mirror of
https://github.com/elastic/kibana.git
synced 2025-06-27 10:40:07 -04:00
[Osquery] Replace js-sql-parser (#128714)
This commit is contained in:
Patryk Kopyciński
GitHub
parent
df38c6fc46
commit
cd3f9acaa1
4 changed files with 175 additions and 131 deletions
|
|
@ -97,6 +97,7 @@
|
|||
"puppeteer/node-fetch": "^2.6.7"
|
||||
},
|
||||
"dependencies": {
|
||||
"@appland/sql-parser": "^1.5.1",
|
||||
"@babel/runtime": "^7.17.9",
|
||||
"@dnd-kit/core": "^3.1.1",
|
||||
"@dnd-kit/sortable": "^4.0.0",
|
||||
|
|
@ -297,7 +298,6 @@
|
|||
"js-levenshtein": "^1.1.6",
|
||||
"js-search": "^1.4.3",
|
||||
"js-sha256": "^0.9.0",
|
||||
"js-sql-parser": "^1.4.1",
|
||||
"js-yaml": "^3.14.1",
|
||||
"json-stable-stringify": "^1.0.1",
|
||||
"json-stringify-pretty-compact": "1.2.0",
|
||||
|
|
|
|||
|
|
@ -6,4 +6,4 @@
|
|||
* Side Public License, v 1.
|
||||
*/
|
||||
|
||||
declare module 'js-sql-parser';
|
||||
declare module '@appland/sql-parser';
|
||||
|
|
@ -34,7 +34,7 @@ import {
|
|||
EuiIcon,
|
||||
EuiSuperSelect,
|
||||
} from '@elastic/eui';
|
||||
import sqlParser from 'js-sql-parser';
|
||||
import sqliteParser from '@appland/sql-parser';
|
||||
import { FormattedMessage } from '@kbn/i18n-react';
|
||||
import { i18n } from '@kbn/i18n';
|
||||
import styled from 'styled-components';
|
||||
|
|
@ -777,7 +777,7 @@ export const ECSMappingEditorField = React.memo(
|
|||
let ast: Record<string, any> | undefined;
|
||||
|
||||
try {
|
||||
ast = sqlParser.parse(query)?.value;
|
||||
ast = sqliteParser(query)?.statement?.[0];
|
||||
} catch (e) {
|
||||
return;
|
||||
}
|
||||
|
|
@ -789,44 +789,88 @@ export const ECSMappingEditorField = React.memo(
|
|||
order: number;
|
||||
}
|
||||
> =
|
||||
ast?.from?.value?.reduce(
|
||||
(
|
||||
acc: {
|
||||
[x: string]: {
|
||||
columns: OsqueryColumn[];
|
||||
order: number;
|
||||
};
|
||||
},
|
||||
table: {
|
||||
value: {
|
||||
left?: { value: { value: string }; alias?: { value: string } };
|
||||
right?: { value: { value: string }; alias?: { value: string } };
|
||||
value?: { value: string };
|
||||
alias?: { value: string };
|
||||
};
|
||||
}
|
||||
) => {
|
||||
each(['value.left', 'value.right', 'value'], (valueKey) => {
|
||||
if (valueKey) {
|
||||
const osqueryTable = find(osquerySchema, [
|
||||
'name',
|
||||
get(table, `${valueKey}.value.value`),
|
||||
]);
|
||||
reduce(
|
||||
ast,
|
||||
(acc, data) => {
|
||||
// select * from uptime
|
||||
if (data?.type === 'identifier' && data?.variant === 'table') {
|
||||
const osqueryTable = find(osquerySchema, ['name', data.name]);
|
||||
|
||||
if (osqueryTable) {
|
||||
acc[
|
||||
get(table, `${valueKey}.alias.value`) ?? get(table, `${valueKey}.value.value`)
|
||||
] = {
|
||||
acc[data.alias || data.name] = {
|
||||
columns: osqueryTable.columns,
|
||||
order: Object.keys(acc).length,
|
||||
};
|
||||
}
|
||||
}
|
||||
});
|
||||
|
||||
// select * from uptime, routes
|
||||
if (data?.type === 'map' && data?.variant === 'join') {
|
||||
if (data?.source?.type === 'identifier' && data?.source?.variant === 'table') {
|
||||
const osqueryTable = find(osquerySchema, ['name', data?.source?.name]);
|
||||
|
||||
if (osqueryTable) {
|
||||
acc[data?.source?.alias || data?.source?.name] = {
|
||||
columns: osqueryTable.columns,
|
||||
order: Object.keys(acc).length,
|
||||
};
|
||||
}
|
||||
}
|
||||
|
||||
if (data?.source?.type === 'statement' && data?.source?.variant === 'compound') {
|
||||
if (
|
||||
data?.source?.statement.from.type === 'identifier' &&
|
||||
data?.source?.statement.from.variant === 'table'
|
||||
) {
|
||||
const osqueryTable = find(osquerySchema, [
|
||||
'name',
|
||||
data?.source?.statement.from.name,
|
||||
]);
|
||||
|
||||
if (osqueryTable) {
|
||||
acc[data?.source?.statement.from.alias || data?.source?.statement.from.name] = {
|
||||
columns: osqueryTable.columns,
|
||||
order: Object.keys(acc).length,
|
||||
};
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
each(
|
||||
data?.map,
|
||||
(mapValue: {
|
||||
type: string;
|
||||
// eslint-disable-next-line @typescript-eslint/no-explicit-any
|
||||
source: { type: string; variant: string; name: any | string; alias: any };
|
||||
}) => {
|
||||
if (mapValue?.type === 'join') {
|
||||
if (
|
||||
mapValue?.source?.type === 'identifier' &&
|
||||
mapValue?.source?.variant === 'table'
|
||||
) {
|
||||
const osqueryTable = find(osquerySchema, ['name', mapValue?.source?.name]);
|
||||
|
||||
if (osqueryTable) {
|
||||
acc[mapValue?.source?.alias || mapValue?.source?.name] = {
|
||||
columns: osqueryTable.columns,
|
||||
order: Object.keys(acc).length,
|
||||
};
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
);
|
||||
}
|
||||
|
||||
return acc;
|
||||
},
|
||||
{}
|
||||
{} as Record<
|
||||
string,
|
||||
{
|
||||
columns: OsqueryColumn[];
|
||||
order: number;
|
||||
}
|
||||
>
|
||||
) ?? {};
|
||||
|
||||
// Table doesn't exist in osquery schema
|
||||
|
|
@ -834,15 +878,14 @@ export const ECSMappingEditorField = React.memo(
|
|||
return;
|
||||
}
|
||||
|
||||
const suggestions =
|
||||
isArray(ast?.selectItems?.value) &&
|
||||
ast?.selectItems?.value
|
||||
?.map((selectItem: { type: string; value: string; hasAs: boolean; alias?: string }) => {
|
||||
if (selectItem.type === 'Identifier') {
|
||||
const suggestions = isArray(ast?.result)
|
||||
? ast?.result
|
||||
?.map((selectItem: { type: string; name: string; alias?: string }) => {
|
||||
if (selectItem.type === 'identifier') {
|
||||
/*
|
||||
select * from routes, uptime;
|
||||
*/
|
||||
if (ast?.selectItems?.value.length === 1 && selectItem.value === '*') {
|
||||
if (ast?.result.length === 1 && selectItem.name === '*') {
|
||||
return reduce(
|
||||
astOsqueryTables,
|
||||
(acc, { columns: osqueryColumns, order: tableOrder }, table) => {
|
||||
|
|
@ -869,9 +912,9 @@ export const ECSMappingEditorField = React.memo(
|
|||
select i.*, p.resident_size, p.user_time, p.system_time, time.minutes as counter from osquery_info i, processes p, time where p.pid = i.pid;
|
||||
*/
|
||||
|
||||
const [table, column] = selectItem.value.includes('.')
|
||||
? selectItem.value?.split('.')
|
||||
: [Object.keys(astOsqueryTables)[0], selectItem.value];
|
||||
const [table, column] = selectItem.name.includes('.')
|
||||
? selectItem.name?.split('.')
|
||||
: [Object.keys(astOsqueryTables)[0], selectItem.name];
|
||||
|
||||
if (column === '*' && astOsqueryTables[table]) {
|
||||
const { columns: osqueryColumns, order: tableOrder } = astOsqueryTables[table];
|
||||
|
|
@ -892,7 +935,7 @@ export const ECSMappingEditorField = React.memo(
|
|||
const osqueryColumn = find(astOsqueryTables[table].columns, ['name', column]);
|
||||
|
||||
if (osqueryColumn) {
|
||||
const label = selectItem.hasAs ? selectItem.alias : column;
|
||||
const label = selectItem.alias ?? column;
|
||||
|
||||
return [
|
||||
{
|
||||
|
|
@ -924,7 +967,7 @@ export const ECSMappingEditorField = React.memo(
|
|||
LIMIT 5;
|
||||
*/
|
||||
|
||||
if (selectItem.hasAs && selectItem.alias) {
|
||||
if (selectItem.type === 'function' && selectItem.alias) {
|
||||
return [
|
||||
{
|
||||
label: selectItem.alias,
|
||||
|
|
@ -941,7 +984,8 @@ export const ECSMappingEditorField = React.memo(
|
|||
|
||||
return [];
|
||||
})
|
||||
.flat();
|
||||
.flat()
|
||||
: [];
|
||||
|
||||
// Remove column duplicates by keeping the column from the table that appears last in the query
|
||||
const newOptions = sortedUniqBy(
|
||||
|
|
|
|||
10
yarn.lock
10
yarn.lock
|
|
@ -41,6 +41,11 @@
|
|||
call-me-maybe "^1.0.1"
|
||||
z-schema "^5.0.1"
|
||||
|
||||
"@appland/sql-parser@^1.5.1":
|
||||
version "1.5.1"
|
||||
resolved "https://registry.yarnpkg.com/@appland/sql-parser/-/sql-parser-1.5.1.tgz#331d644364899858ba7aa6e884e2492596990626"
|
||||
integrity sha512-R2FBHUOdzdBPUCCiL6WvXT9Fu+Xaj89exa1g+wMlatIe5z6vqitzLkY5a9zGDL3IByTiwbR0jiYuvFMfhp1Q+Q==
|
||||
|
||||
"@babel/cli@^7.17.6":
|
||||
version "7.17.6"
|
||||
resolved "https://registry.yarnpkg.com/@babel/cli/-/cli-7.17.6.tgz#169e5935f1795f0b62ded5a2accafeedfe5c5363"
|
||||
|
|
@ -18331,11 +18336,6 @@ js-sha3@0.8.0:
|
|||
resolved "https://registry.yarnpkg.com/js-sha3/-/js-sha3-0.8.0.tgz#b9b7a5da73afad7dedd0f8c463954cbde6818840"
|
||||
integrity sha512-gF1cRrHhIzNfToc802P800N8PpXS+evLLXfsVpowqmAFR9uwbi89WvXg2QspOmXL8QL86J4T1EpFu+yUkwJY3Q==
|
||||
|
||||
js-sql-parser@^1.4.1:
|
||||
version "1.4.1"
|
||||
resolved "https://registry.yarnpkg.com/js-sql-parser/-/js-sql-parser-1.4.1.tgz#775516b3187dd5872ecec04bef8ed4a430242fda"
|
||||
integrity sha512-J8zi3+/yK4FWSnVvLOjS2HIGfJhR6v7ApwIF8gZ/SpaO/tFIDlsgugD6ZMn6flXiuMsCjJxvhE0+xBgbdzvDDw==
|
||||
|
||||
js-string-escape@^1.0.1:
|
||||
version "1.0.1"
|
||||
resolved "https://registry.yarnpkg.com/js-string-escape/-/js-string-escape-1.0.1.tgz#e2625badbc0d67c7533e9edc1068c587ae4137ef"
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue