osquery / osquery/osquery

Extensions don't seem to get constraints that are not `==`

Open
#6,734 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug extensions
Dominant language
C++
Stars
23.6k
Forks
2.6k
Avg merge
6d 7h
Merged PRs (30d)
14

Description

I'm not sure if this is expected or not, but it appears that extensions do not get the constraints for operators that are not ==. I see this on both osquery-go, and osquery-python. In both the current 4.5.1, and 3.3.2.

I've tested this using some simple pp dump statements in test extensions.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

No file or test is named. Start by reproducing the behavior with the mentioned pp dump statements in test extensions for osquery-go and osquery-python, comparing == with other operators; done means the constraint behavior is understood and the issue is fixed or confirmed as expected.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp, go, python, sql
Domain
api, operating-systems
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.