fix(adhoc-sweep-fixes): CU-86akj32d7 40 review findings across 40 files

cmd/osquery-perf/osquery_perf/stats.go

@@ -273,10 +273,15 @@ func (s *Stats) Log() {
 	s.l.Lock()
 	defer s.l.Unlock()
 
+	var errorRate float64
+	if s.osqueryEnrollments > 0 {
+		errorRate = float64(s.errors) / float64(s.osqueryEnrollments)
+	}
+
 	log.Printf(
 		"uptime: %s, error rate: %.2f, osquery enrolls: %d, orbit enrolls: %d, mdm enrolls: %d, distributed/reads: %d, distributed/writes: %d, config requests: %d, result log requests: %d, mdm sessions initiated: %d, mdm on-demand syncs: %d, mdm commands received: %d, config errors: %d, distributed/read errors: %d, distributed/write errors: %d, log result errors: %d, orbit errors: %d, desktop errors: %d, mdm errors: %d, mdm scep requests: %d, mdm scep success: %d, mdm scep errors: %d, ddm tokens success: %d, ddm tokens errors: %d, ddm declaration items success: %d, ddm declaration items errors: %d, ddm activation success: %d, ddm activation errors: %d, ddm configuration success: %d, ddm configuration errors: %d, ddm status success: %d, ddm status errors: %d, buffered logs: %d, script execs (errs): %d (%d), software installs (errs): %d (%d)",
 		time.Since(s.StartTime).Round(time.Second),
-		float64(s.errors)/float64(s.osqueryEnrollments),
+		errorRate,
 		s.osqueryEnrollments,
 		s.orbitEnrollments,
 		s.mdmEnrollments,

ee/cis/macos-14/test/scripts/CIS_2.6.2.sh

@@ -1,21 +1,17 @@
 #!/bin/bash
 
-sudo /usr/bin/defaults write /Library/Application\
-Support/CrashReporter/DiagnosticMessagesHistory.plist AutoSubmit -bool false
+sudo /usr/bin/defaults write "/Library/Application Support/CrashReporter/DiagnosticMessagesHistory.plist" AutoSubmit -bool false
 
-sudo /usr/bin/defaults write /Library/Application\
-Support/CrashReporter/DiagnosticMessagesHistory.plist ThirdPartyDataSubmit -bool false
+sudo /usr/bin/defaults write "/Library/Application Support/CrashReporter/DiagnosticMessagesHistory.plist" ThirdPartyDataSubmit -bool false
 
-sudo /bin/chmod 644 /Library/Application\
-Support/CrashReporter/DiagnosticMessagesHistory.plist
+sudo /bin/chmod 644 "/Library/Application Support/CrashReporter/DiagnosticMessagesHistory.plist"
 
-sudo /usr/sbin/chgrp admin /Library/Application\
-Support/CrashReporter/DiagnosticMessagesHistory.plist
+sudo /usr/sbin/chgrp admin "/Library/Application Support/CrashReporter/DiagnosticMessagesHistory.plist"
 
 
 echo "This needs modification"
 sudo -u <username> /usr/bin/defaults write
 /Users/<username>/Library/Preferences/com.apple.assistant.support "Siri DataSharing Opt-In Status" -int 2
 
 # Example:
-# sudo -u sharonkatz /usr/bin/defaults write  /Users/sharonkatz/Library/Preferences/com.apple.assistant.support "Siri Data Sharing Opt-In Status" -int 2
+# sudo -u sharonkatz /usr/bin/defaults write  /Users/sharonkatz/Library/Preferences/com.apple.assistant.support "Siri Data Sharing Opt-In Status" -int 2

ee/fleetd-chrome/src/tables/os_version.ts

@@ -88,10 +88,6 @@ export default class TableOSVersion extends Table {
         column: "codename",
         error_message: err.message.toString(),
       });
-      warningsArray.push({
-        column: "platform_like",
-        error_message: err.message.toString(),
-      });
     }
 
     let arch;

ee/maintained-apps/ingesters/winget/external_refs/main.go

@@ -1,7 +1,7 @@
 package externalrefs
 
 import (
-	"fmt"
+	"log"
 
 	maintained_apps "github.com/fleetdm/fleet/v4/ee/maintained-apps"
 )
@@ -14,15 +14,18 @@ var Funcs = map[string][]func(*maintained_apps.FMAManifestApp) (*maintained_apps
 
 // EnrichManifest applies all registered enrichment functions for the given app.
 // Enrichers are looked up by app.Slug and run sequentially.
-// Errors are logged but do not stop the enrichment pipeline.
+// Errors are logged and stop the enrichment pipeline for that app, preserving
+// the last known-good app value.
 func EnrichManifest(app *maintained_apps.FMAManifestApp) {
 	if enrichers, ok := Funcs[app.Slug]; ok {
 		for _, enricher := range enrichers {
-			var err error
-			app, err = enricher(app)
+			enriched, err := enricher(app)
 			if err != nil {
-				fmt.Printf("Error enriching app %s: %v\n", app.UniqueIdentifier, err)
+				log.Printf("Error enriching app %s: %v\n", app.UniqueIdentifier, err)
+				break
 			}
+			app = enriched
 		}
 	}
 }
+

ee/maintained-apps/inputs/homebrew/scripts/cleanmymac-uninstall.sh

@@ -100,14 +100,18 @@ trash() {
   fi
 
   local trash="/Users/$logged_in_user/.Trash"
-  local file_name="$(basename "${target_file}")"
-
-  if [[ -e "$target_file" ]]; then
-    echo "removing $target_file."
-    mv -f "$target_file" "$trash/${file_name}_${timestamp}_${rand}"
-  else
-    echo "$target_file doesn't exist."
-  fi
+  local file_name
+
+  # Glob-expand target_file (compgen preserves spaces in the path; [[ -e "$x" ]] does not expand *)
+  while IFS= read -r expanded_file; do
+    if [[ -e "$expanded_file" ]]; then
+      file_name="$(basename "${expanded_file}")"
+      echo "removing $expanded_file."
+      mv -f "$expanded_file" "$trash/${file_name}_${timestamp}_${rand}"
+    else
+      echo "$expanded_file doesn't exist."
+    fi
+  done < <(compgen -G "$target_file")
 }
 
 remove_launchctl_service 'com.macpaw.CleanMyMac5.HealthMonitor'
@@ -130,3 +134,4 @@ trash $LOGGED_IN_USER '~/Library/LaunchAgents/com.macpaw.CleanMyMac5.Updater.pli
 trash $LOGGED_IN_USER '~/Library/Logs/com.macpaw.CleanMyMac5'
 trash $LOGGED_IN_USER '~/Library/Preferences/com.macpaw.CleanMyMac5.plist'
 trash $LOGGED_IN_USER '~/Library/Saved Application State/com.macpaw.CleanMyMac5.savedState'
+

ee/maintained-apps/inputs/homebrew/scripts/docker_desktop_install.sh

@@ -4,7 +4,7 @@ set -euo pipefail
 
 # variables
 APPDIR="/Applications/"
-TMPDIR=$(dirname "$(realpath "$INSTALLER_PATH")")
+TMPDIR=$(mktemp -d)
 MOUNT_POINT=""
 
 cleanup() {
@@ -15,6 +15,9 @@ cleanup() {
     fi
     rmdir "$mp" >/dev/null 2>&1 || true
   fi
+  if [[ -n "${TMPDIR:-}" ]]; then
+    rm -rf "$TMPDIR" >/dev/null 2>&1 || true
+  fi
 }
 trap cleanup EXIT
 
@@ -142,3 +145,4 @@ mkdir -p /usr/local/bin
 /bin/ln -h -f -s -- "$APPDIR/Docker.app/Contents/Resources/bin/docker-credential-desktop" "/usr/local/bin/docker-credential-desktop"
 /bin/ln -h -f -s -- "$APPDIR/Docker.app/Contents/Resources/bin/docker-credential-ecr-login" "/usr/local/bin/docker-credential-ecr-login"
 /bin/ln -h -f -s -- "$APPDIR/Docker.app/Contents/Resources/bin/docker-credential-osxkeychain" "/usr/local/bin/docker-credential-osxkeychain"
+

ee/vulnerability-dashboard/api/helpers/get-vulnerabilities.js

@@ -139,28 +139,36 @@ module.exports = {
     } else {// If we're filtering by a specific team and not getting the results for a single vulnerability, we'll build a list of vulnerabilities that affect that team.
 
       let hostIdsToFind = _.pluck(await Host.find({teamApid: teamApid}).select(['id']), 'id');
-      // TODO use parameterization
       let firstNativeQueryToSend;
+      let hostIdsPlaceholders = hostIdsToFind.map((id, i)=>{
+        return sails.config.datastores.default.adapter === 'sails-postgresql' ? `$${i + 1}` : '?';
+      }).join(',');
 
       if(sails.config.datastores.default.adapter === 'sails-postgresql') {
-        firstNativeQueryToSend = `
+        firstNativeQueryToSend = {
+          sql: `
         SELECT * FROM  "vulnerability"
         WHERE "id" IN (
         SELECT "vulnerability" FROM "vulnerabilityinstall"
-          WHERE "host" IN (${hostIdsToFind.join(',')})
-        );`;
+          WHERE "host" IN (${hostIdsPlaceholders})
+        );`,
+          bindings: hostIdsToFind
+        };
       } else if(sails.config.datastores.default.adapter === 'sails-mysql') {
-        firstNativeQueryToSend = 'SELECT * FROM  `vulnerability` '+
-        'WHERE `id` IN ('+
-          'SELECT `vulnerability` FROM `vulnerabilityinstall` '+
-          'WHERE `host` IN ('+
-            hostIdsToFind.join(',')+
-          ')'+
-        ');';
+        firstNativeQueryToSend = {
+          sql: 'SELECT * FROM  `vulnerability` '+
+          'WHERE `id` IN ('+
+            'SELECT `vulnerability` FROM `vulnerabilityinstall` '+
+            'WHERE `host` IN ('+
+              hostIdsPlaceholders+
+            ')'+
+          ');',
+          bindings: hostIdsToFind
+        };
       }
 
 
-      let rawResultFromDatabase = await sails.sendNativeQuery(firstNativeQueryToSend);
+      let rawResultFromDatabase = await sails.sendNativeQuery(firstNativeQueryToSend.sql, firstNativeQueryToSend.bindings);
 
       for(let row of rawResultFromDatabase.rows){
         row.createdAt = Number(row.createdAt);
@@ -200,17 +208,21 @@ module.exports = {
 
     // Build a where clause for the native query we will be sending.
     let vulnerabilityInstallWhereClause;
+    let vulnerabilityIdsToFind = _.pluck(vulnerabilities, 'id');
+    let vulnerabilityIdsPlaceholders = vulnerabilityIdsToFind.map((id, i)=>{
+      return sails.config.datastores.default.adapter === 'sails-postgresql' ? `$${i + 1}` : '?';
+    }).join(',');
 
     // If we're including resolved install information in this report for a CSV export, we'll send a query without the uninstalledAt condition.
     if(includeResolvedInstalls){
-      vulnerabilityInstallWhereClause = `WHERE vulnerability IN (${_.pluck(vulnerabilities,'id').join(',')})`;// Note this where clause will work with Postgres and MySQL datastores.
+      vulnerabilityInstallWhereClause = `WHERE vulnerability IN (${vulnerabilityIdsPlaceholders})`;// Note this where clause will work with Postgres and MySQL datastores.
     } else { // Otherwise, we'll send queries to only get unresolved installs.
 
       if(sails.config.datastores.default.adapter === 'sails-postgresql') {
         // If this app is configured to use a Postgres datastore, we'll need to put double quotes around the uninstalledAt column name.
-        vulnerabilityInstallWhereClause = `WHERE "uninstalledAt" = 0 AND vulnerability IN (${_.pluck(vulnerabilities,'id').join(',')})`;
+        vulnerabilityInstallWhereClause = `WHERE "uninstalledAt" = 0 AND vulnerability IN (${vulnerabilityIdsPlaceholders})`;
       } else if(sails.config.datastores.default.adapter === 'sails-mysql') {
-        vulnerabilityInstallWhereClause = `WHERE uninstalledAt = 0 AND vulnerability IN (${_.pluck(vulnerabilities,'id').join(',')})`;
+        vulnerabilityInstallWhereClause = `WHERE uninstalledAt = 0 AND vulnerability IN (${vulnerabilityIdsPlaceholders})`;
       }
     }
 
@@ -219,7 +231,7 @@ module.exports = {
      SELECT * FROM vulnerabilityinstall
      ${vulnerabilityInstallWhereClause}`;
 
-    let selectedInstallsFromEntireOrg = await sails.sendNativeQuery(vulnerabilityInstallNativeQuery);
+    let selectedInstallsFromEntireOrg = await sails.sendNativeQuery(vulnerabilityInstallNativeQuery, vulnerabilityIdsToFind);
 
     let hostsFromEntireOrg = await Host.find();
 
@@ -305,3 +317,4 @@ module.exports = {
 
 };
 
+

frontend/components/ActivityDetails/InstallDetails/SoftwareScriptDetailsModal/SoftwareScriptDetailsModal.tsx

