Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Support for "matches" and "js" keys from "content_scripts" in the chrome_extensions table #6140

Merged
merged 3 commits into from
Feb 21, 2020
Merged

Support for "matches" and "js" keys from "content_scripts" in the chrome_extensions table #6140

merged 3 commits into from
Feb 21, 2020

Conversation

rachelcipkins
Copy link
Contributor

Content scripts are able to pass information to the extensions from web pages that the browser visits. Matches specify which of these pages the content scripts will be allowed to access. This PR adds support for matches and scripts to the chrome_extensions table.

Example:

osquery> SELECT uid, name, identifier, version, script, match
    ...> FROM chrome_extensions
    ...> WHERE match = "http://*/" OR
    ...>       match = "https://*/";
+------+----------+----------------------------------+----------+------------+------------+
| uid  | name     | identifier                       | version  | script     | match      |
+------+----------+----------------------------------+----------+------------+------------+
| 1000 | JSONView | chklaanhfefbnpoihckbnefhakgolnmc | 0.0.32.3 | content.js | http://*/  |
| 1000 | JSONView | chklaanhfefbnpoihckbnefhakgolnmc | 0.0.32.3 | content.js | https://*/ |
+------+----------+----------------------------------+----------+------------+------------+

theopolis
theopolis reviewed Jan 1, 2020
View reviewed changes
osquery/tables/applications/browser_utils.cpp Outdated
const std::vector<std::vector<std::string>> matches_list =
genContentScriptDetail(kMatchesKey, tree);

for (int i = 0; i < script_list.size(); i++) {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd like to test this implementation locally but I think we should explore an alternative. Instead of having the existing table with duplicated rows we should introduce a new table that reports these matches. Then a user can join them together.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, I agree. I'll roll this implementation into a new table. It looks like the Chrome extension ID is a decent candidate for joins.

@Smjert Smjert added the feature label Jan 2, 2020
@woodruffw woodruffw force-pushed the rachel/feature/content-scripts-matches branch from da23681 to aa121dd Compare January 2, 2020 21:47
@woodruffw
Copy link
Contributor

Okay, I've refactored the features in this PR into a new table: chrome_extension_content_scripts. This table deduplicates pairs of script, match for each pair of identifier, version, where identifier and version are also present (potentially multiple times, if multiple profiles have the same extension installed) in chrome_extensions.

Example:

osquery> select * from chrome_extension_content_scripts;
+----------------------------------+----------+----------------------------------+-------------+
| identifier                       | version  | script                           | match       |
+----------------------------------+----------+----------------------------------+-------------+
| aomjjhallfgjeglblehebfpbcfeobpgk | 4.7.5.90 | injected.min.js                  | http://*/*  |
| aomjjhallfgjeglblehebfpbcfeobpgk | 4.7.5.90 | injected.min.js                  | https://*/* |
+----------------------------------+----------+----------------------------------+-------------+

@Smjert
Copy link
Member

Smjert commented Jan 3, 2020

The failure is unrelated to this PR, it's test_osqueryd.py and the relative python framework that needs a heavy refactor.
I've kicked again the build.

@woodruffw woodruffw force-pushed the rachel/feature/content-scripts-matches branch 2 times, most recently from d6b0209 to d854e73 Compare January 6, 2020 18:21
@theopolis
Copy link
Member

Is this ready for review?

@woodruffw
Copy link
Contributor

Is this ready for review?

Yep!

theopolis
theopolis requested changes Jan 16, 2020
View reviewed changes
Copy link
Member

@theopolis theopolis left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe consider a different approach to genChromeBasedExtensionContentScripts and have it expect a path to an extension. You'll then avoid enumerating users and extensions twice as I assume folks will always want to join this table against chrome_extensions?

If that is not the case then perhaps path is still a good option if someone does join, you can optimize the search to only parse that extension.

specs/chrome_extension_content_scripts.table Show resolved Hide resolved
specs/chrome_extensions.table Outdated
@@ -16,6 +16,8 @@ schema([
Column("path", TEXT, "Path to extension folder"),
Column("permissions", TEXT, "The permissions required by the extension"),
Column("optional_permissions", TEXT, "The permissions optionally required by the extensions"),
Column("script", TEXT, "The content script used by the extensions"),
Column("match", TEXT, "The URL associated with the content script."),
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nitpick, inconsistent punctuation

@theopolis
Copy link
Member

I can provide an example of what I mean if that helps, just LMK!

@woodruffw
Copy link
Contributor

I can provide an example of what I mean if that helps, just LMK!

Yes, that would be greatly appreciated 😄

@woodruffw woodruffw force-pushed the rachel/feature/content-scripts-matches branch from d854e73 to f4aa5bb Compare February 5, 2020 20:43
@woodruffw woodruffw force-pushed the rachel/feature/content-scripts-matches branch from c270f96 to 07791ef Compare February 20, 2020 22:29
@theopolis theopolis merged commit 3de799e into osquery:master Feb 21, 2020
@mike-myers-tob mike-myers-tob deleted the rachel/feature/content-scripts-matches branch March 5, 2021 00:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@woodruffw woodruffw woodruffw left review comments

@theopolis theopolis theopolis approved these changes

Assignees
No one assigned
Labels
feature virtual tables
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
5 participants
@rachelcipkins @woodruffw @Smjert @theopolis @mike-myers-tob