update(cloudtrail): Update ct.resources handling

Generalize our array length check. Use strings.TrimSuffix in order to avoid a potential string under-read. Signed-off-by: Gerald Combs <[email protected]>
falcosecurity · Jun 9, 2024 · 82feae2 · 82feae2
1 parent ef2a608
commit 82feae2
Showing 1 changed file with 2 additions and 4 deletions.
diff --git a/plugins/cloudtrail/pkg/cloudtrail/extract.go b/plugins/cloudtrail/pkg/cloudtrail/extract.go
@@ -532,16 +532,14 @@ func getfieldStr(jdata *fastjson.Value, field string) (bool, string) {
 	case "ct.resources":
 		var resources string = ""
 		rlist := jdata.GetArray("resources")
-		if rlist == nil {
+		if len(rlist) == 0 {
 			return false, ""
 		}
 		for _, resource := range rlist {
 			resources += string(resource.MarshalTo(nil))
 			resources += ","
 		}
-		if resources[len(resources)-1] == ',' {
-			resources = resources[0 : len(resources)-1]
-		}
+		resources = strings.TrimSuffix(resources, ",")
 		if resources == "" {
 			return false, ""
 		}