Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add new table vscode_extensions #8150

Merged
merged 10 commits into from
Dec 20, 2023
Merged

Conversation

KavetiRohith
Copy link
Contributor

@KavetiRohith KavetiRohith commented Oct 5, 2023

To submit a PR please make sure to follow the next steps:

  • Read the CONTRIBUTING.md guide at the root of the repo.
  • Ensure the code is formatted building the format_check target.
    If it is not, then move the committed files to the git staging area,
    build the format target to format them, and then re-commit.
    More information is available on the wiki.
  • Ensure your PR contains a single logical change.
  • Ensure your PR contains tests for the changes you're submitting.
  • Describe your changes with as much detail as you can.
  • Link any issues this PR is related to.
    Add new table vscode_extensions. #8138

@KavetiRohith KavetiRohith requested review from a team as code owners October 5, 2023 04:39
@linux-foundation-easycla
Copy link

linux-foundation-easycla bot commented Oct 5, 2023

CLA Signed

The committers listed above are authorized under a signed CLA.

Copy link
Member

@Smjert Smjert left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hello @KavetiRohith, thank for looking into this.
I did a first quick pass; beyond the comments, please use snake_case for variable names.

osquery/tables/applications/vscode_extensions.cpp Outdated Show resolved Hide resolved
osquery/tables/applications/vscode_extensions.cpp Outdated Show resolved Hide resolved
@Smjert Smjert linked an issue Oct 5, 2023 that may be closed by this pull request
Copy link
Member

@zwass zwass left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Tested working nicely on my system. Some minor feedback.

osquery/tables/applications/vscode_extensions.cpp Outdated Show resolved Hide resolved
osquery/tables/applications/vscode_extensions.cpp Outdated Show resolved Hide resolved
specs/vscode_extensions.table Show resolved Hide resolved
@KavetiRohith KavetiRohith requested review from Smjert and zwass October 31, 2023 18:49
Copy link
Member

@zwass zwass left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think once we sort out the consistency issue with prerelease this is good to merge. Thanks!

specs/vscode_extensions.table Show resolved Hide resolved
table_name("vscode_extensions")
description("Lists all vscode extensions.")
schema([
Column("id", TEXT, "Extension id"),
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Interesting that this is the id. Elsewhere in vscode, this data is the name. But 🤷

I think it'd be good to include the uuid as well.

Copy link
Member

@zwass zwass Nov 3, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There seem to be a few identifiers. This is referred to in the JSON as id (and sort of identifier) but in the UI as identifier
Screenshot 2023-11-03 at 9 13 21 AM

  {
    "identifier": {
      "id": "ms-python.python",
      "uuid": "f1f59ae4-9318-4f3c-a9b5-81b2eaa5f8a5"
    },
    "version": "2023.20.0",
    "location": {
      "$mid": 1,
      "fsPath": "/Users/zwass/.vscode/extensions/ms-python.python-2023.20.0",
      "external": "file:///Users/zwass/.vscode/extensions/ms-python.python-2023.20.0",
      "path": "/Users/zwass/.vscode/extensions/ms-python.python-2023.20.0",
      "scheme": "file"
    },
    "relativeLocation": "ms-python.python-2023.20.0",
    "metadata": {
      "id": "f1f59ae4-9318-4f3c-a9b5-81b2eaa5f8a5",
      "publisherId": "998b010b-e2af-44a5-a6cd-0b5fd3b9b6f8",
      "publisherDisplayName": "Microsoft",
      "targetPlatform": "undefined",
      "isApplicationScoped": false,
      "updated": true,
      "isPreReleaseVersion": false,
      "installedTimestamp": 1698970500850,
      "preRelease": false
    }
  }

I think it might make sense to call it identifier?

There is also a friendly name. Not sure what that is referred to in the UI, and it's not available directly in the extensions.json (though it is available in the individual packages in that directory).
Screenshot 2023-11-03 at 9 15 15 AM

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Depends which json. It looks like it's id in .extensions.json but name in foo/package.json. Similarly, uuid vs __metadata.id.

Given the internal inconsistency, I think we should just pick id/uuid or name/id. As long as they're both exposed I think we'll be okay

specs/vscode_extensions.table Show resolved Hide resolved
zwass
zwass previously approved these changes Nov 10, 2023
Copy link
Member

@zwass zwass left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you for your efforts! Looks good to me now.

@zwass
Copy link
Member

zwass commented Nov 10, 2023

I approved this but then noticed merge conflicts (which I pushed a commit to resolve). I think someone else will now need to add an approval to get it merged.

Copy link
Member

@Smjert Smjert left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There's only one thing that doesn't convince me completely, and it's the getStringValuefromRjObject function used to parse every field.
I would expect those fields to have a specific type and not change; and if they do, we want to know.

Shouldn't we only parse if the type is what we expect?

@zwass
Copy link
Member

zwass commented Dec 4, 2023

I don't feel strongly either way, but my instinct is we should render what's in the json file regardless of whether it matches the type we expect. Possibly different versions of vscode could end up using different types?

@Smjert
Copy link
Member

Smjert commented Dec 4, 2023

I don't feel strongly either way, but my instinct is we should render what's in the json file regardless of whether it matches the type we expect. Possibly different versions of vscode could end up using different types?

Note that this is already an issue for the schema as written, since it assumes that prerelease, uid, and installed_at are integers. If the type changes that would cause type errors when our SQL logic attempts to convert the string value to integer.

@zwass
Copy link
Member

zwass commented Dec 19, 2023

@Smjert I just pushed changes that use the expected types when reading the values (and also eliminates the helper function to try to make things a little more obvious).

@zwass zwass requested a review from Smjert December 19, 2023 20:05
Smjert
Smjert previously requested changes Dec 20, 2023
Copy link
Member

@Smjert Smjert left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The test is not running on Windows; since the table is supported on all platforms, lets move the vscode_extensions.cpp file to line 34 in tests/integration/tables/CMakeLists.txt

@zwass zwass requested a review from Smjert December 20, 2023 20:38
@Smjert
Copy link
Member

Smjert commented Dec 20, 2023

Forgot that tests that test tables that need to access users and groups data need to explicitly start the service to collect them on Windows. I've updated.

Copy link
Member

@zwass zwass left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. Thank you @KavetiRohith for the initial work and @Smjert for helping get it across the finish line!

@zwass zwass dismissed Smjert’s stale review December 20, 2023 21:57

addressed comments

@zwass zwass merged commit c396d07 into osquery:master Dec 20, 2023
16 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Add new table vscode_extensions.
4 participants