1. 03 Feb, 2021 1 commit
  2. 27 Jan, 2021 1 commit
  3. 18 Jan, 2021 1 commit
  4. 14 Jan, 2021 1 commit
  5. 04 Jan, 2021 4 commits
  6. 24 Dec, 2020 2 commits
  7. 19 Oct, 2020 2 commits
  8. 02 Sep, 2020 1 commit
    • Allow a Py_buffer as data for Rules_match (#152) · fa3795f9
      * Allow a Py_buffer as data for Rules_match
      
      This makes rules matching compatible with data objects
      `PyArg_ParseTuple` does not consider read-only (even though they might
      actually be), such a memoryviews. The main change is replacing the `s#`
      formatter with `s*` and replacing the `(pointer, length)` pair with a
      `Py_buffer` object accordingly. Additional care must be taken to release
      the `Py_buffer` on every error path.
      
      * Rules_match: zero-initialize data
      
      PyArg_ParseTupleAndKeywords does not initialize optional fields unless
      they are passed, which means we need to zero-initialize the data buffer
      to be sure the later NULL checks always work.
      
      This commit also gets rid of the unneeded has_data flag.
      
      * Add test for matching on a memoryview
      Jan Teske authored
  9. 26 Jun, 2020 1 commit
  10. 12 Jun, 2020 1 commit
    • Fix issue #149. · cfd49c04
      This is regression in introduced in #140. When a string in the metadata section contains invalid UTF-8 characters the behavior Python 2 is leave the string exactly as it appears in YARA, in Python 3 however the invalid characters are removed because Python 3 strings are not handled as bytes like in Python 2, they most have a valid encoding. PR #140 was an attempt to homogenize the behavior in both versions of Python, but it introduced this other issue.
      Victor M. Alvarez authored
  11. 15 May, 2020 2 commits
  12. 29 Apr, 2020 1 commit
  13. 23 Apr, 2020 5 commits
    • Support a "is_global" and "is_private" member on Rules. (#130) · 5224381e
      * Support a "is_global" and "is_private" member on Rules.
      
      When writing linters it is currently impossible to know (via rule introspection)
      if a given rule is private or global. We have banned global rules for our use
      case and we have to resort to a janky regex against our rules files to know if
      anyone is about to commit a global rule. I figure exposing these two flags via
      python will be useful for programatically checking those bits.
      
      I'm not very pleased with the name "is_global" - I wanted to go with just
      "global" and "private" but "global" is a reserved keyword and rule.global breaks
      the python interpreter. I'm open to changing the member names if you have any
      suggestions.
      
      * Decrement reference counts on global and private.
      
      * Update global and private checks after API changes.
      Wesley Shields authored
    • Adapt to changes in YARA v4.0 API (#141) · cd033f7a
      * Upgrade YARA submodule and adapt to new API.
      
      * Upgrade YARA and adapt to API changes.
      
      * Fix build in Appveyor (#131)
      
      * The precompiled OpenSSL is now extracted from the NuGet package generated by https://ci.appveyor.com/project/plusvic/openssl.
      
      * OpenSSL was upgraded to version 1.1.1.
      Victor M. Alvarez authored
    • Handle invalid unicode in metadata values. (#136) · bc4e0cdb
      * Handle invalid unicode in metadata values.
      
      In #135 it was brought up that you can crash the python interpreter if you have
      invalid unicode in a metadata value. This is my attempt to fix that by
      attempting to create a string, and if that fails falling back to a bytes object.
      On the weird chance that the bytes object fails to create I added a safety check
      so that we don't add a NULL ptr to the dictionary (this is how the crash was
      manifesting).
      
      It's debatable if we want to ONLY add strings as metadata, and NOT fallback to
      bytes. If we don't fall back to bytes the only other option I see is to silently
      drop that metadata on the floor. The tradeoff here is that now you may end up
      with a string or a bytes object in your metadata dictionary, which is less than
      ideal IMO.
      
      I'm open to suggestions on this one.
      
      Fixes #135
      
      * Add error handling to conversion to Unicode
      Metadata test accepts stripped or original characters
      
      * Remove 'or' clause from tests and add another NULL test check.
      
      Co-authored-by: malvidin <malvidin@gmail.com>
      Wesley Shields authored
  14. 21 Apr, 2020 1 commit
  15. 24 Mar, 2020 2 commits
  16. 07 Jan, 2020 6 commits
  17. 09 Dec, 2019 1 commit
  18. 20 Nov, 2019 1 commit
  19. 13 Nov, 2019 1 commit
  20. 10 Oct, 2019 3 commits
  21. 24 Sep, 2019 2 commits