Elgato_dark/fleet
1
0
Fork 0
mirror of https://github.com/fleetdm/fleet synced 2026-05-22 00:18:27 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 139

Include browser extensions in software inventory (#3733)

Browse source 
Use appropriate JOINs against users table to include all results.

For #3557
This commit is contained in:
Zach Wasserman 2022-01-18 12:46:04 -08:00 committed by GitHub
parent 1782fc7b8f
commit 6232bfa1d6
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 38 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
changes/issue-3557-browser-extensions Normal file
View file

@ -0,0 +1 @@
* Include Chrome and Firefox extensions in software inventory.

44
server/service/osquery_utils/queries.go
View file

@ -305,7 +305,13 @@ FROM logical_drives WHERE file_system = 'NTFS' LIMIT 1;`,
}
var softwareMacOS = DetailQuery{
// Note that we create the cached_users CTE (the WITH clause) in order to suggest to SQLite
// that it generates the users once instead of once for each UNIONed query. We use CROSS JOIN to
// ensure that the nested loops in the query generation are ordered correctly for the _extensions
// tables that need a uid parameter. CROSS JOIN ensures that SQLite does not reorder the loop
// nesting, which is important as described in https://youtu.be/hcn3HIcHAAo?t=77.
Query: `
WITH cached_users AS (SELECT * FROM users)
SELECT
name AS name,
bundle_short_version AS version,
@ -328,7 +334,7 @@ SELECT
'Browser plugin (Chrome)' AS type,
'' AS bundle_identifier,
'chrome_extensions' AS source
FROM chrome_extensions
FROM cached_users CROSS JOIN chrome_extensions USING (uid)
UNION
SELECT
name AS name,
@ -336,7 +342,7 @@ SELECT
'Browser plugin (Firefox)' AS type,
'' AS bundle_identifier,
'firefox_addons' AS source
FROM firefox_addons
FROM cached_users CROSS JOIN firefox_addons USING (uid)
UNION
SELECT
name As name,
@ -344,7 +350,15 @@ SELECT
'Browser plugin (Safari)' AS type,
'' AS bundle_identifier,
'safari_extensions' AS source
FROM safari_extensions
FROM cached_users CROSS JOIN safari_extensions USING (uid)
UNION
SELECT
name AS name,
version AS version,
'Package (Atom)' AS type,
'' AS bundle_identifier,
'atom_packages' AS source
FROM cached_users CROSS JOIN atom_packages USING (uid)
UNION
SELECT
name AS name,
@ -360,6 +374,7 @@ FROM homebrew_packages;
var softwareLinux = DetailQuery{
Query: `
WITH cached_users AS (SELECT * FROM users)
SELECT
name AS name,
version AS version,
@ -388,12 +403,26 @@ SELECT
'npm_packages' AS source
FROM npm_packages
UNION
SELECT
name AS name,
version AS version,
'Browser plugin (Chrome)' AS type,
'chrome_extensions' AS source
FROM cached_users CROSS JOIN chrome_extensions USING (uid)
UNION
SELECT
name AS name,
version AS version,
'Browser plugin (Firefox)' AS type,
'firefox_addons' AS source
FROM cached_users CROSS JOIN firefox_addons USING (uid)
UNION
SELECT
name AS name,
version AS version,
'Package (Atom)' AS type,
'atom_packages' AS source
FROM atom_packages
FROM users CROSS JOIN atom_packages USING (uid)
UNION
SELECT
name AS name,
@ -408,6 +437,7 @@ FROM python_packages;
var softwareWindows = DetailQuery{
Query: `
WITH cached_users AS (SELECT * FROM users)
SELECT
name AS name,
version AS version,
@ -434,14 +464,14 @@ SELECT
version AS version,
'Browser plugin (Chrome)' AS type,
'chrome_extensions' AS source
FROM chrome_extensions
FROM cached_users CROSS JOIN chrome_extensions USING (uid)
UNION
SELECT
name AS name,
version AS version,
'Browser plugin (Firefox)' AS type,
'firefox_addons' AS source
FROM firefox_addons
FROM cached_users CROSS JOIN firefox_addons USING (uid)
UNION
SELECT
name AS name,
@ -455,7 +485,7 @@ SELECT
version AS version,
'Package (Atom)' AS type,
'atom_packages' AS source
FROM atom_packages
FROM cached_users CROSS JOIN atom_packages USING (uid)
UNION
SELECT
name AS name,