seph
locale
, replaced by default_locale
and current_locale
. That seems fine, though I don’t really understand it. I would have assumed an array there. but 🤷theopolis
np5
02/10/2021, 6:56 PMEvgeny Sidorov
02/26/2021, 3:37 PMpuffycid
03/23/2021, 1:00 PMtheopolis
puffycid
06/04/2021, 1:25 AMpuffycid
06/23/2021, 7:50 PMpuffycid
07/25/2021, 5:50 AMRobin Powell
10/04/2021, 9:53 PMpuffycid
10/20/2021, 11:55 PMalessandrogario
Mayur Shingote
12/25/2021, 1:14 AMPeijun Zhu
04/21/2022, 6:29 AMDaniel Bretón Suárez
04/21/2022, 1:45 PMJoe Sweeney
04/28/2022, 5:32 PMMike Myers
05/02/2022, 6:31 PMseph
seph
Mike Myers
06/01/2022, 4:19 PMkernel_panics
is not that big, but generating kernel panic logs is annoying so I've attached sample files so the reviewer can test or just check how they look. https://github.com/osquery/osquery/pull/7585Daniel Bretón Suárez
06/02/2022, 7:56 AMnp5
06/28/2022, 3:44 PMnp5
06/28/2022, 3:44 PMnp5
06/28/2022, 4:24 PMLucas Rodriguez
08/02/2022, 10:00 PMAndre Pinter
08/29/2022, 6:22 PMdiff --git a/osquery/tables/forensic/carves.cpp b/osquery/tables/forensic/carves.cpp
index 1fcdb25af..80929ad13 100644
--- a/osquery/tables/forensic/carves.cpp
+++ b/osquery/tables/forensic/carves.cpp
@@ -53,8 +53,10 @@ void enumerateCarves(QueryData& results, const std::string& new_guid) {
r["time"] = INTEGER(tree.doc()["time"].GetUint64());
}
- if (tree.doc().HasMember("size")) {
+ if (tree.doc().HasMember("size") && tree.doc()["size"].IsInt()) {
r["size"] = INTEGER(tree.doc()["size"].GetInt());
+ } else if (tree.doc().HasMember("size") && tree.doc()["size"].IsString()) {
+ r["size"] = INTEGER(tree.doc()["size"].GetString());
}
stringToRow("sha256", r, tree);
From reading more of the codebase and the database code it seems like there's some friction where the update functions only take strings and then it seems its up to casts elsewhere in the codebase to turn them into the right typesMike Myers
08/30/2022, 5:50 AMMike Myers
08/30/2022, 5:52 AMLucas Rodriguez
09/06/2022, 10:37 PMMike Myers
09/16/2022, 4:44 PM