From fe24ff1d670117f4ea9f95b239f1f27664484270 Mon Sep 17 00:00:00 2001 From: Victor Lyuboslavsky <2685025+getvictor@users.noreply.github.com> Date: Tue, 10 Feb 2026 13:03:23 -0600 Subject: [PATCH] Fixed a bug where certain macOS app names could be ingested as empty strings due to incorrect ".app" suffix removal. (#39563) **Related issue:** Resolves #34620 # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. ## Testing - [x] QA'd all new/changed functionality manually ## Summary by CodeRabbit ## Bug Fixes * Fixed an issue where macOS app names could become empty after removing the ".app" extension. The app name extraction logic now correctly handles edge cases, ensuring app names are properly ingested without empty values. --- changes/34620-trim-app-fix | 1 + .../product-groups/orchestration/understanding-host-vitals.md | 4 +++- server/service/osquery_utils/queries.go | 4 +++- 3 files changed, 7 insertions(+), 2 deletions(-) create mode 100644 changes/34620-trim-app-fix diff --git a/changes/34620-trim-app-fix b/changes/34620-trim-app-fix new file mode 100644 index 0000000000..2e3c5ae29c --- /dev/null +++ b/changes/34620-trim-app-fix @@ -0,0 +1 @@ +Fixed a bug where certain macOS app names could be ingested as empty strings due to incorrect ".app" suffix removal. diff --git a/docs/Contributing/product-groups/orchestration/understanding-host-vitals.md b/docs/Contributing/product-groups/orchestration/understanding-host-vitals.md index 0773b5e338..17641e86c4 100644 --- a/docs/Contributing/product-groups/orchestration/understanding-host-vitals.md +++ b/docs/Contributing/product-groups/orchestration/understanding-host-vitals.md @@ -805,7 +805,9 @@ WITH cached_users AS (WITH cached_groups AS (select * from groups) FROM users LEFT JOIN cached_groups USING (gid) WHERE type <> 'special' AND shell NOT LIKE '%/false' AND shell NOT LIKE '%/nologin' AND shell NOT LIKE '%/shutdown' AND shell NOT LIKE '%/halt' AND username NOT LIKE '%$' AND username NOT LIKE '\_%' ESCAPE '\' AND NOT (username = 'sync' AND shell ='/bin/sync' AND directory <> '')) SELECT - COALESCE(NULLIF(display_name, ''), NULLIF(bundle_name, ''), NULLIF(NULLIF(bundle_executable, ''), 'run.sh'), TRIM(name, '.app') ) AS name, + COALESCE(NULLIF(display_name, ''), NULLIF(bundle_name, ''), NULLIF(NULLIF(bundle_executable, ''), 'run.sh'), + CASE WHEN name IS NOT NULL AND lower(name) LIKE '%.app' THEN substr(name, 1, length(name) - 4) ELSE name END + ) AS name, COALESCE(NULLIF(bundle_short_version, ''), bundle_version) AS version, bundle_identifier AS bundle_identifier, '' AS extension_id, diff --git a/server/service/osquery_utils/queries.go b/server/service/osquery_utils/queries.go index 584a505d55..e221758c95 100644 --- a/server/service/osquery_utils/queries.go +++ b/server/service/osquery_utils/queries.go @@ -974,7 +974,9 @@ var softwareMacOS = DetailQuery{ // which is used in vulnerability scanning. Query: withCachedUsers(`WITH cached_users AS (%s) SELECT - COALESCE(NULLIF(display_name, ''), NULLIF(bundle_name, ''), NULLIF(NULLIF(bundle_executable, ''), 'run.sh'), TRIM(name, '.app') ) AS name, + COALESCE(NULLIF(display_name, ''), NULLIF(bundle_name, ''), NULLIF(NULLIF(bundle_executable, ''), 'run.sh'), + CASE WHEN name IS NOT NULL AND lower(name) LIKE '%%.app' THEN substr(name, 1, length(name) - 4) ELSE name END + ) AS name, COALESCE(NULLIF(bundle_short_version, ''), bundle_version) AS version, bundle_identifier AS bundle_identifier, '' AS extension_id,