Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix multiple object redefinitions in extensions #108

Conversation

PierreSedon
Copy link
Contributor

Currently if multiple extensions redefine the same object by adding attributes, only the modifications from the last extension to be loaded will actually be taken into account.
As an example, the core schema extends the process object for the linux extension. If someone was to also extend process in the windows extension by adding for instance a test attribute (by including a profile or just adding the attribute), this test attribute would not show in any of the APIs nor be visible through the frontend.

With the proposed fix, in the case where multiple extensions extend the same object and add the same attribute, only the last loaded extension will be taken into account which seems fine since in this case it is the schema that is poorly defined and not something the ocsf-server could really handle more gracefully.

I also included a fix for the cases where the observable_type_id_map is non-existent, if it makes more sense to put it in a dedicated pull request I can move it.

@PierreSedon PierreSedon force-pushed the fix-multiple-object-redefinitions-in-extensions branch from b22c330 to 0494e62 Compare August 26, 2024 15:30
The check in cond was correct. The fix is to set observable_type_id_map to nil if there is no `observable` object defined in the schema.

Signed-off-by: Rick Mouritzen <[email protected]>
@rmouritzen-splunk
Copy link
Contributor

Both commits identify real issues. The first commit looks good. For the second I noticed a less complex variation.

@rmouritzen-splunk rmouritzen-splunk merged commit f0de5e9 into ocsf:main Sep 19, 2024
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants