Repository navigation
Conversation
… other kinds of fields. Code completion is now more informative as it clearly distinguishes between standard fields and enums.
) Bumps [postcss](https://github.com/postcss/postcss) from 8.5.15 to 8.5.25. - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.15...8.5.25) --- updated-dependencies: - dependency-name: postcss dependency-version: 8.5.25 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
The previous logic unconditionally marked patterns in sets as non-anchorable. This update moves anchorability determination to the `of` and `for of` expression handlers. This allows patterns with explicit `at ` anchors to be correctly marked as anchored.
Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion) from 1.1.16 to 1.1.18. - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](https://github.com/juliangruber/brace-expansion/commits) --- updated-dependencies: - dependency-name: brace-expansion dependency-version: 1.1.18 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Refactors Teddy's `find_overlapping` methods and their callbacks to use `std::ops::ControlFlow`. This enables the scanner to propagate early termination signals, such as timeouts, back through the Teddy algorithm, stopping further processing once a condition is met. This ensures that scans using the Teddy algorithm respect configured timeouts,.
…#729) Many YARA rules contain subtle mistakes due to pattern sets that include patterns that were not meant to be part of the set. For instance, consider this rule: ``` rule example { strings: $bd1 = "@eval($_POST[" ascii $bd2 = "@Assert($_POST[" ascii $b1 = "pluginWrapper plugin_" ascii $b2 = "data-areaid=" ascii $b3 = "PowerbyDedeCms" ascii $b4 = "dede_fieldshash" ascii $b5 = "/plus/diy.php" ascii condition: 1 of ($bd*) and 2 of ($b*) } ``` The intention here was detecting files that contained one of $bd1, $bd2 and two of $b1, $b2, $b3, $b4, $b5. However, the expression `2 of ($b*)` also includes `$bd1` and `$bd2`, as `$b*` not only matches `$b1` to `$b5`, but `$bd1` and `$bd2` as well. This type of error is very common, and this PR introduces a new warning for detecting these situations.
#728) Bumps [undici](https://github.com/nodejs/undici) from 7.28.0 to 7.29.0. - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v7.28.0...v7.29.0) --- updated-dependencies: - dependency-name: undici dependency-version: 7.29.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
#730) Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.4 to 3.1.5. - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.4...v3.1.5) --- updated-dependencies: - dependency-name: fast-uri dependency-version: 3.1.5 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
This commit introduces the ability for users to switch between dark and light themes within the YARA Playground. Key features include: - A new theme toggle button in the status bar for quick switching. - Theme selection options within the settings dialog. - Persistence of the user's chosen theme across sessions using local storage. - Automatic detection and application of the system's preferred color scheme as the default. - Custom light and dark themes for the Monaco editor to ensure consistency. - Comprehensive styling updates across all components to support both dark and light modes.
- add a dedicated YARA mark for light mode - fix checkbox checkmarks in Settings light mode
…#733) Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.2.0 to 4.3.1. - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.1/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.2.0...4.3.1) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 4.3.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Cleanup a TODO that suggests to change overflowing_add to carrying_add.
Fixes #343 `--ignore-module` (and `Compiler::ignore_module`) only worked for modules that YARA-X doesn't know. A module that exists but is only partly implemented, such as `vt`, can't be skipped: rules that use the missing parts fail to compile, which is the regression described in the issue. `c_import` now treats a module in the ignored list as if it didn't exist, even when YARA-X implements it. The import produces the usual warning, and the rules that use the module are ignored by the existing "unknown identifier of an ignored module" path, so nothing else changes. Modules that are not in the list are imported as before.
…es (#832) The Python binding turns module outputs into dicts by serializing them to JSON and decoding the result with `JsonDecoder`. Bytes and timestamps were written as `{"encoding": ..., "value": ...}` objects, and the decoder converted any object with those keys. A `map<string, string>` with `encoding` and `value` keys, like `pe.version_info` filled from the scanned file, was converted by mistake: the scan panicked, raised `TypeError`, or returned the map as bytes. Add a `Format` option to `yara_x_proto::json::Serializer`. The default format now writes bytes as `{"$bytes": ["..."]}` and timestamps as `{"$timestamp": [N]}`. No map or message can produce that shape, since field names can't start with `$` and map values are never arrays, so `JsonDecoder` converts only objects with exactly that shape and leaves everything else unchanged. Invalid base64 now raises `ValueError` instead of panicking. `yr dump -o json` keeps its current output by selecting `Format::Legacy`. Fixes #825.
