ESE multivalue record is always returned as a list

[hypn0s]

Hello,

After updating ntdissector to use dissect.database instead of dissect.esedb, we found a bug where record.get returns a list of values even when there is only one value.

The Problem

The issue is caused by a recent change in https://github.com/fox-it/dissect.database/blob/542289301b3f754c40dceddaed26d4bd33043f6f/dissect/database/ese/record.py (lines 303–304):

            if column.is_multivalue and not isinstance(value, list):
                value = [value]

The code currently treats all "multivalue" columns as lists. However, a column typed as "multivalue" might still only contain a single value (or none). In these cases, it should return the value directly rather than wrapping it in a list. This is why the tag flags are compared to TAGFLD_HEADER.MultiValues in which case, indicate that multiple values are in the field.

This condition was recently added in 64ae6d8 .

Proposed Fix

Remove lines 303 and 304. I have tested this change locally, and it restores the expected behavior for ntdissector.

[Schamper]

This is an intentional change to make the parser more accurate. We believe the correct way to solve this is in your NTDS layer. For example, we fix this by taking the first value if the NTDS attribute is marked as being single valued:

dissect.database/dissect/database/ese/ntds/objects/object.py

Lines 270 to 272 in dee2182

	if schema.is_single_valued and isinstance(value, list):
	# There are a few attributes that have the flag IsSingleValued but are marked as MultiValue in ESE
	value = value[0]

I suggest you make a similar change to ntdissector.

The TAGFLD_HEADER.MultiValues only applies to the way the data is stored. The column definition determines how the data should be represented in a record.

[hypn0s]

Appreciate the response. I've made some adjustments to ntdissector to bring back the original functionality 👍