file: Add Shortcut metadata parsing on Windows

- Add 6 new columns to the file table on Windows, to display Shortcut metadata (.lnk files), and specifically the shortcut_target_path, shortcut_target_type, shortcut_target_location, shortcut_start_in, shortcut_run, shortcut_comment columns. - Fix a small bug in the file integration test, where a comma was forgotten, and instead of creating and testing querying two files, the concatentation of both was tested - Added logic to the integration test to create shortcuts to the created files, and test their content. - Fix the expandConstraints function so that it can be const, since it's not supposed to modify the context.
osquery · Smjert · Nov 28, 2023 · Sep 8, 2023 · Nov 1, 2023 · Nov 21, 2023
commit 21263558fbd771d09af0357813d6f83fe329ef88
@@ -561,14 +561,20 @@ Status QueryContext::expandConstraints(
     ConstraintOperator op,
     std::set<std::string>& output,
     std::function<Status(const std::string& constraint,
-                         std::set<std::string>& output)> predicate) {
-  for (const auto& constraint : constraints[column].getAll(op)) {
+                         std::set<std::string>& output)> predicate) const {
+  auto constraint_it = constraints.find(column);
+
+  if (constraint_it == constraints.end()) {
+    return Status::success();
+  }
+
+  for (const auto& constraint : constraint_it->second.getAll(op)) {
     auto status = predicate(constraint, output);
     if (!status) {
       return status;
     }
   }
-  return Status(0);
+  return Status::success();
 }
 
 Status deserializeQueryContextJSON(const JSON& json_helper,

@@ -567,7 +567,7 @@ struct QueryContext {
       ConstraintOperator op,
       std::set<std::string>& output,
       std::function<Status(const std::string& constraint,
-                           std::set<std::string>& output)> predicate);
+                           std::set<std::string>& output)> predicate) const;
 
   /// Check if the given column is used by the query
   bool isColumnUsed(const std::string& colName) const;