Velocidex / velociraptor

Digging Deeper....
https://docs.velociraptor.app/
Other
2.98k stars 492 forks source link

Stopping an invalid notebook cell query erases the VQL #3607

Closed misje closed 4 months ago

misje commented 4 months ago

I've been caught off guard a number of times now that if my notebook cell has invalid syntax when executing, and I'm impatiently waiting for those handful of seconds necessary seconds for the "Edit cell" button to reappear, clicking the stop button destroys all my work since the last query execution. Can we keep the "unsaved" VQL even if it had a syntax error and the user pressed stopped instead of waiting for the edit button to appear again?

predictiple commented 4 months ago

One possible solution is to have separate Save and Run buttons. Save should work even if the VQL is incorrect. Often I have needed to go to another cell to copy a snippet while forgetting that I haven't yet run the current cell (because it was still incomplete/WIP), thus losing my changes.

An autosave of the current cell would be ideal.

Run should save&run as it currently does, but it should save even if execution is cancelled, as per OP.

Some of the button descriptions are also not accurate, for example this Undo doesn't actually undo anything. It should be labelled Cancel, consistent with the same button in the notebook toolbar. Screenshot from 2024-07-11 12-37-48

scudette commented 4 months ago

What version are you running? I cant seem to replicate it because the stop button is disabled until the refresh is done.

Looks like that code was updated a few months ago but should be in the 0.72 releases

https://github.com/Velocidex/velociraptor/blame/5cc893a3e507a271037f7ff32e095a4025ce8af6/gui/velociraptor/src/components/notebooks/notebook-cell-renderer.jsx#L719

misje commented 4 months ago

This is the latest release, 0.72.4/d568709. I cannot find a way to reliably reproduce the issue, but it happens on some occasions.

scudette commented 4 months ago

This should be fixed in #3613