@@ -44,7 +44,7 @@ const baseClass = "software-script-details-modal";
 
 export type IPackageInstallDetails = {
   host_display_name?: string;
-  install_uuid?: string; // not actually optional
+  install_uuid: string;
 };
 
 export const renderContactOption = (url?: string) => (
@@ -201,8 +201,7 @@ export const SoftwareScriptDetailsModal = ({
   onRerun,
   contactUrl,
 }: ISoftwareInstallDetailsProps) => {
-  // will always be present
-  const installUUID = detailsFromProps.install_uuid ?? "";
+  const installUUID = detailsFromProps.install_uuid;
 
   const [showInstallDetails, setShowInstallDetails] = useState(false);
   const toggleInstallDetails = () => {
@@ -223,6 +222,7 @@ export const SoftwareScriptDetailsModal = ({
     {
       ...DEFAULT_USE_QUERY_OPTIONS,
       staleTime: 3000,
+      enabled: !!installUUID,
       select: (data) => data.results as ISoftwareScriptResult,
     }
   );
@@ -263,6 +263,15 @@ export const SoftwareScriptDetailsModal = ({
     : undefined;
 
   const renderContent = () => {
+    if (!installUUID) {
+      return (
+        <DataError
+          description="Couldn't get script details. Missing install UUID."
+          excludeIssueLink
+        />
+      );
+    }
+
     if (isLoading) {
       return <Spinner />;
     }

frontend/hooks/useSoftwareInstallerMeta.ts

@@ -93,11 +93,6 @@ export const useSoftwareInstaller = (
           0
       );
 
-    const fmaVersions =
-      isFleetMaintainedApp && "fleet_maintained_versions" in softwareInstaller
-        ? softwareInstaller.fleet_maintained_versions
-        : [];
-
     const isCustomPackage =
       installerType === "package" && !isFleetMaintainedApp;
 
@@ -141,7 +136,6 @@ export const useSoftwareInstaller = (
         isAndroidPlayStoreWebApp,
         isFleetMaintainedApp,
         isLatestFmaVersion,
-        fmaVersions,
         isCustomPackage,
         isIosOrIpadosApp,
         sha256,

frontend/interfaces/mdm.ts

@@ -338,7 +338,8 @@ export const isAndroidBYO = (enrollmentStatus: MdmEnrollmentStatus | null) => {
   return enrollmentStatus === "On (personal)";
 };
 
-/** Android COBO (company-owned, fully managed) enrollment. */
+/** Android COBO (company-owned, fully managed) enrollment. Shares the same
+ * current/legacy enrollment status semantics as isAutomaticDeviceEnrollment. */
 export const isAndroidCOBO = (enrollmentStatus: MdmEnrollmentStatus | null) => {
-  return enrollmentStatus === "On (automatic)";
+  return isAutomaticDeviceEnrollment(enrollmentStatus);
 };

frontend/pages/DashboardPage/cards/OperatingSystems/OSTable.tsx

@@ -19,7 +19,7 @@ const EmptyOS = (platform: PlatformValueOptions): JSX.Element => (
   <EmptyState
     className={`${baseClass}__os-empty-table`}
     header={`No${
-      ` ${PLATFORM_DISPLAY_NAMES[platform]}` || ""
+      PLATFORM_DISPLAY_NAMES[platform] ? ` ${PLATFORM_DISPLAY_NAMES[platform]}` : ""
     } operating systems detected`}
     info="This report is updated every hour to protect the performance of your
   devices."

frontend/pages/DashboardPage/cards/WelcomeHost/WelcomeHost.tsx

@@ -229,6 +229,7 @@ const WelcomeHost = ({
             if (p.response) {
               return (
                 <Button
+                  key={p.id}
                   variant="unstyled"
                   onClick={() => handlePolicyModal(p.id)}
                 >

frontend/pages/ManageControlsPage/OSSettings/cards/DiskEncryption/DiskEncryption.tsx

@@ -7,6 +7,7 @@ import { ITeamConfig } from "interfaces/team";
 import { getErrorReason } from "interfaces/errors";
 
 import { LEARN_MORE_ABOUT_BASE_LINK } from "utilities/constants";
+import { API_NO_TEAM_ID } from "interfaces/team";
 
 import diskEncryptionAPI from "services/entities/disk_encryption";
 import teamsAPI, { ILoadTeamResponse } from "services/entities/teams";
@@ -93,7 +94,7 @@ const DiskEncryption = ({
     {
       refetchOnWindowFocus: false,
       retry: false,
-      enabled: currentTeamId !== 0,
+      enabled: currentTeamId !== API_NO_TEAM_ID,
       select: (res) => res.fleet,
       onSuccess: (res) => {
         const enableDiskEncryption = res.mdm?.enable_disk_encryption ?? false;
@@ -119,7 +120,7 @@ const DiskEncryption = ({
       );
       onMutation();
       setShowAggregate(diskEncryptionEnabled);
-      if (currentTeamId === 0) {
+      if (currentTeamId === API_NO_TEAM_ID) {
         getUpdatedAppConfig();
       }
     } catch (e) {
@@ -148,7 +149,7 @@ const DiskEncryption = ({
     }
   };
 
-  if (currentTeamId === 0 && isLoadingTeam) {
+  if (currentTeamId === API_NO_TEAM_ID && isLoadingTeam) {
     setIsLoadingTeam(false);
   }