google_chrome_profiles: add path column #60
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
There is currently no column that can be used to link rows returned by the _google_chrome_profiles_ table with the rows returned by the OSQuery built-in _chrome_extensions_ table. This is useful for determining the email, and therefore the Google Account, associated with the profile, which can be used as a proxy for whether the profile is a work or non-work one. This PR adds a _path_ column to the _google_chrome_profiles_ table. This is the path to the profile's directory, and should match _profile_path_ column in the _chrome_extensions_ table, allowing these two tables to be joined together. It does this by pulling out the profile's directory name from the same dictionary used to get the existing data, combines it with the Chrome user data directory path, and finally checks that it exists before returning it. It is therefore possible for this column to be empty, if for whatever reason, the computed path does not exist. ``` osquery> select * from google_chrome_profiles; +----------+------------------------+------------------+-----------+-----------------------------------------------------------------+ | username | email | name | ephemeral | path | +----------+------------------------+------------------+-----------+-----------------------------------------------------------------+ | user1 | [email protected] | test.example.com | 0 | /Users/user/Library/Application Support/Google/Chrome/Default | | user2 | [email protected] | example.com | 0 | /Users/user/Library/Application Support/Google/Chrome/Profile 1 | +----------+------------------------+------------------+-----------+-----------------------------------------------------------------+ ```
grahamgilbert
requested changes
Jan 16, 2025
| }) | ||
| } | ||
|
|
||
| return results, nil | ||
| } | ||
|
|
||
| func profilePathIfExists(localStatePath, profileDir string) string { |
There was a problem hiding this comment.
Please write a unit test for this function
| @@ -61,6 +61,12 @@ func TestGenerateForPath(t *testing.T) { | |||
| // Create a temporary directory for testing | |||
| tempDir := t.TempDir() | |||
|
|
|||
| // Create a dummy directory for one of the profiles - the name is the | |||
There was a problem hiding this comment.
Please use more inclusive language here. Placeholder is a decent alternative here.
| localStateDir := filepath.Dir(localStatePath) | ||
| profilePath := filepath.Join(localStateDir, profileDir) | ||
| if _, err := os.Stat(profilePath); err != nil { | ||
| // If there's an error of any kind, assume the profile path doesn't |
There was a problem hiding this comment.
Perhaps it would be better to handle the specific not found error and surface other errors?
There was a problem hiding this comment.
I've propagated the error up to the generateForPath function, but I've noticed that GoogleChromeProfilesGenerate currently ignores all errors returned from all of the functions it calls.
If we surface the errors returned from my changes, I think we should also surface the other possible errors from the functions called. But this would be a change in how this table works, from never returning errors in any scenario, to returning errors in some scenarios.
Thoughts?
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There is currently no column that can be used to link rows returned by the google_chrome_profiles table with the rows returned by the OSQuery built-in chrome_extensions table. This is useful for determining the email, and therefore the Google Account, associated with the profile the extension is installed in, which can be used as a proxy for whether the extension was installed in a work or non-work profile.
This PR adds a path column to the google_chrome_profiles table. This is the path to the profile's directory, and should match profile_path column in the chrome_extensions table, allowing these two tables to be joined together. It does this by pulling out the profile's directory name from the same dictionary used to get the existing data, combines it with the Chrome user data directory path, and finally checks that it exists before returning it. It is possible for this column to be empty, if for whatever reason, the computed path does not exist.