From cfbc9d8829c7ec02eda4e9e68148dcd239da9184 Mon Sep 17 00:00:00 2001 From: Jordan Montgomery Date: Fri, 26 Sep 2025 15:22:45 -0400 Subject: [PATCH] Fix osquery detection of vscode extensions (#33523) **Related issue:** Resolves #33520 Recent changes to the users query accidentally introduced an ambiguous column error with the vscode extensions query. Fixed the SELECT statement in vscode_extensions to properly account for this No changes file added since this is an unreleased bug and the feature has a changes file # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements) - [x] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes ## Testing No automated tests in this area so no tests to update/add - [x] Added/updated automated tests - [x] Where appropriate, [automated tests simulate multiple hosts and test for host isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing) (updates to one hosts's records do not affect another) - [x] QA'd all new/changed functionality manually For unreleased bug fixes in a release candidate, one of: - [x] Confirmed that the fix is not expected to adversely impact load test results --- .../orchestration/understanding-host-vitals.md | 2 +- server/service/osquery_utils/queries.go | 8 +++++--- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/docs/Contributing/product-groups/orchestration/understanding-host-vitals.md b/docs/Contributing/product-groups/orchestration/understanding-host-vitals.md index 8865984e46..766a5cda8c 100644 --- a/docs/Contributing/product-groups/orchestration/understanding-host-vitals.md +++ b/docs/Contributing/product-groups/orchestration/understanding-host-vitals.md @@ -944,7 +944,7 @@ SELECT name, version, '' AS bundle_identifier, - uuid AS extension_id, + vscode_extensions.uuid AS extension_id, '' AS browser, 'vscode_extensions' AS source, publisher AS vendor, diff --git a/server/service/osquery_utils/queries.go b/server/service/osquery_utils/queries.go index 5ff8e8ac7d..57982bbbb5 100644 --- a/server/service/osquery_utils/queries.go +++ b/server/service/osquery_utils/queries.go @@ -979,7 +979,7 @@ SELECT name, version, '' AS bundle_identifier, - uuid AS extension_id, + vscode_extensions.uuid AS extension_id, '' AS browser, 'vscode_extensions' AS source, publisher AS vendor, @@ -1815,8 +1815,10 @@ const ( archKernelName = `^linux(?:-(?:lts|zen|hardened))?$` ) -var kernelRegex = regexp.MustCompile(linuxImageRegex) -var archKernelRegex = regexp.MustCompile(archKernelName) +var ( + kernelRegex = regexp.MustCompile(linuxImageRegex) + archKernelRegex = regexp.MustCompile(archKernelName) +) func directIngestSoftware(ctx context.Context, logger log.Logger, host *fleet.Host, ds fleet.Datastore, rows []map[string]string) error { var software []fleet.Software