Title
#fleet
Mystery Incorporated

Mystery Incorporated

08/11/2021, 8:48 AM
Hi,
SELECT * FROM startup_items;
seems to get the split of executable path/args wrong, see it has split at the first space in Program Files" and is listing path and binary in arguments, this is incorrect.
8:50 AM
8:51 AM
Added image with the table headings for reference
Martavis Parker

Martavis Parker

08/11/2021, 5:07 PM
Thanks for reporting this. Does it seem to split incorrectly consistently, or only for some?
Mystery Incorporated

Mystery Incorporated

08/12/2021, 6:18 AM
@Martavis Parker it doesn't like the space in "Program Files" so it is incorrectly splitting the string based on that space, it should not do that.
6:19 AM
I don't have any paths with a space outside of Program Files in startup to test, but as a dev, to me, logic would suggest that any path with a space in it will do the same thing.
Martavis Parker

Martavis Parker

08/12/2021, 3:51 PM
That makes complete sense. I'll file an issue for it on our end. Thanks!
zwass

zwass

08/16/2021, 1:38 AM
I investigated this and it seems it may be an osquery bug: https://github.com/fleetdm/fleet/issues/1657