https://github.com/osquery/osquery logo
#fleet
Title
# fleet
m

Mystery Incorporated

08/11/2021, 8:48 AM
Hi,
SELECT * FROM startup_items;
seems to get the split of executable path/args wrong, see it has split at the first space in Program Files" and is listing path and binary in arguments, this is incorrect.
Added image with the table headings for reference
m

Martavis Parker

08/11/2021, 5:07 PM
Thanks for reporting this. Does it seem to split incorrectly consistently, or only for some?
m

Mystery Incorporated

08/12/2021, 6:18 AM
@Martavis Parker it doesn't like the space in "Program Files" so it is incorrectly splitting the string based on that space, it should not do that.
I don't have any paths with a space outside of Program Files in startup to test, but as a dev, to me, logic would suggest that any path with a space in it will do the same thing.
m

Martavis Parker

08/12/2021, 3:51 PM
That makes complete sense. I'll file an issue for it on our end. Thanks!
👍 1
z

zwass

08/16/2021, 1:38 AM
I investigated this and it seems it may be an osquery bug: https://github.com/fleetdm/fleet/issues/1657
3 Views