{"action":"created","comment":{"url":"https://api.github.com/repos/trailofbits/osquery/pulls/comments/64277128","id":64277128,"diff_hunk":"@@ -0,0 +1,555 @@\n+/*\n+*  Copyright (c) 2014-present, Facebook, Inc.\n+*  All rights reserved.\n+*\n+*  This source code is licensed under the BSD-style license found in the\n+*  LICENSE file in the root directory of this source tree. An additional grant\n+*  of patent rights can be found in the PATENTS file in the same directory.\n+*\n+*/\n+\n+#include <AclAPI.h>\n+#include <io.h>\n+#include <sddl.h>\n+#include <ShlObj.h>\n+\n+#include <memory>\n+#include <regex>\n+#include <string>\n+#include <vector>\n+#include <sstream>\n+\n+#include <boost/filesystem.hpp>\n+#include <boost/optional.hpp>\n+\n+#include \"osquery/core/process.h\"\n+#include \"osquery/filesystem/fileops.h\"\n+\n+namespace fs = boost::filesystem;\n+\n+namespace osquery {\n+\n+#define CHMOD_READ    SYNCHRONIZE | READ_CONTROL | FILE_READ_ATTRIBUTES | FILE_READ_EA | FILE_READ_DATA\n+#define CHMOD_WRITE   FILE_WRITE_ATTRIBUTES | FILE_WRITE_EA | FILE_WRITE_DATA | FILE_APPEND_DATA | DELETE\n+#define CHMOD_EXECUTE FILE_EXECUTE \n+\n+using SidObject = std::unique_ptr<unsigned char>;\n+using AclObject = std::unique_ptr<unsigned char>;\n+\n+class WindowsFindFiles {\n+public:\n+  explicit WindowsFindFiles(fs::path path) : path_(path) {\n+    handle_ = ::FindFirstFileA(path.make_preferred().string().c_str(), &fd_);\n+  }\n+\n+  ~WindowsFindFiles() {\n+    if (handle_ != INVALID_HANDLE_VALUE) {\n+      FindClose(handle_);\n+      handle_ = INVALID_HANDLE_VALUE;\n+    }\n+  }\n+\n+  std::vector<fs::path> get() {\n+    std::vector<fs::path> results;\n+\n+    if (handle_ != INVALID_HANDLE_VALUE) {\n+      do {\n+        std::string component(fd_.cFileName);\n+        if (component != \".\" && component != \"..\") {\n+          if (path_.has_parent_path()) {\n+            results.push_back(path_.parent_path() / component);\n+          } else {\n+            results.push_back(fs::path(component));\n+          }\n+        }\n+\n+        ::RtlZeroMemory(&fd_, sizeof(fd_));\n+      } while (::FindNextFileA(handle_, &fd_));\n+    }\n+\n+    return results;\n+  }\n+\n+  std::vector<fs::path> getDirectories() {\n+    std::vector<fs::path> results;\n+    for (auto const &result : get()) {\n+      if (fs::is_directory(result)) {\n+        results.push_back(result);\n+      }\n+    }\n+    return results;\n+  }\n+\n+private:\n+  HANDLE handle_{ INVALID_HANDLE_VALUE };\n+  WIN32_FIND_DATAA fd_{ 0 };\n+\n+  fs::path path_;\n+};\n+\n+static bool hasGlobBraces(const std::string &glob) {\n+  int brace_depth = 0;\n+  bool has_brace = false;\n+\n+  for (size_t i = 0; i < glob.size(); i++) {\n+    switch (glob[i]) {\n+    case '{':\n+      brace_depth += 1;\n+      has_brace = true;\n+      break;\n+    case '}':\n+      brace_depth -= 1;\n+      break;\n+    default:\n+      break;\n+    }\n+  }\n+  return (brace_depth == 0 && has_brace);\n+}\n+\n+/// Inspired by glob-to-regexp node package\n+static std::string globToRegex(const std::string &glob) {\n+  bool in_group = false;\n+  std::string regex(\"\");\n+\n+  for (size_t i = 0; i < glob.size(); i++) {\n+    char c = glob[i];\n+\n+    switch (c) {\n+    case '\\\\':\n+    case '/':\n+    case '$':\n+    case '^':\n+    case '+':\n+    case '.':\n+    case '(':\n+    case ')':\n+    case '=':\n+    case '!':\n+    case '|':\n+      regex += \"\\\\\";\n+      regex += c;\n+      break;\n+    case '?':\n+      regex += \".\";\n+      break;\n+    case '[':\n+    case ']':\n+      regex += c;\n+      break;\n+    case '{':\n+      in_group = true;\n+      regex += \"(\";\n+      break;\n+    case '}':\n+      in_group = false;\n+      regex += \")\";\n+      break;\n+    case ',':\n+      regex += \"|\";\n+      break;\n+    case '*':\n+      regex += \".*\";\n+      break;\n+    default:\n+      regex += c;\n+      break;\n+    }\n+  }\n+\n+  return \"^\" + regex + \"$\";\n+}\n+\n+static DWORD getNewAclSize(PACL dacl, PSID sid, ACL_SIZE_INFORMATION& info, bool needs_allowed, bool needs_denied) {\n+  DWORD acl_size = info.AclBytesInUse;\n+  if (needs_allowed) {\n+    acl_size += sizeof(ACCESS_ALLOWED_ACE) + ::GetLengthSid(sid) - sizeof(DWORD);\n+  }\n+\n+  if (needs_denied) {\n+    acl_size += sizeof(ACCESS_DENIED_ACE) + ::GetLengthSid(sid) - sizeof(DWORD);\n+  }\n+\n+  PACE_HEADER entry = nullptr;\n+  for (DWORD i = 0; i < info.AceCount; i++) {\n+    if (!::GetAce(dacl, i, (LPVOID *)&entry)) {\n+      return 0;\n+    }\n+\n+    if (entry->AceType == ACCESS_ALLOWED_ACE_TYPE &&\n+      ::EqualSid(sid, &((ACCESS_ALLOWED_ACE *)entry)->SidStart)) {\n+      acl_size -= sizeof(ACCESS_ALLOWED_ACE) + ::GetLengthSid(sid) - sizeof(DWORD);\n+    }\n+\n+    if (entry->AceType == ACCESS_DENIED_ACE_TYPE &&\n+      ::EqualSid(sid, &((ACCESS_DENIED_ACE *)entry)->SidStart)) {\n+      acl_size -= sizeof(ACCESS_DENIED_ACE) + ::GetLengthSid(sid) - sizeof(DWORD);\n+    }\n+\n+    if (entry->AceFlags & INHERITED_ACE) {\n+      break;\n+    }\n+  }\n+\n+  return acl_size;\n+}\n+\n+static AclObject modifyAcl(PACL acl, PSID target, bool allow_read, bool allow_write, bool allow_exec) {\n+  if (acl == nullptr && target == nullptr) {\n+    return std::move(AclObject());\n+  }\n+\n+  DWORD allow_mask = 0;\n+  DWORD deny_mask = 0;\n+\n+  ACL_SIZE_INFORMATION info = { 0 };\n+  info.AclBytesInUse = sizeof(ACL);\n+\n+  if (!::GetAclInformation(acl, &info, sizeof(info), AclSizeInformation)) {\n+    return std::move(AclObject());\n+  }\n+\n+  if (allow_read) {\n+    allow_mask = CHMOD_READ;\n+  }\n+  else {\n+    deny_mask = CHMOD_READ;\n+  }\n+\n+  if (allow_write) {\n+    allow_mask |= CHMOD_WRITE;\n+  }\n+  else {\n+    deny_mask |= CHMOD_WRITE;\n+  }\n+\n+  if (allow_exec) {\n+    allow_mask |= CHMOD_EXECUTE;\n+  }\n+  else {\n+    deny_mask |= CHMOD_EXECUTE;\n+  }\n+\n+  DWORD new_acl_size = 0;\n+  if (allow_read && allow_write && allow_exec) {\n+    new_acl_size = getNewAclSize(acl, target, info, true, false);\n+  }\n+  else if (!allow_read && !allow_write && !allow_exec) {\n+    new_acl_size = getNewAclSize(acl, target, info, false, true);\n+  }\n+  else {\n+    new_acl_size = getNewAclSize(acl, target, info, true, true);\n+  }\n+\n+  AclObject new_acl_buffer(new unsigned char[new_acl_size]);\n+  PACL new_acl = reinterpret_cast<PACL>(new_acl_buffer.get());\n+\n+  if (!::InitializeAcl(new_acl, new_acl_size, ACL_REVISION)) {\n+    return std::move(AclObject());\n+  }\n+\n+  DWORD i = 0;\n+  PACE_HEADER entry = nullptr;\n+  for (i = 0; i < info.AceCount; i++) {\n+    if (!::GetAce(acl, i, (LPVOID *)&entry)) {\n+      return std::move(AclObject());\n+    }\n+\n+    if (entry->AceFlags & INHERITED_ACE) {\n+      break;\n+    }\n+\n+    if ((entry->AceType == ACCESS_ALLOWED_ACE_TYPE &&\n+      ::EqualSid(target, &((ACCESS_ALLOWED_ACE *)entry)->SidStart)) ||\n+      (entry->AceType == ACCESS_DENIED_ACE_TYPE &&\n+        ::EqualSid(target, &((ACCESS_DENIED_ACE *)entry)->SidStart))) {\n+      continue;\n+    }\n+\n+    if (!::AddAce(new_acl, ACL_REVISION, MAXDWORD, (LPVOID)entry, entry->AceSize)) {\n+      return std::move(AclObject());\n+    }\n+  }\n+\n+  if (deny_mask != 0 &&\n+    !::AddAccessDeniedAce(new_acl, ACL_REVISION, deny_mask, target)) {\n+    return std::move(AclObject());\n+  }\n+\n+  if (allow_mask != 0 &&\n+    !::AddAccessAllowedAce(new_acl, ACL_REVISION, allow_mask, target)) {\n+    return std::move(AclObject());\n+  }\n+\n+  for (; i < info.AceCount; i++) {\n+    if (!::GetAce(acl, i, (LPVOID *)&entry)) {\n+      return std::move(AclObject());\n+    }\n+\n+    if (!::AddAce(new_acl, ACL_REVISION, MAXDWORD, (LPVOID)entry, entry->AceSize)) {\n+      return std::move(AclObject());\n+    }\n+  }\n+\n+  return std::move(new_acl_buffer);\n+}\n+\n+PlatformFile::PlatformFile(const std::string& path, int mode, int perms) {\n+  DWORD access_mask = 0;\n+  DWORD flags_and_attrs = 0;\n+  DWORD creation_disposition = 0;\n+  std::unique_ptr<SECURITY_ATTRIBUTES> security_attrs;\n+\n+  if (mode & PF_READ) {\n+    access_mask |= GENERIC_READ;\n+  }\n+\n+  if (mode & PF_WRITE) {\n+    access_mask |= GENERIC_WRITE;\n+  }\n+\n+  switch (PF_GET_OPTIONS(mode)) {\n+    case PF_GET_OPTIONS(PF_CREATE_NEW):\n+      creation_disposition = CREATE_NEW;\n+      break;\n+    case PF_GET_OPTIONS(PF_CREATE_ALWAYS):\n+      creation_disposition = CREATE_ALWAYS;\n+      break;\n+    case PF_GET_OPTIONS(PF_OPEN_EXISTING):\n+      creation_disposition = OPEN_EXISTING;\n+      break;\n+    case PF_GET_OPTIONS(PF_TRUNCATE):\n+      creation_disposition = TRUNCATE_EXISTING;\n+      break;\n+    default:\n+      break;\n+  }\n+\n+  if (mode & PF_NONBLOCK) {","path":"osquery/filesystem/windows/fileops.cpp","position":328,"original_position":328,"commit_id":"507fdb18689b6ed903a368401802ef53c0bbb969","original_commit_id":"507fdb18689b6ed903a368401802ef53c0bbb969","user":{"login":"artemdinaburg","id":1051838,"avatar_url":"https://avatars.githubusercontent.com/u/1051838?v=3","gravatar_id":"","url":"https://api.github.com/users/artemdinaburg","html_url":"https://github.com/artemdinaburg","followers_url":"https://api.github.com/users/artemdinaburg/followers","following_url":"https://api.github.com/users/artemdinaburg/following{/other_user}","gists_url":"https://api.github.com/users/artemdinaburg/gists{/gist_id}","starred_url":"https://api.github.com/users/artemdinaburg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/artemdinaburg/subscriptions","organizations_url":"https://api.github.com/users/artemdinaburg/orgs","repos_url":"https://api.github.com/users/artemdinaburg/repos","events_url":"https://api.github.com/users/artemdinaburg/events{/privacy}","received_events_url":"https://api.github.com/users/artemdinaburg/received_events","type":"User","site_admin":false},"body":"Same suggestion about naked `&` in `if` statements...","created_at":"2016-05-23T19:51:06Z","updated_at":"2016-05-23T19:51:06Z","html_url":"https://github.com/trailofbits/osquery/pull/1#discussion_r64277128","pull_request_url":"https://api.github.com/repos/trailofbits/osquery/pulls/1","_links":{"self":{"href":"https://api.github.com/repos/trailofbits/osquery/pulls/comments/64277128"},"html":{"href":"https://github.com/trailofbits/osquery/pull/1#discussion_r64277128"},"pull_request":{"href":"https://api.github.com/repos/trailofbits/osquery/pulls/1"}}},"pull_request":{"url":"https://api.github.com/repos/trailofbits/osquery/pulls/1","id":71104790,"html_url":"https://github.com/trailofbits/osquery/pull/1","diff_url":"https://github.com/trailofbits/osquery/pull/1.diff","patch_url":"https://github.com/trailofbits/osquery/pull/1.patch","issue_url":"https://api.github.com/repos/trailofbits/osquery/issues/1","number":1,"state":"open","locked":false,"title":"Filesystem abstractions/codebase and tests","user":{"login":"artemdinaburg","id":1051838,"avatar_url":"https://avatars.githubusercontent.com/u/1051838?v=3","gravatar_id":"","url":"https://api.github.com/users/artemdinaburg","html_url":"https://github.com/artemdinaburg","followers_url":"https://api.github.com/users/artemdinaburg/followers","following_url":"https://api.github.com/users/artemdinaburg/following{/other_user}","gists_url":"https://api.github.com/users/artemdinaburg/gists{/gist_id}","starred_url":"https://api.github.com/users/artemdinaburg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/artemdinaburg/subscriptions","organizations_url":"https://api.github.com/users/artemdinaburg/orgs","repos_url":"https://api.github.com/users/artemdinaburg/repos","events_url":"https://api.github.com/users/artemdinaburg/events{/privacy}","received_events_url":"https://api.github.com/users/artemdinaburg/received_events","type":"User","site_admin":false},"body":"PR for internal code review.","created_at":"2016-05-23T19:13:16Z","updated_at":"2016-05-23T19:51:06Z","closed_at":null,"merged_at":null,"merge_commit_sha":"d4708e7461db654fe764f884c23a60f026f9a447","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/trailofbits/osquery/pulls/1/commits","review_comments_url":"https://api.github.com/repos/trailofbits/osquery/pulls/1/comments","review_comment_url":"https://api.github.com/repos/trailofbits/osquery/pulls/comments{/number}","comments_url":"https://api.github.com/repos/trailofbits/osquery/issues/1/comments","statuses_url":"https://api.github.com/repos/trailofbits/osquery/statuses/507fdb18689b6ed903a368401802ef53c0bbb969","head":{"label":"trailofbits:filesystem-abstractions/codebase-and-tests","ref":"filesystem-abstractions/codebase-and-tests","sha":"507fdb18689b6ed903a368401802ef53c0bbb969","user":{"login":"trailofbits","id":2314423,"avatar_url":"https://avatars.githubusercontent.com/u/2314423?v=3","gravatar_id":"","url":"https://api.github.com/users/trailofbits","html_url":"https://github.com/trailofbits","followers_url":"https://api.github.com/users/trailofbits/followers","following_url":"https://api.github.com/users/trailofbits/following{/other_user}","gists_url":"https://api.github.com/users/trailofbits/gists{/gist_id}","starred_url":"https://api.github.com/users/trailofbits/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/trailofbits/subscriptions","organizations_url":"https://api.github.com/users/trailofbits/orgs","repos_url":"https://api.github.com/users/trailofbits/repos","events_url":"https://api.github.com/users/trailofbits/events{/privacy}","received_events_url":"https://api.github.com/users/trailofbits/received_events","type":"Organization","site_admin":false},"repo":{"id":54419021,"name":"osquery","full_name":"trailofbits/osquery","owner":{"login":"trailofbits","id":2314423,"avatar_url":"https://avatars.githubusercontent.com/u/2314423?v=3","gravatar_id":"","url":"https://api.github.com/users/trailofbits","html_url":"https://github.com/trailofbits","followers_url":"https://api.github.com/users/trailofbits/followers","following_url":"https://api.github.com/users/trailofbits/following{/other_user}","gists_url":"https://api.github.com/users/trailofbits/gists{/gist_id}","starred_url":"https://api.github.com/users/trailofbits/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/trailofbits/subscriptions","organizations_url":"https://api.github.com/users/trailofbits/orgs","repos_url":"https://api.github.com/users/trailofbits/repos","events_url":"https://api.github.com/users/trailofbits/events{/privacy}","received_events_url":"https://api.github.com/users/trailofbits/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/trailofbits/osquery","description":"SQL powered operating system instrumentation, monitoring, and analytics.","fork":true,"url":"https://api.github.com/repos/trailofbits/osquery","forks_url":"https://api.github.com/repos/trailofbits/osquery/forks","keys_url":"https://api.github.com/repos/trailofbits/osquery/keys{/key_id}","collaborators_url":"https://api.github.com/repos/trailofbits/osquery/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/trailofbits/osquery/teams","hooks_url":"https://api.github.com/repos/trailofbits/osquery/hooks","issue_events_url":"https://api.github.com/repos/trailofbits/osquery/issues/events{/number}","events_url":"https://api.github.com/repos/trailofbits/osquery/events","assignees_url":"https://api.github.com/repos/trailofbits/osquery/assignees{/user}","branches_url":"https://api.github.com/repos/trailofbits/osquery/branches{/branch}","tags_url":"https://api.github.com/repos/trailofbits/osquery/tags","blobs_url":"https://api.github.com/repos/trailofbits/osquery/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/trailofbits/osquery/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/trailofbits/osquery/git/refs{/sha}","trees_url":"https://api.github.com/repos/trailofbits/osquery/git/trees{/sha}","statuses_url":"https://api.github.com/repos/trailofbits/osquery/statuses/{sha}","languages_url":"https://api.github.com/repos/trailofbits/osquery/languages","stargazers_url":"https://api.github.com/repos/trailofbits/osquery/stargazers","contributors_url":"https://api.github.com/repos/trailofbits/osquery/contributors","subscribers_url":"https://api.github.com/repos/trailofbits/osquery/subscribers","subscription_url":"https://api.github.com/repos/trailofbits/osquery/subscription","commits_url":"https://api.github.com/repos/trailofbits/osquery/commits{/sha}","git_commits_url":"https://api.github.com/repos/trailofbits/osquery/git/commits{/sha}","comments_url":"https://api.github.com/repos/trailofbits/osquery/comments{/number}","issue_comment_url":"https://api.github.com/repos/trailofbits/osquery/issues/comments{/number}","contents_url":"https://api.github.com/repos/trailofbits/osquery/contents/{+path}","compare_url":"https://api.github.com/repos/trailofbits/osquery/compare/{base}...{head}","merges_url":"https://api.github.com/repos/trailofbits/osquery/merges","archive_url":"https://api.github.com/repos/trailofbits/osquery/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/trailofbits/osquery/downloads","issues_url":"https://api.github.com/repos/trailofbits/osquery/issues{/number}","pulls_url":"https://api.github.com/repos/trailofbits/osquery/pulls{/number}","milestones_url":"https://api.github.com/repos/trailofbits/osquery/milestones{/number}","notifications_url":"https://api.github.com/repos/trailofbits/osquery/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/trailofbits/osquery/labels{/name}","releases_url":"https://api.github.com/repos/trailofbits/osquery/releases{/id}","deployments_url":"https://api.github.com/repos/trailofbits/osquery/deployments","created_at":"2016-03-21T20:06:09Z","updated_at":"2016-05-19T13:57:38Z","pushed_at":"2016-05-23T19:13:16Z","git_url":"git://github.com/trailofbits/osquery.git","ssh_url":"git@github.com:trailofbits/osquery.git","clone_url":"https://github.com/trailofbits/osquery.git","svn_url":"https://github.com/trailofbits/osquery","homepage":"https://osquery.io","size":8065,"stargazers_count":2,"watchers_count":2,"language":"C++","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":1,"mirror_url":null,"open_issues_count":1,"forks":1,"open_issues":1,"watchers":2,"default_branch":"master"}},"base":{"label":"trailofbits:master","ref":"master","sha":"26ad131c382e27b97897eb09ad427710346f7c6f","user":{"login":"trailofbits","id":2314423,"avatar_url":"https://avatars.githubusercontent.com/u/2314423?v=3","gravatar_id":"","url":"https://api.github.com/users/trailofbits","html_url":"https://github.com/trailofbits","followers_url":"https://api.github.com/users/trailofbits/followers","following_url":"https://api.github.com/users/trailofbits/following{/other_user}","gists_url":"https://api.github.com/users/trailofbits/gists{/gist_id}","starred_url":"https://api.github.com/users/trailofbits/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/trailofbits/subscriptions","organizations_url":"https://api.github.com/users/trailofbits/orgs","repos_url":"https://api.github.com/users/trailofbits/repos","events_url":"https://api.github.com/users/trailofbits/events{/privacy}","received_events_url":"https://api.github.com/users/trailofbits/received_events","type":"Organization","site_admin":false},"repo":{"id":54419021,"name":"osquery","full_name":"trailofbits/osquery","owner":{"login":"trailofbits","id":2314423,"avatar_url":"https://avatars.githubusercontent.com/u/2314423?v=3","gravatar_id":"","url":"https://api.github.com/users/trailofbits","html_url":"https://github.com/trailofbits","followers_url":"https://api.github.com/users/trailofbits/followers","following_url":"https://api.github.com/users/trailofbits/following{/other_user}","gists_url":"https://api.github.com/users/trailofbits/gists{/gist_id}","starred_url":"https://api.github.com/users/trailofbits/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/trailofbits/subscriptions","organizations_url":"https://api.github.com/users/trailofbits/orgs","repos_url":"https://api.github.com/users/trailofbits/repos","events_url":"https://api.github.com/users/trailofbits/events{/privacy}","received_events_url":"https://api.github.com/users/trailofbits/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/trailofbits/osquery","description":"SQL powered operating system instrumentation, monitoring, and analytics.","fork":true,"url":"https://api.github.com/repos/trailofbits/osquery","forks_url":"https://api.github.com/repos/trailofbits/osquery/forks","keys_url":"https://api.github.com/repos/trailofbits/osquery/keys{/key_id}","collaborators_url":"https://api.github.com/repos/trailofbits/osquery/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/trailofbits/osquery/teams","hooks_url":"https://api.github.com/repos/trailofbits/osquery/hooks","issue_events_url":"https://api.github.com/repos/trailofbits/osquery/issues/events{/number}","events_url":"https://api.github.com/repos/trailofbits/osquery/events","assignees_url":"https://api.github.com/repos/trailofbits/osquery/assignees{/user}","branches_url":"https://api.github.com/repos/trailofbits/