Merge branch 'jumplists' into automatic_jumplist

Author: brian-mckinney

x-pack/osquerybeat/ext/osquery-extension/pkg/jumplists/custom.go

@@ -27,27 +27,28 @@ func ParseCustomJumplistFile(filePath string, userProfile *UserProfile, log *log
 
 	// Carve out the Lnk objects from the file
 	lnks := carveLnkFiles(fileBytes, log)
-	entries := make([]*JumplistEntry, 0, len(lnks))
-	for _, lnk := range lnks {
-		entries = append(entries, &JumplistEntry{Lnk: lnk})
-	}
 
 	// If the jumplist file is empty, return an error jlecmd does this as well
 	if len(lnks) == 0 {
 		return nil, fmt.Errorf("custom jumplist file %s is empty", filePath)
 	}
 
 	// Look up the application id and create the metadata
-	jumpListMeta := &JumplistMeta{
+	jumplistMeta := &JumplistMeta{
 		UserProfile:   userProfile,
 		ApplicationId: GetAppIdFromFileName(filePath, log),
 		JumplistType:  JumplistTypeCustom,
 		Path:          filePath,
 	}
 
+	entries := make([]*JumplistEntry, 0, len(lnks))
+	for _, lnk := range lnks {
+		entries = append(entries, &JumplistEntry{Lnk: lnk})
+	}
+
 	// Combine the metadata and the entries into a Jumplist object
 	customJumplist := &Jumplist{
-		JumplistMeta: jumpListMeta,
+		JumplistMeta: jumplistMeta,
 		entries:      entries,
 	}
 	return customJumplist, nil

x-pack/osquerybeat/ext/osquery-extension/pkg/jumplists/jumplists.go

@@ -26,6 +26,7 @@ const (
 	JumplistTypeAutomatic JumplistType = 2
 )
 
+// JumplistMeta is the metadata for a jump list.
 // JumplistMeta is the metadata for a jump list.
 // It contains the application ID, jump list type, path to the jump list file,
 // and any jumplist type specific metadata.  The embedded fields
@@ -85,6 +86,8 @@ func GetColumns() []table.ColumnDefinition {
 	return columns
 }
 
+// GetGenerateFunc returns a function that can be used to generate a table of JumplistRow objects.
+// It returns a function that can be used to generate a table of JumplistRow objects.
 // matchesFilters is a helper function that checks if a row matches the given filters.
 func matchesFilters(row JumplistRow, filters []filters.Filter) bool {
 	for _, filter := range filters {