Skip to content

fix(utils): restore NormalizePath to fix headless /proc and dot paths#774

Open
yugal07 wants to merge 2 commits intokubescape:mainfrom
yugal07:normalising-path
Open

fix(utils): restore NormalizePath to fix headless /proc and dot paths#774
yugal07 wants to merge 2 commits intokubescape:mainfrom
yugal07:normalising-path

Conversation

@yugal07
Copy link
Copy Markdown
Contributor

@yugal07 yugal07 commented Apr 5, 2026

Overview

Commit 9597da4 refactored datasource_event.go to suppress verbose field
length warnings, but silently dropped the NormalizePath() calls that were
introduced in eafe066. This caused raw eBPF paths to be surfaced without
normalization, resulting in:

Headless /proc paths: /46/task/46/fd instead of /proc/46/task/46/fd
runc paths reported as . instead of /
Relative paths missing a leading /

This PR restores pkg/utils/path.go with the NormalizePath() function and
re-wires it into the GetPath, GetFullPath, GetExePath, GetNewPath, and
GetOldPath getter methods in both DatasourceEvent and StructEvent.

Testing -
Deploy the node-agent and inspect open events or an ApplicationProfile.
Paths should be fully absolute (e.g. /proc/46/task/46/fd) with no bare .
entries.

Unit tests can be run locally with:
go test ./pkg/utils/...

This fixes #721

Summary by CodeRabbit

  • Bug Fixes

    • Improved consistency of file path handling by normalizing all returned paths across event tracking
    • Fixed path handling for edge cases including relative paths and special filesystem formats
  • Tests

    • Added comprehensive test coverage for path normalization logic

Signed-off-by: yugal07 <yashsadhwani544@gmail.com>
@coderabbitai
Copy link
Copy Markdown

coderabbitai bot commented Apr 5, 2026

Warning

Rate limit exceeded

@yugal07 has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 10 minutes and 24 seconds before requesting another review.

Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 10 minutes and 24 seconds.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 182b0811-248e-443f-b4f9-8f453fe9f45d

📥 Commits

Reviewing files that changed from the base of the PR and between fa1409f and 26ebe00.

📒 Files selected for processing (2)
  • pkg/utils/normalize_path_test.go
  • pkg/utils/path.go
📝 Walkthrough

Walkthrough

This PR introduces a NormalizePath utility function to fix an issue where proc filesystem paths were missing their /proc prefix (e.g., /46/task/46/fd instead of /proc/46/task/46/fd). The function detects "headless" proc paths using regex and applies standard path normalization. All path-related getters in DatasourceEvent and StructEvent now apply this normalization before returning paths.

Changes

Cohort / File(s) Summary
Path Normalization Utility
pkg/utils/path.go
New utility module with NormalizePath function that detects headless proc paths (e.g., /pid/task/...), prefixes them with /proc, maps . to /, and applies path.Clean for standard normalization.
Datasource & Struct Event Getters
pkg/utils/datasource_event.go, pkg/utils/struct_event.go
Updated path-related getters (GetExePath, GetFullPath, GetNewPath, GetOldPath, GetPath) to return normalized paths via NormalizePath instead of raw field values.
Normalization Tests
pkg/utils/normalize_path_test.go
New comprehensive test suite for NormalizePath covering empty strings, dot mapping, absolute paths, headless proc path conversion, idempotency, relative-to-absolute conversion, slash collapsing, and dot component resolution.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~22 minutes

Poem

🐰 Paths once wandered, headless and bare,
/proc prefixes floating in air,
Now normalized, clean, and made whole,
The rabbit hops forth on the corrected road! 🌿✨

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title accurately describes the main change: restoring NormalizePath function to fix headless /proc paths and dot paths issues.
Linked Issues check ✅ Passed The PR successfully addresses issue #721 by restoring NormalizePath() and re-wiring it into path getters on DatasourceEvent and StructEvent to ensure absolute normalized paths.
Out of Scope Changes check ✅ Passed All changes are directly related to the objectives: adding NormalizePath utility, updating event getters to use it, and providing comprehensive unit tests.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

Copy link
Copy Markdown

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🧹 Nitpick comments (1)
pkg/utils/normalize_path_test.go (1)

28-63: Add boundary cases for terminal headless proc paths

Please add cases for /46/fd and /46/task so regex boundary behavior is locked down.

Suggested test additions
 		{
 			name:     "headless proc path (fd)",
 			input:    "/46/fd/3",
 			expected: "/proc/46/fd/3",
 		},
+		{
+			name:     "headless proc path (fd terminal)",
+			input:    "/46/fd",
+			expected: "/proc/46/fd",
+		},
+		{
+			name:     "headless proc path (task terminal)",
+			input:    "/46/task",
+			expected: "/proc/46/task",
+		},
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@pkg/utils/normalize_path_test.go` around lines 28 - 63, Add two boundary test
cases to the existing test table in normalize_path_test.go to exercise terminal
headless proc paths: one with input "/46/fd" expecting "/proc/46/fd" and one
with input "/46/task" expecting "/proc/46/task"; place them alongside the other
cases (use descriptive names like "terminal headless proc path (fd)" and
"terminal headless proc path (task)") so the normalization logic exercised by
the test runner (the test table used by the test function in this file)
validates regex boundary behavior for those endings.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@pkg/utils/path.go`:
- Around line 9-10: The regex in headlessProcRegex currently only matches when
the matched segment has a trailing slash, so terminal paths like "/1234/task" or
"/1234/fd" are skipped; update the pattern used by headlessProcRegex (and the
other similar regexes referenced around lines 25-27) to accept either a trailing
slash or end-of-string (for example: allow (task|fd) followed by either "/" or
end), then run tests to ensure both "/pid/task", "/pid/task/", "/pid/fd" and
"/pid/fd/" are all recognized as headless.

---

Nitpick comments:
In `@pkg/utils/normalize_path_test.go`:
- Around line 28-63: Add two boundary test cases to the existing test table in
normalize_path_test.go to exercise terminal headless proc paths: one with input
"/46/fd" expecting "/proc/46/fd" and one with input "/46/task" expecting
"/proc/46/task"; place them alongside the other cases (use descriptive names
like "terminal headless proc path (fd)" and "terminal headless proc path
(task)") so the normalization logic exercised by the test runner (the test table
used by the test function in this file) validates regex boundary behavior for
those endings.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: da44170b-5c4c-4437-812c-47b05fea3fb0

📥 Commits

Reviewing files that changed from the base of the PR and between 5eb0191 and fa1409f.

📒 Files selected for processing (4)
  • pkg/utils/datasource_event.go
  • pkg/utils/normalize_path_test.go
  • pkg/utils/path.go
  • pkg/utils/struct_event.go

Signed-off-by: yugal07 <yashsadhwani544@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Absolute paths partially changed to relative paths for OPEN_calls in Rule0002

1 participant