Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

google_chrome_profiles: add path column #60

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

slai
Copy link

@slai slai commented Dec 31, 2024

There is currently no column that can be used to link rows returned by the google_chrome_profiles table with the rows returned by the OSQuery built-in chrome_extensions table. This is useful for determining the email, and therefore the Google Account, associated with the profile the extension is installed in, which can be used as a proxy for whether the extension was installed in a work or non-work profile.

This PR adds a path column to the google_chrome_profiles table. This is the path to the profile's directory, and should match profile_path column in the chrome_extensions table, allowing these two tables to be joined together. It does this by pulling out the profile's directory name from the same dictionary used to get the existing data, combines it with the Chrome user data directory path, and finally checks that it exists before returning it. It is possible for this column to be empty, if for whatever reason, the computed path does not exist.

osquery> select * from google_chrome_profiles;
+----------+------------------------+------------------+-----------+-----------------------------------------------------------------+
| username | email                  | name             | ephemeral | path                                                            |
+----------+------------------------+------------------+-----------+-----------------------------------------------------------------+
| user1    | [email protected] | test.example.com | 0         | /Users/user/Library/Application Support/Google/Chrome/Default   |
| user2    | [email protected]      | example.com      | 0         | /Users/user/Library/Application Support/Google/Chrome/Profile 1 |
+----------+------------------------+------------------+-----------+-----------------------------------------------------------------+

There is currently no column that can be used to link rows returned by the _google_chrome_profiles_ table with the rows returned by the OSQuery built-in _chrome_extensions_ table. This is useful for determining the email, and therefore the Google Account, associated with the profile, which can be used as a proxy for whether the profile is a work or non-work one.

This PR adds a _path_ column to the _google_chrome_profiles_ table. This is the path to the profile's directory, and should match _profile_path_ column in the _chrome_extensions_ table, allowing these two tables to be joined together. It does this by pulling out the profile's directory name from the same dictionary used to get the existing data, combines it with the Chrome user data directory path, and finally checks that it exists before returning it. It is therefore possible for this column to be empty, if for whatever reason, the computed path does not exist.

```
osquery> select * from google_chrome_profiles;
+----------+------------------------+------------------+-----------+-----------------------------------------------------------------+
| username | email                  | name             | ephemeral | path                                                            |
+----------+------------------------+------------------+-----------+-----------------------------------------------------------------+
| user1    | [email protected] | test.example.com | 0         | /Users/user/Library/Application Support/Google/Chrome/Default   |
| user2    | [email protected]      | example.com      | 0         | /Users/user/Library/Application Support/Google/Chrome/Profile 1 |
+----------+------------------------+------------------+-----------+-----------------------------------------------------------------+
```
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant