update(cloudtrail): Update ct.resources handling

Generalize our array length check. Use strings.TrimSuffix in order to avoid a potential string under-read. Signed-off-by: Gerald Combs <[email protected]>
falcosecurity · Jun 17, 2024 · fbd9f48 · fbd9f48
1 parent b31ad61
commit fbd9f48
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 5 deletions.
diff --git a/plugins/cloudtrail/pkg/cloudtrail/cloudtrail.go b/plugins/cloudtrail/pkg/cloudtrail/cloudtrail.go
@@ -48,7 +48,7 @@ const (
 	PluginName               = "cloudtrail"
 	PluginDescription        = "reads cloudtrail JSON data saved to file in the directory specified in the settings"
 	PluginContact            = "github.com/falcosecurity/plugins/"
-	PluginVersion            = "0.12.2"
+	PluginVersion            = "0.12.3"
 	PluginEventSource        = "aws_cloudtrail"
 )
 

diff --git a/plugins/cloudtrail/pkg/cloudtrail/extract.go b/plugins/cloudtrail/pkg/cloudtrail/extract.go
@@ -532,16 +532,14 @@ func getfieldStr(jdata *fastjson.Value, field string) (bool, string) {
 	case "ct.resources":
 		var resources string = ""
 		rlist := jdata.GetArray("resources")
-		if rlist == nil {
+		if rlist == nil || len(rlist) == 0 {
 			return false, ""
 		}
 		for _, resource := range rlist {
 			resources += string(resource.MarshalTo(nil))
 			resources += ","
 		}
-		if resources[len(resources)-1] == ',' {
-			resources = resources[0 : len(resources)-1]
-		}
+		resources = strings.TrimSuffix(resources, ",")
 		if resources == "" {
 			return false, ""
 		}