Update the browser_firefox table to exclude "Crash Reports" and "Pe…

…nding Pings" folders (osquery#8478)
Smjert · Dec 30, 2024 · 6a8a7f7 · 6a8a7f7
1 parent 6c4bafd
commit 6a8a7f7
Showing 1 changed file with 12 additions and 0 deletions.
diff --git a/osquery/tables/applications/browser_firefox.cpp b/osquery/tables/applications/browser_firefox.cpp
@@ -9,6 +9,7 @@
 
 #include <optional>
 
+#include <boost/algorithm/string/predicate.hpp>
 #include <boost/property_tree/json_parser.hpp>
 
 #include <osquery/core/tables.h>
@@ -195,6 +196,17 @@ QueryData genFirefoxAddons(QueryContext& context) {
         }
       }
 
+      // Do not list Crash Reports and Pending Pings folders as profiles
+      profiles.erase(std::remove_if(profiles.begin(),
+                                    profiles.end(),
+                                    [](const std::string& s) {
+                                      return boost::algorithm::ends_with(
+                                                 s, "Crash Reports") ||
+                                             boost::algorithm::ends_with(
+                                                 s, "Pending Pings");
+                                    }),
+                     profiles.end());
+
       // Generate an addons list from their extensions JSON.
       for (const auto& profile : profiles) {
         genFirefoxAddonsFromExtensions(row.at("uid"), profile, results);