Abstract
Wmi57 uses the record datatype. Field elements are then used for each field selected in the WQL query. The field element only supports simple data types and therefore cannot represent complex data types such as arrays that may be returned by a WQL query.
Proposal
An interim step may be to update documentation on wmi57 to indicate this is an unsupported use and for tools to return an error when this is attempted. A resolution may involve revisions to the record datatype to add support for complex data types.
Additional context
Current tool behavior is varied. In testing with a field that is an integer array, SCC 5.14 returns text “ARRAY(address)” with a datatype of “int”, and Policy Auditor 6.5.9.144 crashes producing no results.
Abstract
Wmi57 uses the record datatype. Field elements are then used for each field selected in the WQL query. The field element only supports simple data types and therefore cannot represent complex data types such as arrays that may be returned by a WQL query.
Proposal
An interim step may be to update documentation on wmi57 to indicate this is an unsupported use and for tools to return an error when this is attempted. A resolution may involve revisions to the record datatype to add support for complex data types.
Additional context
Current tool behavior is varied. In testing with a field that is an integer array, SCC 5.14 returns text “ARRAY(address)” with a datatype of “int”, and Policy Auditor 6.5.9.144 crashes producing no results.