Skip to content

Stop guessing Windows FMA open-query process names for multi-word titles #50825

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
allenhouchins wants to merge 1 commit into
base: main
Choose a base branch
from
+19 −1
Draft

Stop guessing Windows FMA open-query process names for multi-word titles #50825

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions changes/windows-open-query-drop-multiword-guess
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
- Fixed Fleet-maintained apps on Windows generating an "app open" pre-install check that could never match: multi-word app names without a known process name (e.g. "Mozilla Firefox", "Microsoft Visual C++ 2015-2022 Redistributable (x64)") no longer produce a guessed `<name>.exe` process check. Apps with a curated process-name mapping keep their check.
2 changes: 1 addition & 1 deletion ee/maintained-apps/maintained_apps.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ const OutputPath = "ee/maintained-apps/outputs"
type FMAQueries struct {
Exists string `json:"exists"`
Patched string `json:"patched"`
Open string `json:"open"`
Open string `json:"open,omitempty"`

@coderabbitai coderabbitai Bot Aug 8, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

rg -n -C 5 \
  'type FMAQueries struct|FMAQueries|GenerateOpenQuery|json:"open|\.Open\b|json\.(Marshal|Unmarshal|NewEncoder|NewDecoder)' \
  --glob '*.go' --glob '!vendor/**' . || true

rg -n -C 5 '"open"' \
  --glob '*.ts' --glob '*.tsx' --glob '*.js' --glob '*.json' . || true

Repository: fleetdm/fleet

Length of output: 50370

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

# Locate and inspect the changed file and nearby tests without running repository code.
printf '--- git diff stat ---\n'
git diff --stat || true

printf '\n--- changed/untracked Go file ---\n'
git ls-files ee/maintained-apps/maintained_apps.go ee/maintained-apps/**/*_test.go
printf '\n--- maintained_apps.go context ---\n'
nl -ba ee/maintained-apps/maintained_apps.go | sed -n '1,120p'

printf '\n--- references to FMAQueries/Open in Go files only ---\n'
rg -n -C 4 \
  '(FMAQueries|\.Open|json:"open|Open:|json\.Marshal|json\.Unmarshal)' \
  ee/maintained-apps cmd frontend server --glob '*.go' || true

printf '\n--- strict references to open field/query in frontend/API files ---\n'
rg -n -C 3 '["'\'']open["'\'']|open:|open\?' frontend ee cmd --glob '*.{go,ts,tsx,js,json,yaml,yml}' || true

Repository: fleetdm/fleet

Length of output: 242

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

# Locate and inspect the changed file and nearby tests without running repository code.
printf '%s\n' '--- git diff stat ---'
git diff --stat || true

printf '%s\n' ''
printf '%s\n' '--- changed/untracked Go file ---'
git ls-files ee/maintained-apps/maintained_apps.go ee/maintained-apps/**/*_test.go

printf '%s\n' ''
printf '%s\n' '--- maintained_apps.go context ---'
nl -ba ee/maintained-apps/maintained_apps.go | sed -n '1,160p'

printf '%s\n' ''
printf '%s\n' '--- references to FMAQueries/Open in Go files only ---'
rg -n -C 4 \
  '(FMAQueries|\.Open|json:"open|Open:|json\.Marshal|json\.Unmarshal)' \
  ee/maintained-apps cmd frontend server --glob '*.go' || true

printf '%s\n' ''
printf '%s\n' '--- strict references to open field/query in frontend/API files ---'
rg -n -C 3 '["'"'"']open["'"'"']|open:|open\?' frontend ee cmd --glob '*.{go,ts,tsx,js,json,yaml,yml}' || true

Repository: fleetdm/fleet

Length of output: 1188

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

printf '%s\n' '--- maintained_apps.go context ---'
awk '{printf "%6d\t%s\n", NR, $0}' ee/maintained-apps/maintained_apps.go | sed -n '1,160p'

printf '%s\n' ''
printf '%s\n' '--- references to FMAQueries/Open in Go files only ---'
rg -n -C 4 \
  '(FMAQueries|\.Open|json:"open|Open:|json\.Marshal|json\.Unmarshal)' \
  ee/maintained-apps cmd frontend server --glob '*.go' || true

printf '%s\n' ''
printf '%s\n' '--- strict references to open field/query in frontend/API files ---'
rg -n -C 3 '["'"'"']open["'"'"']|open:|open\?' frontend ee cmd --glob '*.{go,ts,tsx,js,json,yaml,yml}' || true

Repository: fleetdm/fleet

Length of output: 50370

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

printf '%s\n' '--- maintained_apps.go lines 1-120 ---'
awk '{printf "%6d\t%s\n", NR, $0}' ee/maintained-apps/maintained_apps.go | sed -n '1,120p'

printf '%s\n' ''
printf '%s\n' '--- maintained-apps package Go symbols/tests ---'
find ee/maintained-apps -maxdepth 2 -type f \( -name '*.go' -o -name '*_test.go' \) -print | sort

printf '%s\n' ''
printf '%s\n' '--- maintained-apps Go references for FMAQueries/Open/open field ---'
rg -n -C 4 '^[A-Za-z0-9_. \t:]*type\s+FMAQueries|FMAQueries|Open\s*:|\.Open\s*|json:\s*"open' ee/maintained-apps --glob '*.go' || true

printf '%s\n' ''
printf '%s\n' '--- managed references to open query in focused files only ---'
rg -n -C 3 'FMAQueries|openQuery|\.Open\s*|json:\s*"open"|"open"\s*[:=,]' ee cmd frontend --glob '*.{go,ts,tsx,js}' || true

printf '%s\n' ''
printf '%s\n' '--- JSON/marshalling references around maintained apps ---'
rg -n -C 3 'json\.(Marshal|Unmarshal|NewEncoder|NewDecoder)|encoder\.Encode\(|decoder\.Decode\(|FMAQueries' ee/maintained-apps ee/maintained-apps --glob '*.go' || true

Repository: fleetdm/fleet

Length of output: 50370

Add coverage for the omitted empty open query.

FMAQueries.Open now omits empty values from the manifest JSON, but the code path only checks non-empty generation. Add unit coverage for marshalling an empty Queries.Open and for any downstream manifest reader that depends on queries.open being present or absent.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@ee/maintained-apps/maintained_apps.go` at line 22, Add unit tests covering
JSON marshalling of an empty FMAQueries.Open value and verifying the resulting
manifest omits the open field. Also cover downstream manifest-reader behavior
for manifests where queries.open is absent, preserving existing behavior for
non-empty values.

}

type FMAManifestApp struct {
Expand Down
11 changes: 11 additions & 0 deletions pkg/patch_policy/patch_policy.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -179,6 +179,17 @@ func defaultWindowsOpenQuery(softwareTitle string) string {
return fmt.Sprintf(windowsOpenQueryPrefix, query)
}

// Multi-word catalog names ("Mozilla Firefox", "XnSoft XnConvert", "Microsoft
// Visual C++ 2015-2022 Redistributable (x64)") almost never equal the process
// image name — vendor prefixes, editions, and version suffixes produce a query
// that can never match, which silently defeats the app-open gate. Runtime,
// driver, and redistributable packages have no user-facing process at all.
// Emit no open query rather than a wrong one; add a windowsOpenQueryOverrides
// entry when the real binary name is known.
if strings.Contains(softwareTitle, " ") {
return ""
}

// Match a process named "<title>.exe"
// alternatives considered:
// - join programs.install_location with processes.path - install_location is unreliable (especially for MSI installers)
Expand Down
6 changes: 6 additions & 0 deletions pkg/patch_policy/patch_policy_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -99,6 +99,12 @@ func TestGenerateOpenQuery(t *testing.T) {
got = patch_policy.GenerateOpenQuery("windows", "", "Microsoft Teams")
require.Equal(t, "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM processes WHERE LOWER(name) IN ('teams.exe','ms-teams.exe'));", got)

// A multi-word title without an override yields no query: the derived
// "<title>.exe" ("xnsoft xnconvert.exe") would never match a real process,
// silently defeating the app-open gate.
require.Empty(t, patch_policy.GenerateOpenQuery("windows", "", "XnSoft XnConvert"))
require.Empty(t, patch_policy.GenerateOpenQuery("windows", "", "Microsoft Visual C++ 2015-2022 Redistributable (x64)"))

// Unknown platform yields no query.
require.Empty(t, patch_policy.GenerateOpenQuery("linux", "com.example.foo", ""))
}
Loading