Added jetbrains_plugins table #8623

ksykulev · 2025-06-10T00:16:22Z

fleetdm/fleet#20644
fleetdm/fleet#27914

This adds the jetbrains_plugins table. It contains a list of plugins installed on the system under a jetbrains product. Currently supported jetbrains products
CLion, DataGrip, GoLand, IntelliJIdea, IntelliJIdeaCommunityEdition, PhpStorm, PyCharm, PyCharmCommunityEdition, ReSharper, Rider, RubyMine, RustRover, WebStorm

An important thing to note about this table is in order to get some of the details about each plugin we must go through the jar files in the lib directory of the plugin and scan for a "plugin.xml" file. This requires zlib and libarchive.

Here is a sample output

osquery> select product_type, name, version, vendor, path from users cross join jetbrains_plugins using (uid);
+---------------------------------+-------------------+---------------+-----------+-------------------------------------------------------------------------------------------------------------------+
| product_type                    | name              | version       | vendor    | path                                                                                                              |
+---------------------------------+-------------------+---------------+-----------+-------------------------------------------------------------------------------------------------------------------+
| intellij_idea                   | AWS Toolkit       | 3.51-243      | AWS       | /Users/ksykulev/Library/Application Support/JetBrains/IntelliJIdea2024.3/plugins/aws-toolkit-jetbrains-standalone |
| intellij_idea                   | Plugin DevKit     | 243.22562.218 | JetBrains | /Users/ksykulev/Library/Application Support/JetBrains/IntelliJIdea2024.3/plugins/devkit                           |
| intellij_idea                   | GitHub Copilot    | 1.5.30-242    | GitHub    | /Users/ksykulev/Library/Application Support/JetBrains/IntelliJIdea2024.3/plugins/github-copilot-intellij          |
| intellij_idea                   | Swing UI Designer | 243.22562.218 | JetBrains | /Users/ksykulev/Library/Application Support/JetBrains/IntelliJIdea2024.3/plugins/uiDesigner                       |
| intellij_idea                   | AWS Core          | 3.51-243      | AWS       | /Users/ksykulev/Library/Application Support/JetBrains/IntelliJIdea2024.3/plugins/plugin-core                      |
| intellij_idea_community_edition | Docker            | 251.26094.133 | JetBrains | /Users/ksykulev/Library/Application Support/JetBrains/IdeaIC2025.1/plugins/clouds-docker-impl                     |
| intellij_idea_community_edition | AWS Toolkit       | 3.74-251      | AWS       | /Users/ksykulev/Library/Application Support/JetBrains/IdeaIC2025.1/plugins/aws-toolkit-jetbrains-standalone       |
| intellij_idea_community_edition | GitHub Copilot    | 1.5.46-243    | GitHub    | /Users/ksykulev/Library/Application Support/JetBrains/IdeaIC2025.1/plugins/github-copilot-intellij                |
| intellij_idea_community_edition | AWS Core          | 3.74.251      | AWS       | /Users/ksykulev/Library/Application Support/JetBrains/IdeaIC2025.1/plugins/plugin-core                            |
+---------------------------------+-------------------+---------------+-----------+-------------------------------------------------------------------------------------------------------------------+

ksykulev · 2025-06-10T00:18:03Z

CMakeLists.txt

    "Linux,Darwin,Windows:gflags"
    "Linux,Darwin,Windows:glog"
    "Linux,Darwin,Windows:googletest"
+    "Linux,Darwin,Windows:zlib"


This is a change to note. libarchive now needs to be compiled with zlib in order to extract the jar files. See the libraries/cmake/source/libarchive/CMakeLists.txt file for details. This means that zlib now needs to be compiled prior to libarchive.

ksykulev · 2025-06-10T00:20:28Z

osquery/tables/applications/jetbrains_plugins.cpp

+  return std::make_unique<PluginAttributes>(parsePluginXml(xml_content));
+}
+
+/*


👀
https://github.com/JetBrains/intellij-community/blob/master/platform/util/src/com/intellij/platform/util/plugin.kt

ksykulev · 2025-06-10T00:25:54Z

libraries/cmake/source/libarchive/CMakeLists.txt

+  )
+  target_link_libraries(thirdparty_libarchive PRIVATE
+    zlibstatic
+  )


Is this the right way to compile with zlib?

ksykulev · 2025-06-10T14:03:53Z

osquery/tables/applications/jetbrains_plugins.cpp

+  std::vector<char> content;
+};
+
+FileData extractSpecificFileFromArchive(const std::string& archive_file_path,


Wonder if this should be in some common util location, it's a very generic method.

ksykulev · 2025-06-10T15:55:22Z

osquery/tables/applications/jetbrains_plugins.cpp

+};
+
+// Function to extract the contents of a specific tag
+std::string getContentFromTag(const std::string& xml,


This is a duplicate of getTagContent from https://github.com/osquery/osquery/blob/master/osquery/tables/system/windows/programs.cpp#L43C13-L43C26

I don't want to make it part of this PR, but I feel like I should extract some of this simple XML parsing logic into some sort of shared util.
https://github.com/osquery/osquery/blob/master/osquery/tables/system/windows/programs.cpp#L23-L67

Caught by this:
https://github.com/osquery/osquery/actions/runs/15562331436/job/43817632273

osquery_tables_system_systemtable.lib(programs.cpp.obj) : error LNK2005: "class std::basic_string<char, ... > osquery::tables::getTagContent(...)" is already defined.

ksykulev · 2025-06-10T20:22:14Z

osquery/tables/applications/jetbrains_plugins.cpp

+  QueryData results;
+
+  auto users = usersFromContext(context);
+  for (const auto& user : users) {


Another thing to note here, jetbrains plugins are installed at a user level.

lucasmrod

LGTM!

Left some questions/comments.

osquery/tables/applications/jetbrains_plugins.cpp

ksykulev · 2025-06-11T03:28:02Z

tests/integration/tables/jetbrains_plugins.cpp

+    deinitUsersAndGroupsServices(true, false);
+    Dispatcher::instance().resetStopping();
+  }
+#endif


Not having this block was making the windows test fail. I see that usersFromContext(context) fails without it.

80: E20250611 01:13:27.886477 7396 registry_factory.cpp:188] table registry users plugin caused exception: no state 80: E20250611 01:13:27.886477 7396 virtual_table.cpp:1052] Exception while executing table jetbrains_plugins: no state

ksykulev · 2025-06-11T05:12:49Z

The path was incorrect on windows. It is now fixed and returning correct results.

lucasmrod

LGTM!

ksykulev · 2025-06-11T22:08:22Z

The linux paths were incorrect. 🤦

Tested and corrected.

ksykulev · 2025-06-11T22:10:57Z

Just for completeness a screenshot from my mac

ksykulev requested review from a team as code owners June 10, 2025 00:16

ksykulev commented Jun 10, 2025

View reviewed changes

ksykulev force-pushed the jetbrains-plugins-table branch from f538480 to 573fb4d Compare June 10, 2025 00:25

ksykulev commented Jun 10, 2025

View reviewed changes

ksykulev force-pushed the jetbrains-plugins-table branch 3 times, most recently from c5d4c54 to 292cba1 Compare June 10, 2025 15:52

ksykulev commented Jun 10, 2025

View reviewed changes

ksykulev force-pushed the jetbrains-plugins-table branch 4 times, most recently from ca7c738 to 3c0c57a Compare June 10, 2025 20:20

ksykulev commented Jun 10, 2025

View reviewed changes

lucasmrod reviewed Jun 10, 2025

View reviewed changes

ksykulev force-pushed the jetbrains-plugins-table branch 2 times, most recently from a762135 to c86bb40 Compare June 11, 2025 03:23

ksykulev commented Jun 11, 2025

View reviewed changes

ksykulev force-pushed the jetbrains-plugins-table branch 2 times, most recently from e7b2b71 to 55db4dd Compare June 11, 2025 04:38

Added jetbrains_plugins table

4b56279

ksykulev force-pushed the jetbrains-plugins-table branch from 55db4dd to 4b56279 Compare June 11, 2025 05:10

lucasmrod previously approved these changes Jun 11, 2025

View reviewed changes

fixing linux paths

8a1df0f

ksykulev dismissed lucasmrod’s stale review via 8a1df0f June 11, 2025 22:04

fixing formatting

78f1ccd

lucasmrod approved these changes Jun 11, 2025

View reviewed changes

zwass merged commit 2e1a79d into osquery:master Jun 11, 2025
22 checks passed

Uh oh!

Added jetbrains_plugins table #8623

Added jetbrains_plugins table #8623

Uh oh!

Conversation

ksykulev commented Jun 10, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

lucasmrod left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ksykulev commented Jun 11, 2025

Uh oh!

lucasmrod left a comment

Choose a reason for hiding this comment

Uh oh!

ksykulev commented Jun 11, 2025

Uh oh!

ksykulev commented Jun 11, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants