What happens
dm discover file-report <run-id> prints [] on stdout, prints nothing on
stderr, and exits 0 in three conditions:
- the run is still in progress
- the run failed
- the run is a database discovery run, not a file discovery run
Why this is a problem
A completed file run that found no sensitive data gives the same output.
The caller cannot see the difference. An agent that calls file-report after
run start reads "the run scanned nothing" as "the run found nothing".
Cause
The server answers with HTTP 200 and an empty list in all three conditions.
The 404 handler in the command does not run.
Suggested fix
When the report is empty, get the run status.
- For a run that is not in a final state, abort with the hint from
_abort_if_run_output_missing: "Discovery output is written once the run
reaches a final state."
- For a database run, abort with a different message.
Source
Issue found here.
What happens
dm discover file-report <run-id>prints[]on stdout, prints nothing onstderr, and exits 0 in three conditions:
Why this is a problem
A completed file run that found no sensitive data gives the same output.
The caller cannot see the difference. An agent that calls
file-reportafterrun startreads "the run scanned nothing" as "the run found nothing".Cause
The server answers with HTTP 200 and an empty list in all three conditions.
The 404 handler in the command does not run.
Suggested fix
When the report is empty, get the run status.
_abort_if_run_output_missing: "Discovery output is written once the runreaches a final state."
Source
Issue found here.