osquery/branches{/branch}","tags_url":"https://api.github.com/repos/trailofbits/osquery/tags","blobs_url":"https://api.github.com/repos/trailofbits/osquery/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/trailofbits/osquery/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/trailofbits/osquery/git/refs{/sha}","trees_url":"https://api.github.com/repos/trailofbits/osquery/git/trees{/sha}","statuses_url":"https://api.github.com/repos/trailofbits/osquery/statuses/{sha}","languages_url":"https://api.github.com/repos/trailofbits/osquery/languages","stargazers_url":"https://api.github.com/repos/trailofbits/osquery/stargazers","contributors_url":"https://api.github.com/repos/trailofbits/osquery/contributors","subscribers_url":"https://api.github.com/repos/trailofbits/osquery/subscribers","subscription_url":"https://api.github.com/repos/trailofbits/osquery/subscription","commits_url":"https://api.github.com/repos/trailofbits/osquery/commits{/sha}","git_commits_url":"https://api.github.com/repos/trailofbits/osquery/git/commits{/sha}","comments_url":"https://api.github.com/repos/trailofbits/osquery/comments{/number}","issue_comment_url":"https://api.github.com/repos/trailofbits/osquery/issues/comments{/number}","contents_url":"https://api.github.com/repos/trailofbits/osquery/contents/{+path}","compare_url":"https://api.github.com/repos/trailofbits/osquery/compare/{base}...{head}","merges_url":"https://api.github.com/repos/trailofbits/osquery/merges","archive_url":"https://api.github.com/repos/trailofbits/osquery/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/trailofbits/osquery/downloads","issues_url":"https://api.github.com/repos/trailofbits/osquery/issues{/number}","pulls_url":"https://api.github.com/repos/trailofbits/osquery/pulls{/number}","milestones_url":"https://api.github.com/repos/trailofbits/osquery/milestones{/number}","notifications_url":"https://api.github.com/repos/trailofbits/osquery/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/trailofbits/osquery/labels{/name}","releases_url":"https://api.github.com/repos/trailofbits/osquery/releases{/id}","deployments_url":"https://api.github.com/repos/trailofbits/osquery/deployments","created_at":"2016-03-21T20:06:09Z","updated_at":"2016-05-19T13:57:38Z","pushed_at":"2016-05-23T19:13:16Z","git_url":"git://github.com/trailofbits/osquery.git","ssh_url":"git@github.com:trailofbits/osquery.git","clone_url":"https://github.com/trailofbits/osquery.git","svn_url":"https://github.com/trailofbits/osquery","homepage":"https://osquery.io","size":8065,"stargazers_count":2,"watchers_count":2,"language":"C++","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":1,"mirror_url":null,"open_issues_count":1,"forks":1,"open_issues":1,"watchers":2,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/trailofbits/osquery/pulls/1"},"html":{"href":"https://github.com/trailofbits/osquery/pull/1"},"issue":{"href":"https://api.github.com/repos/trailofbits/osquery/issues/1"},"comments":{"href":"https://api.github.com/repos/trailofbits/osquery/issues/1/comments"},"review_comments":{"href":"https://api.github.com/repos/trailofbits/osquery/pulls/1/comments"},"review_comment":{"href":"https://api.github.com/repos/trailofbits/osquery/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/trailofbits/osquery/pulls/1/commits"},"statuses":{"href":"https://api.github.com/repos/trailofbits/osquery/statuses/507fdb18689b6ed903a368401802ef53c0bbb969"}}}}
{"actor":{"display_login":"artemdinaburg"}}