Coverage Report

Created: 2025-09-08 08:01

/src/osquery/plugins/config/parsers/events_parser.cpp
Line
Count
Source (jump to first uncovered line)
1
/**
2
 * Copyright (c) 2014-present, The osquery authors
3
 *
4
 * This source code is licensed as defined by the LICENSE file found in the
5
 * root directory of this source tree.
6
 *
7
 * SPDX-License-Identifier: (Apache-2.0 OR GPL-2.0-only)
8
 */
9
10
#include <osquery/config/config.h>
11
#include <osquery/registry/registry_factory.h>
12
13
namespace osquery {
14
15
/**
16
 * @brief A simple ConfigParserPlugin for an "events" dictionary key.
17
 */
18
class EventsConfigParserPlugin : public ConfigParserPlugin {
19
 public:
20
64.6k
  std::vector<std::string> keys() const override {
21
64.6k
    return {"events"};
22
64.6k
  }
23
24
  Status setUp() override;
25
26
  Status update(const std::string& source, const ParserConfig& config) override;
27
};
28
29
0
Status EventsConfigParserPlugin::setUp() {
30
0
  auto obj = data_.getObject();
31
0
  data_.add("events", obj);
32
0
  return Status();
33
0
}
34
35
Status EventsConfigParserPlugin::update(const std::string& source,
36
64.6k
                                        const ParserConfig& config) {
37
64.6k
  auto events = config.find("events");
38
64.6k
  if (events != config.end()) {
39
336
    auto doc = JSON::newObject();
40
336
    auto obj = doc.getObject();
41
336
    doc.copyFrom(events->second.doc(), obj);
42
336
    doc.add("events", obj);
43
336
    data_ = std::move(doc);
44
336
  }
45
64.6k
  return Status();
46
64.6k
}
47
48
REGISTER_INTERNAL(EventsConfigParserPlugin, "config_parser", "events");
49
}