osquery-node icon indicating copy to clipboard operation
osquery-node copied to clipboard

Only TEXT (strings) are supported

Open Downchuck opened this issue 10 years ago • 5 comments

When sending a response, all value types must be a string or writeString will fail: (this is using { "foo": 2 } having changed the schema to be "INTEGER"):

Error: writeString called without a string/Buffer argument: 2
    at TBinaryProtocol.writeString (/Users/chuck/Desktop/swamp/node_modules/osquery/node_modules/thrift/lib/thrift/protocol.js:149:11)
    at Object.ExtensionResponse.write (/Users/chuck/Desktop/swamp/node_modules/osquery/gen-nodejs/osquery_types.js:381:20)
    at Object.Extension_call_result.write (/Users/chuck/Desktop/swamp/node_modules/osquery/gen-nodejs/Extension.js:251:18)
    at /Users/chuck/Desktop/swamp/node_modules/osquery/gen-nodejs/Extension.js:434:14
    at /Users/chuck/Desktop/swamp/node_modules/osquery/extension_server.js:42:7
    at generateTable (/Users/chuck/Desktop/swamp/osquery.js:63:3)
    at /Users/chuck/Desktop/swamp/osquery.js:17:3

Downchuck avatar Aug 25 '15 19:08 Downchuck

could you post a full example? I guess simple solution on my side would be .toString() on values

sidorares avatar Aug 26 '15 00:08 sidorares

Simple solution works, of course.

Example is simple as:

var generateTable = function(req, resp) {
  resp(null, [{
        "foo": 1,
        "bar": "bar value " + Date.now()
      }]
  );
};

From the code:

TBinaryProtocol.prototype.writeString = function(arg) {
  if (typeof(arg) === 'string') {
    this.writeI32(Buffer.byteLength(arg, 'utf8'));
    this.trans.write(arg, 'utf8');
  } else if (arg instanceof Buffer) {
    this.writeI32(arg.length);
    this.trans.write(arg);
  } else {
    throw new Error('writeString called without a string/Buffer argument: ' + arg);
  }
};

Downchuck avatar Aug 26 '15 00:08 Downchuck

looks like it must be text: https://github.com/facebook/osquery/blob/master/osquery.thrift#L5

sidorares avatar Aug 26 '15 01:08 sidorares

You're correct -- they're supposed to be cast: "we need to cast the ints as strings to comply with the type definition of the Row object." https://osquery.readthedocs.org/en/stable/development/creating-tables/

Seems that calling toString is what's intended. I'm (mildly) curious as to whether values should be cast into primitives (by the affinity value) when doing a select. Has the usual danger of losing data for BIGINT.

Downchuck avatar Aug 26 '15 15:08 Downchuck

yes, official C++ examples do exactly the same . I'll add automatic conversion to string

sidorares avatar Aug 27 '15 00:08 sidorares