kolide/launcher

`kolide_system_profiler` should not support an all option

Closed this issue · 4 comments

Chatting with some coworkers, I learned that SELECT * FROM kolide_system_profiler where datatype like "%" works. But it returns so much data it crashes Terminal.app and probably has a bunch of gnarly load.

I think we should disable it. We should require a reasonable argument for datatype

// If the constraint is the magic "%", it's eqivlent to an `all` style

You can find all valid datatypes by running system_profiler -listDataTypes. We should restrict the allowed values for datatype to one in that list.

@directionless do we also want to set a limit on the max number of datatypes that can be specified in one query?

The intent here is to prevent someone from trivially running something that would effectively hang launcher. Preventing all should have that effect.

I don't know that we need to pre-determine the list of allowed values -- I don't see much harm in letting someone pass a bad data type. (these also vary by macOS release)

I'm ambivalent about putting a max length there. I guess it's reasonable, someday someone will try won't they. Maybe 3?

Issue requirements:

  • Disallow passing % as datatype
  • Do now allow more than 3 datatypes in a query