Metadata strings containing escaped (\x00) or literal null bytes are classified as MetaValue::Bytes since c557033, which maps to Python bytes rather than str.
…840) Bumps [zip](https://github.com/zip-rs/zip2) from 8.6.0 to 9.0.5. - [Release notes](https://github.com/zip-rs/zip2/releases) - [Changelog](https://github.com/zip-rs/zip2/blob/master/CHANGELOG.md) - [Commits](zip-rs/zip2@v8.6.0...v9.0.5) --- updated-dependencies: - dependency-name: zip dependency-version: 9.0.5 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [zip](https://github.com/zip-rs/zip2) from 8.5.1 to 9.0.5. - [Release notes](https://github.com/zip-rs/zip2/releases) - [Changelog](https://github.com/zip-rs/zip2/blob/master/CHANGELOG.md) - [Commits](zip-rs/zip2@v8.5.1...v9.0.5) --- updated-dependencies: - dependency-name: zip dependency-version: 9.0.5 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [wasmtime](https://github.com/bytecodealliance/wasmtime) from 43.0.1 to 48.0.7. - [Release notes](https://github.com/bytecodealliance/wasmtime/releases) - [Changelog](https://github.com/bytecodealliance/wasmtime/blob/v48.0.7/RELEASES.md) - [Commits](bytecodealliance/wasmtime@v43.0.1...v48.0.7) --- updated-dependencies: - dependency-name: wasmtime dependency-version: 48.0.7 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Speeds up `Scanner::new` by up to **~100x** (from ~220 µs down to ~2 µs for typical rule sets) by building the WASM `Linker` once and reusing it across scanners instead of rebuilding it on every `Scanner::new` call. This PR is based on #837, with a simpler design that achieves similar performance gains with a smaller surface area. --------- Co-authored-by: CfirTsabari <cfir16@gmail.com>
Update vt module with changes from cl/1014485791 Co-authored-by: VirusTotal Bot <virustotal-github-bot@google.com>
… .NET parser Some tools (such as Unity/IL2CPP linkers and dumpers) set method_list to 1 (0-based 0) for types that have no methods instead of repeating the next type's method_list. Previously, this caused parse_user_types to truncate method lists preceding 0-method types and repeatedly re-assign methods starting from index 0 to multiple classes, leading to excessive memory consumption. Also ensure parse_table preserves actual table row counts for index size calculations and skips unparsed rows when a table exceeds MAX_ROWS_PER_TABLE so subsequent tables in the #~ stream remain aligned.
The test case is removed because it was slow before, and now with the new limit is even slower.
#844) Fixes #843. When the `uint64` module fields were switched to `int64`, the `size` field of the olecf `Stream` message became `i64`, but `olecf/mod.rs` still passes the parser's `u64` size straight into `set_size`. Since `olecf-module` is not part of `default-modules`, CI never compiles it, so any build that enables `olecf-module`, `msi-module` or `vba-module` fails with E0308 on 1.22 and 1.23. This casts the size with `as i64`, the same way the other modules handle values from that refactor. Tested locally on Rust 1.95: - `cargo test -p yara-x --features=msi-module,olecf-module,vba-module` fails to compile on main and passes with this change (371 lib tests, including `modules::tests::test_modules` which checks the olecf stream sizes in `testdata/*.out`) - `cargo test --features=rules-profiling --workspace --exclude=yara-x-py` passes - `cargo clippy --workspace --tests --no-deps -- --deny clippy::all` and `cargo fmt --all --check` are clean Happy to also add these experimental modules to one of the CI test jobs so this gets caught next time, if you'd like that.
Recent commits introduced changes in the serialization format.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )