Struct Foreach

pkg/filter/ql/function.go:158–158

Foreach adds iteration capabilities to the rule language. The decision to keep the function implementation outside the functions package is deliberate. The function mostly operates with raw expressions, and if the function lived in the functions package, that would create a cyclic import and likely

//     foreach(ps._ancestors, $proc, $proc.name = 'services.exe' and ps.is_protected, ps.is_protected)
//     In this example, the ps.is_protected field is captured prior to its usage in the predicate
type Foreach struct{}

func (f *Foreach) Call(args []interface{}) (interface{}, bool) {
	if len(args) < 3 {