
#include <osquery/utils/system/errno.h>

#include <string.h>

@flamingo flamingo Bot Aug 24, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🦩 🟠 kInitialBufferSize and kEnvironmentExpansionMax declared with auto instead of explicit constexpr type but otherwise fine; MAX_BUFFER_SIZE macro violates k-prefix constant convention

Replaced #define MAX_BUFFER_SIZE 256 with constexpr std::size_t kMaxBufferSize = 256; at file scope (outside the osquery namespace, matching the macro's prior placement) in osquery/utils/system/windows/errno.cpp, added #include <cstddef> for std::size_t, and updated the sole usage site in platformStrerr() (buffer.assign(MAX_BUFFER_SIZE, '\0') → buffer.assign(kMaxBufferSize, '\0')) to reference the new constant.

🤖 Prompt for AI agents 
In osquery/utils/system/windows/errno.cpp around line 12, review and complete this code-review fix: kInitialBufferSize and kEnvironmentExpansionMax declared with `auto` instead of explicit constexpr type but otherwise fine; MAX_BUFFER_SIZE macro violates k-prefix constant convention.
What the draft fix changed: Replaced `#define MAX_BUFFER_SIZE 256` with `constexpr std::size_t kMaxBufferSize = 256;` at file scope (outside the `osquery` namespace, matching the macro's prior placement) in `osquery/utils/system/windows/errno.cpp`, added `#include <cstddef>` for `std::size_t`, and updated the sole usage site in `platformStrerr()` (`buffer.assign(MAX_BUFFER_SIZE, '\0')` → `buffer.assign(kMaxBufferSize, '\0')`) to reference the new constant.
Verify the change is correct and complete; do not refactor unrelated code.

fix confidence: 🟡 85 medium — react 👍/👎 to teach the reviewer

#include <cstddef>
#include <vector>

#define MAX_BUFFER_SIZE 256
constexpr std::size_t kMaxBufferSize = 256;

namespace osquery {
const auto kWindowsLanguageId = MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT);

std::string platformStrerr(int errnum) {
std::vector<char> buffer;
buffer.assign(MAX_BUFFER_SIZE, '\0');
buffer.assign(kMaxBufferSize, '\0');

auto status = ::strerror_s(buffer.data(), buffer.size(), errnum);
if (status != 0) {
Expand Down Expand Up @@ -57,3 +58,4 @@ Status getWindowsErrorDescription(std::wstring& error_message, DWORD error_id) {
}

} // namespace osquery