You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The context passed to table plugins' generate() methods is a JSON encoding of a JSON encoding of the data that the plugin actually cares about. If you want to access the actual context data structure then you need to use something like:
context=json.loads(json.loads(context))
While this issue has been in the code for at least six years, it's pretty clear from the source that this was not the original intention and is in fact a bug. Lines 41-43 of table_plugin.py read:
The underlying Thrift call context includes the table generation context as a string which contains the JSON-encoded details. The original author sets up a dictionary to pass to the generation function, then checks to see if a context was provided and, if present, replaces this with the JSON string encoding of the already-encoded context. It would make vastly more sense, and also be vastly more convenient for the user, to decode the context string value into another dictionary instead and thus for this to read:
ctx=json.loads(context["context"])
This is almost certainly what the author intended and the current state is a typo. Hopefully this can still be fixed.
The text was updated successfully, but these errors were encountered:
nickovs
added a commit
to nickovs/osquery-python
that referenced
this issue
Feb 5, 2021
The
context
passed to table plugins'generate()
methods is a JSON encoding of a JSON encoding of the data that the plugin actually cares about. If you want to access the actual context data structure then you need to use something like:While this issue has been in the code for at least six years, it's pretty clear from the source that this was not the original intention and is in fact a bug. Lines 41-43 of
table_plugin.py
read:The underlying Thrift call context includes the table generation context as a string which contains the JSON-encoded details. The original author sets up a dictionary to pass to the generation function, then checks to see if a context was provided and, if present, replaces this with the JSON string encoding of the already-encoded context. It would make vastly more sense, and also be vastly more convenient for the user, to decode the context string value into another dictionary instead and thus for this to read:
This is almost certainly what the author intended and the current state is a typo. Hopefully this can still be fixed.
The text was updated successfully, but these errors were encountered: