Skip to content

Bugfix: Adding stored query to array should expand the stored query. #122

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
scudette merged 1 commit into from
Aug 22, 2025
Merged

Bugfix: Adding stored query to array should expand the stored query. #122

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
78 changes: 78 additions & 0 deletions fixtures/multi_vql_queries.golden
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1338,5 +1338,83 @@
"StructValue.src_ip": "127.0.0.1",
"StructValue.SrcIp": null
}
],
"088/000 Adding Stored Query: LET X = SELECT value AS Foo FROM range(start=1, end=4)": null,
"088/001 Adding Stored Query: SELECT (dict(Foo=12), ) + X, X + (dict(Foo=12), ) FROM scope()": [
{
"(dict(Foo=12), ) + X": [
{
"Foo": 12
},
{
"Foo": 1
},
{
"Foo": 2
},
{
"Foo": 3
},
{
"Foo": 4
}
],
"X + (dict(Foo=12), )": [
{
"Foo": 1
},
{
"Foo": 2
},
{
"Foo": 3
},
{
"Foo": 4
},
{
"Foo": 12
}
]
}
],
"089/000 Adding Materialized Stored Query: LET X \u003c= SELECT value AS Foo FROM range(start=1, end=4)": null,
"089/001 Adding Materialized Stored Query: SELECT (dict(Foo=12), ) + X, X + (dict(Foo=12), ) FROM scope()": [
{
"(dict(Foo=12), ) + X": [
{
"Foo": 12
},
{
"Foo": 1
},
{
"Foo": 2
},
{
"Foo": 3
},
{
"Foo": 4
}
],
"X + (dict(Foo=12), )": [
{
"Foo": 1
},
{
"Foo": 2
},
{
"Foo": 3
},
{
"Foo": 4
},
{
"Foo": 12
}
]
}
]
}
17 changes: 14 additions & 3 deletions protocols/protocol_add.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
package protocols

import (
"context"
"reflect"

"www.velocidex.com/golang/vfilter/types"
Expand Down Expand Up @@ -94,8 +95,8 @@ func (self AddDispatcher) Add(scope types.Scope, a types.Any, b types.Any) types

// Handle array concatenation
if is_array(a) || is_array(b) {
a_slice := convertToSlice(a)
b_slice := convertToSlice(b)
a_slice := convertToSlice(scope, a)
b_slice := convertToSlice(scope, b)

return append(a_slice, b_slice...)
}
Expand All @@ -111,7 +112,7 @@ func (self *AddDispatcher) AddImpl(elements ...AddProtocol) {
}
}

func convertToSlice(a types.Any) []types.Any {
func convertToSlice(scope types.Scope, a types.Any) []types.Any {
if is_array(a) {
a_slice := reflect.ValueOf(a)
result := make([]types.Any, 0, a_slice.Len())
Expand All @@ -120,5 +121,15 @@ func convertToSlice(a types.Any) []types.Any {
}
return result
}

stored_query, ok := a.(types.StoredQuery)
if ok {
var res []types.Any
for _, x := range MaterializeToArray(context.Background(), scope, stored_query) {
res = append(res, x)
}
return res
}

return []types.Any{a}
}
13 changes: 12 additions & 1 deletion vfilter_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1334,6 +1334,17 @@ FROM scope()
{"Test struct associative", `
SELECT StructValue.SrcIP, StructValue.src_ip, StructValue.SrcIp
FROM scope()`},

{"Adding Stored Query", `
LET X = SELECT value AS Foo FROM range(start=1, end=4)

SELECT (dict(Foo=12), ) + X, X + (dict(Foo=12),) FROM scope()
`},
{"Adding Materialized Stored Query", `
LET X <= SELECT value AS Foo FROM range(start=1, end=4)

SELECT (dict(Foo=12), ) + X, X + (dict(Foo=12),) FROM scope()
`},
}

type _RangeArgs struct {
Expand Down Expand Up @@ -1533,7 +1544,7 @@ func TestMultiVQLQueries(t *testing.T) {
// Store the result in ordered dict so we have a consistent golden file.
result := ordereddict.NewDict()
for i, testCase := range multiVQLTest {
if false && i != 85 {
if false && i != 88 {
continue
}
scope := makeTestScope()
Expand Down