Skip to content

Fix parsing of "private global" rules #93

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Apr 8, 2020

Conversation

msm-code
Copy link
Contributor

@msm-code msm-code commented Apr 6, 2020

I've went ahead and tried to fix the issue I've found. I hope my C++ is adequate.

I tried to be careful not to introduce any regressions and memory leaks, but please do check.

I've also added a test to parser_tests.cpp but had problems building the test suite, so I just hope the test works. I tested my fixes by hand, using the python bindings instead:

import yaramod

test = """
/* comment test */
private global rule Kot
{
    strings:
        $a = "dummy1"

    condition:
        $a
}
/* comment test */
global private rule Hmm
{
    strings:
        $a = "dummy1"

    condition:
        $a
}

/* this will not work:
global global rule Zzz
{
    strings:
        $a = "dummy1"

    condition:
        $a
}
*/

private rule private_rule {
    condition:
        true
}

global rule global_rule {
    condition:
        true
}
"""

print(yaramod.Yaramod().parse_string(test).text_formatted)

for rule in yaramod.Yaramod().parse_string(test).rules:
    print(rule.name, ("private" if rule.is_private else ""), ("global" if rule.is_global else ""))

This test doesn't work on current master branch (as expected), but works after this PR.

Fixes #92.

@msm-code msm-code force-pushed the fix/private-global branch 2 times, most recently from c1bd255 to ebbb568 Compare April 6, 2020 20:08
@s3rvac
Copy link
Member

s3rvac commented Apr 7, 2020

Thank you for the very nicely written issue and PR! Since @metthal is on vacation, could I ask you @TadeasKucera to take a look at this PR and the associated issue #92?

Copy link
Contributor

@TadeasKucera TadeasKucera left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

First of all thank you very much for this PR! I have run the tests and all of them passed. I only have some minor remarks listed below.

@msm-code msm-code force-pushed the fix/private-global branch from ebbb568 to 3f86e88 Compare April 7, 2020 11:26
@msm-code
Copy link
Contributor Author

msm-code commented Apr 7, 2020

No problem, glad I can help!

@msm-code msm-code requested a review from TadeasKucera April 7, 2020 11:29
@TadeasKucera TadeasKucera merged commit d59cc83 into avast:master Apr 8, 2020
@msm-code msm-code deleted the fix/private-global branch May 11, 2020 16:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Allow parsing of rules that are both private and global
3 participants