Hi All I m facing an issue hopefully you can help me with wh

Question

Hi All I m facing an issue hopefully you can help me with when running a query with case sensitive on OSquery version 4 9 0 it returns this error but it worked on the version 4 5 1 previously ```osquery gt PRAGMA case sensitive like=1 lt Query gt E0817 04 50 29 635751 8504 sqlite util cpp 295 Authorizer denied action 19 case sensitive like 1 null null Error not authorized```

seph · Answer

At some point we started blocking PRAGMA commands that are not in an explicit allowlist It seems reasonable to add it Would you open a github issue for that

seph · Answer

As a worker around you can probably use `GLOB but I m not sure it s a 1 1 replacement

Ahmed · Answer

sure thanks a lot for clarifying this to me i ll create an issue there if you have an example of `GLOB` that would be great i ll try to research that

Ahmed · Answer

Unlike the `LIKE` operator the `GLOB` operator is case sensitive and uses the UNIX wildcards In addition the `GLOB` patterns do not have escape characters <https www sqlitetutorial net sqlite glob >

seph · Answer

`select a GLOB A ` for example

Ahmed · Answer

yes its case sensitive which not what i was looking for ```osquery gt select a GLOB A + + | a GLOB A | + + | 0 | + + osquery gt select a GLOB a + + | a GLOB a | + + | 1 | + +```

seph · Answer

Er wait You said `case sensitive like=1 ` which is setting case sensitivity LIKE defaults to insensitive

seph · Answer

I think it s reasonable to add this to the allowlist happy to review a PR or issue for it

seph · Answer

But tactically sqlite looks kinda weird `LIKE` defaults to case insensitive and needs that pragma to become case sensitive Most other comparators default to case sensitive and you can use `COLLATE NOCASE` to make them insensitive I m not sure what you re looking for though

Ahmed · Answer

sorry yes that what i was looking for it seems i lost my track of thoughts for a second smile i will add an issue anyway and send it to you and i will use GLOB in my case for now thanks a lot Seph

seph · Answer

Great Glad there s a workaround Yeah I keep getting confused by them too

Ahmed · Answer

here is the issue <https github com osquery osquery issues 7266>