1. 23 Aug, 2021 1 commit
  2. 26 Apr, 2021 1 commit
  3. 16 Apr, 2021 1 commit
  4. 18 Mar, 2021 2 commits
  5. 16 Mar, 2021 2 commits
  6. 15 Mar, 2021 1 commit
  7. 12 Mar, 2021 4 commits
  8. 23 Feb, 2021 2 commits
    • Add support for exposing runtime warnings via a callback. (#160) · d20e6f16
      Add support for a "warnings_callback" argument to Rules.match(). If provided the
      function definition needs to be:
      
      def warnings_callback(warning_type, message)
      
      The callback will be called with a warning type of yara.WARNING_TOO_MANY_MATCHES
      and the message will be a string indicating which rule caused the warning. I
      think a warning type and a message is reasonably flexible in case we introduce
      other runtime warnings in the future.
      
      If a callback is not provided we print a warning on stderr using the normal
      python warning system. It's worth noting the function I'm using was introduced
      in python 3.2. I can switch it to something more portable if you don't want to
      pull support for 2.x yet.
      
      While I'm here, also chase the renaming of rules_list_head and other list
      variables so that it can compile with latest yara master.
      Wesley Shields authored
    • Added check for stdbool.h header and forcing its use (#159) · a7e5627b
      When compiling YARA without Python bindings, stdbool.h is actually used
      if it can be used. However Python bindings completely ignore it resulting
      in YARA defining its own bool type with sizeof(bool) == sizeof(int).
      However before [#1377](https://github.com/VirusTotal/yara/pull/1377), this
      can result in different compilation units using different sizes of
      bool type and chaos ensues.
      Marek Milkovič authored
  9. 03 Feb, 2021 2 commits
  10. 27 Jan, 2021 1 commit
  11. 18 Jan, 2021 1 commit
  12. 14 Jan, 2021 1 commit
  13. 04 Jan, 2021 4 commits
  14. 24 Dec, 2020 2 commits
  15. 19 Oct, 2020 2 commits
  16. 02 Sep, 2020 1 commit
    • Allow a Py_buffer as data for Rules_match (#152) · fa3795f9
      * Allow a Py_buffer as data for Rules_match
      
      This makes rules matching compatible with data objects
      `PyArg_ParseTuple` does not consider read-only (even though they might
      actually be), such a memoryviews. The main change is replacing the `s#`
      formatter with `s*` and replacing the `(pointer, length)` pair with a
      `Py_buffer` object accordingly. Additional care must be taken to release
      the `Py_buffer` on every error path.
      
      * Rules_match: zero-initialize data
      
      PyArg_ParseTupleAndKeywords does not initialize optional fields unless
      they are passed, which means we need to zero-initialize the data buffer
      to be sure the later NULL checks always work.
      
      This commit also gets rid of the unneeded has_data flag.
      
      * Add test for matching on a memoryview
      Jan Teske authored
  17. 26 Jun, 2020 1 commit
  18. 12 Jun, 2020 1 commit
    • Fix issue #149. · cfd49c04
      This is regression in introduced in #140. When a string in the metadata section contains invalid UTF-8 characters the behavior Python 2 is leave the string exactly as it appears in YARA, in Python 3 however the invalid characters are removed because Python 3 strings are not handled as bytes like in Python 2, they most have a valid encoding. PR #140 was an attempt to homogenize the behavior in both versions of Python, but it introduced this other issue.
      Victor M. Alvarez authored
  19. 15 May, 2020 2 commits
  20. 29 Apr, 2020 1 commit
  21. 23 Apr, 2020 5 commits
    • Support a "is_global" and "is_private" member on Rules. (#130) · 5224381e
      * Support a "is_global" and "is_private" member on Rules.
      
      When writing linters it is currently impossible to know (via rule introspection)
      if a given rule is private or global. We have banned global rules for our use
      case and we have to resort to a janky regex against our rules files to know if
      anyone is about to commit a global rule. I figure exposing these two flags via
      python will be useful for programatically checking those bits.
      
      I'm not very pleased with the name "is_global" - I wanted to go with just
      "global" and "private" but "global" is a reserved keyword and rule.global breaks
      the python interpreter. I'm open to changing the member names if you have any
      suggestions.
      
      * Decrement reference counts on global and private.
      
      * Update global and private checks after API changes.
      Wesley Shields authored
    • Adapt to changes in YARA v4.0 API (#141) · cd033f7a
      * Upgrade YARA submodule and adapt to new API.
      
      * Upgrade YARA and adapt to API changes.
      
      * Fix build in Appveyor (#131)
      
      * The precompiled OpenSSL is now extracted from the NuGet package generated by https://ci.appveyor.com/project/plusvic/openssl.
      
      * OpenSSL was upgraded to version 1.1.1.
      Victor M. Alvarez authored
    • Handle invalid unicode in metadata values. (#136) · bc4e0cdb
      * Handle invalid unicode in metadata values.
      
      In #135 it was brought up that you can crash the python interpreter if you have
      invalid unicode in a metadata value. This is my attempt to fix that by
      attempting to create a string, and if that fails falling back to a bytes object.
      On the weird chance that the bytes object fails to create I added a safety check
      so that we don't add a NULL ptr to the dictionary (this is how the crash was
      manifesting).
      
      It's debatable if we want to ONLY add strings as metadata, and NOT fallback to
      bytes. If we don't fall back to bytes the only other option I see is to silently
      drop that metadata on the floor. The tradeoff here is that now you may end up
      with a string or a bytes object in your metadata dictionary, which is less than
      ideal IMO.
      
      I'm open to suggestions on this one.
      
      Fixes #135
      
      * Add error handling to conversion to Unicode
      Metadata test accepts stripped or original characters
      
      * Remove 'or' clause from tests and add another NULL test check.
      
      Co-authored-by: malvidin <malvidin@gmail.com>
      Wesley Shields authored
  22. 21 Apr, 2020 1 commit
  23. 24 Mar, 2020 1 commit