-
-
Notifications
You must be signed in to change notification settings - Fork 2.4k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
sql: Avoid returning empty matches with regex_split #8083
base: master
Are you sure you want to change the base?
sql: Avoid returning empty matches with regex_split #8083
Conversation
8d5c7c3
to
de127f0
Compare
de127f0
to
6190a09
Compare
@@ -305,12 +305,12 @@ The following trig functions: `sin`, `cos`, `tan`, `cot`, `asin`, `acos`, `atan` | |||
|
|||
osquery> .mode line | |||
|
|||
osquery> select uid from users; | |||
osquery> select uid from users; |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Is this whitespace intentional?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yes, it's to force a linebreak, since if you check here https://osquery.readthedocs.io/en/latest/introduction/sql/#string-functions, the uid = 500
line is rendered on the same line of the query.
EXPECT_EQ(d[0]["t1"], "foo"); | ||
EXPECT_EQ(d[0]["t2"], "bar"); | ||
EXPECT_EQ(d[0]["t3"], ""); | ||
EXPECT_EQ(d[0]["t0"], "foo"); |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This feels like a breaking change. And I have no idea what correct is in the larger world.
Though, I guess regex_split
and split
behave differently, and that's also confusing:
osquery> select split('/foo/bar', '/', 1), regex_split('/foo/bar', '/', 1);
+---------------------------+---------------------------------+
| split('/foo/bar', '/', 1) | regex_split('/foo/bar', '/', 1) |
+---------------------------+---------------------------------+
| bar | foo |
+---------------------------+---------------------------------+
Still, I worry about a breaking change
No description provided.