Software inventory & vulnerabilities: Add Adobe plugins - #50006
Merged
juan-fdz-hawa merged 10 commits intoAug 6, 2026
Merged
Conversation
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #50006 +/- ##
==========================================
- Coverage 68.26% 68.25% -0.02%
==========================================
Files 3949 3950 +1
Lines 252481 252648 +167
Branches 13291 13297 +6
==========================================
+ Hits 172348 172434 +86
- Misses 64698 64779 +81
Partials 15435 15435
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
juan-fdz-hawa
had a problem deploying
to
Docker Hub
August 5, 2026 11:08 — with 
GitHub Actions
Error
GitHub Actions
Error
juan-fdz-hawa
temporarily deployed
to
Docker Hub
August 5, 2026 11:11 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
Relates to #49062 Add `adobe_plugins` to `SOURCE_TYPE_CONVERSION` so the Type column resolves "Plugin (Adobe)" everywhere `formatSoftwareType` is used: software inventory, software versions, software title details, host details, and device software.
Closes #49061 Adobe plugins are inventory-only: no vulnerability data source maps an Adobe CEP or UXP extension to a CVE. Adobe files CVEs against the host application (Photoshop, Acrobat, and so on) keyed to that app's version, which Fleet already scans via the apps/programs sources, so any match on an extension row would be a false positive pinned to the wrong version. Added adobe_plugins to the excluded sources on the NVD/CPE software iterator so they are excluded from vuln scanning.
Resolves #49060 Ingest fleetd's adobe_plugins table as a new `adobe_plugins` software source, so Adobe Creative Cloud CEP and UXP extensions show up in inventory on macOS and Windows hosts. osquery-perf gets -common_adobe_plugins_software_count and -software_adobe_plugins_query_fail_prob.
35 tasks
getMatchedSoftwareIcon matches on name before source, and the name map holds "adobe creative cloud", "adobe acrobat" and friends. A plugin named "Adobe Creative Cloud Libraries" therefore resolved to the Creative Cloud application icon and never reached the source map. Add SOURCE_ICON_OVERRIDES_NAME, checked before the loose name match, letting a source's icon win. Only adobe_plugins opts in, so a VSCode extension named "Docker" still gets the Docker icon. Adds the first tests for getMatchedSoftwareIcon, and repaints the icon's backing rect #fff to match the other source icons. Review follow-ups, no behavior change: parse the detail query's SELECT list on commas so reformatting can't break the column-drift guard; rename the "table doesn't exist" test case to say what it covers; note the query has no ingest func; validate the adobe_plugins uninstall counts in osquery-perf.
juan-fdz-hawa
force-pushed
the
45414-software-inventory-vulnerabilities-add-adobe-plugins
branch
from
August 5, 2026 11:45
d955acf to
9b99ca4
Compare
juan-fdz-hawa
temporarily deployed
to
Docker Hub
August 5, 2026 11:45 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
juan-fdz-hawa
marked this pull request as ready for review
August 5, 2026 11:45
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (4)
🚧 Files skipped from review as they are similar to previous changes (4)
WalkthroughAdds Adobe CEP and UXP plugin discovery to macOS and Windows software inventory. The server maps plugin metadata into software records and installed paths. Possibly related PRs
🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (1 warning, 1 inconclusive)
✅ Passed checks (3 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@cmd/osquery-perf/agent.go`:
- Around line 4119-4130: Add non-negative validation for
commonAdobePluginsSoftwareUninstallCount and
uniqueAdobePluginsSoftwareUninstallCount alongside the existing Adobe plugin
count checks, before agent creation. Use the same log.Fatalf validation pattern
and argument names, while preserving the existing upper-bound checks against
their corresponding install counts.
In `@frontend/pages/SoftwarePage/components/icons/AdobePlugin.tsx`:
- Around line 5-12: Update the root SVG element in AdobePlugin to include
viewBox="0 0 32 32", matching the 32×32 coordinate system used by its paths.
Preserve the existing props and SVG content.
In `@frontend/pages/SoftwarePage/components/icons/index.ts`:
- Around line 2407-2419: The icon resolution flow should apply source overrides
before strict name matching, so Adobe sources select AdobePlugin even when the
plugin name matches another icon such as Zoom. Update the surrounding resolver
logic before matchStrictNameSourceToIcon to prioritize
SOURCE_ICON_OVERRIDES_NAME and assign the result from
SOFTWARE_SOURCE_TO_ICON_MAP, then add a regression test covering name "zoom"
with source "adobe_plugins".
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 85a8f083-3bb4-4e51-bd08-c857118eae6f
📒 Files selected for processing (13)
changes/45414-adobe-pluginscmd/osquery-perf/agent.gofrontend/interfaces/software.tests.tsfrontend/interfaces/software.tsfrontend/pages/SoftwarePage/components/icons/AdobePlugin.tsxfrontend/pages/SoftwarePage/components/icons/index.tests.tsfrontend/pages/SoftwarePage/components/icons/index.tsserver/service/osquery.goserver/service/osquery_test.goserver/service/osquery_utils/queries.goserver/service/osquery_utils/queries_test.goserver/vulnerabilities/nvd/cpe.goserver/vulnerabilities/nvd/cpe_test.go
Document the software_adobe_plugins host vitals query reference. Also note in the vulnerability processing article that Fleet doesn't scan Adobe plugins.
juan-fdz-hawa
had a problem deploying
to
Docker Hub
August 5, 2026 12:10 — with
GitHub Actions
Error
GitHub Actions
Error
juan-fdz-hawa
temporarily deployed
to
Docker Hub
August 5, 2026 12:15 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
The software_adobe_plugins query mapped the table's host_application into extension_for. That column lists the Adobe applications from the plugin's manifest, so it changes when a plugin gains or drops support for one, while the plugin keeps its bundle identifier. extension_for is part of a software title's identity, so Fleet treats the changed value as a new title. But software_titles also has a unique key on (bundle_identifier, additional_identifier), which ignores extension_for and is 0 for every source except ios_apps and ipados_apps. The second title collides, its INSERT IGNORE is dropped silently, and the follow-up lookup still keys on extension_for, so the software row is written with a NULL title_id and logs "inserting software without title_id" on every check-in. It never recovers, because the blocking title never goes away, and a row with no title can't appear on the Software page. Adobe plugins are the first source to combine a real bundle identifier with a varying extension_for: the browser and IDE extension sources report no bundle identifier, and every source that does report one hardcodes extension_for to empty. Blanking it makes Adobe plugins behave like those sources. Nothing is lost, because the Type column shows a flat "Plugin (Adobe)" and never displays the host application. The underlying schema/matcher disagreement is untouched and still affects any future source that varies extension_for under a stable bundle identifier. Also drop the frontend guard that suppressed the Type suffix for adobe_plugins, now that the field is always empty, update the osquery-perf generator and the ingestion fixtures to match, and regenerate the host vitals reference.
juan-fdz-hawa
temporarily deployed
to
Docker Hub
August 5, 2026 13:30 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
| SELECT | ||
| name, | ||
| version, | ||
| bundle_id AS bundle_identifier, |
Member
There was a problem hiding this comment.
software_adobe_plugins selects bundle_id AS bundle_identifier, putting plugin titles on the source-agnostic software_titles unique keys — so a plugin whose id collides with a macOS app's bundle id, or with an earlier NULL-bundle title created from the same extension dir on a host with an unreadable manifest, gets its title INSERT IGNORE'd and its software row stuck at title_id = NULL (invisible on the Software page, error logged every check-in).
We should select '' AS bundle_identifier like every other extension source (vscode_extensions, jetbrains_plugins) and let titles dedupe on (name, source, extension_for).
dantecatalfamo
approved these changes
Aug 6, 2026
sharon-fdm
reviewed
Aug 6, 2026
sharon-fdm
left a comment
sharon-fdm
left a comment
Collaborator
There was a problem hiding this comment.
I only reviewed :
docs/Contributing/product-groups/orchestration/understanding-host-vitals.md
Relying on Dante's approval for the rest of the files.
sharon-fdm
approved these changes
Aug 6, 2026
juan-fdz-hawa
deleted the
45414-software-inventory-vulnerabilities-add-adobe-plugins
branch
August 6, 2026 21:01
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Resolves #45414
Checklist for submitter
If some of the following don't apply, delete the relevant line.
changes/,orbit/changes/oree/fleetd-chrome/changes.See Changes files for more information.
Testing
Added/updated automated tests
Where appropriate, automated tests simulate multiple hosts and test for host isolation (updates to one hosts's records do not affect another)
QA'd all new/changed functionality manually
Summary by CodeRabbit
Summary
New Features
Bug Fixes
Tests