Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Added warning on unknown escape sequences #1880

Merged

Conversation

TommYDeeee
Copy link
Contributor

@TommYDeeee TommYDeeee commented Feb 22, 2023

Whenever user makes a mistake in escape sequence it is being silently ignored.
For example if user writes
C:\Users\\[^\\]+\\test.txt
instead of
C:\\Users\\[^\\]+\\test.txt
YARA takes \U as an escape sequence and ignores it as there is not a rule to match (U is returned), therefore this would match strings starting with C:Users instead of C:\Users.
Another case where this problem would rise is even within YARA tests. There is \0x5A value being escaped in range test. YARA does not support leading 0 in escaping, therefore it escapes only \0, returns 0 and continues with the rest being treated as a normal string. We would then get range 65-93(65 is a decimal value for ASCII A and 93 for \x5D) instead of desired range 91-93 in decimal values. The test is not failing as the tested value is within both ranges but if you try something that should fail as a \x4F it still passes.

  • I have added an CLI argument that would turn on this feature and generate warning whenever user writes invalid escape sequence.
  • I have also modified tests and added new test suite to tests those cases.

@google-cla
Copy link

google-cla bot commented Feb 22, 2023

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

@TommYDeeee TommYDeeee force-pushed the warn-on-invalid-escape-sequences branch from 9e670ea to 64b3a64 Compare March 7, 2023 09:54
@plusvic plusvic merged commit d7e67ff into VirusTotal:master Aug 23, 2023
9 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants