1. 20 May, 2022 1 commit
    • Allow metadata to contain a list of values (#201) · d29ca083
      The `Rules.match` function now receives an optional `allow_duplicate_metadata=True` argument, which changes the structure of `Match.meta`. By default `Match.meta` is a dictionary with metadata names and their corresponding values, if a metadata name appears duplicated in a rule, the last value will be used. For example, consider the following rule:
      
      ```yara
      rule demo {
         meta: 
           foo = "foo #1"
           foo = "foo #2"
           bar = "bar"
         condition:
            false
      }
      ```
      
      In that case `Match.meta` would be `{"foo": "foo #2", "bar": "bar"}` by default (`allow_duplicate_metadata=False`), but with `allow_duplicate_metadata=True` it would be: `{"foo": ["foo #1", "foo #2"], "bar": ["bar"]}`. 
      cccs-rs authored
  2. 18 May, 2022 1 commit
    • Add a "warnings" member to Rules. (#208) · e14f096e
      When compiling rules that have warnings currently the only way to know they have
      warnings is to specify error_on_warning=True to yara.compile(). This will throw
      an exception that you can then check the warnings member of, like this:
      
      ```
      r = 'rule a { strings: $a = "a" condition: $a } rule b { strings: $b = "b" condition: $b }'
      
      try:
          rules = yara.compile(source=r, error_on_warning=True)
      except yara.WarningError as e:
          print(e.warnings)
      ```
      
      This stops the compilation process, so if you're trying to just know if there
      are warnings but still run the rules there is no good way to do it without using
      the exception mechanism and then compiling the rules a second time (with
      error_on_warning not set).
      
      This patch adds a warnings member to the compiled Rules object, which is always
      set to a list of warning strings. If you want to error on warning you can still
      use error_on_warning=True in yara.compile() and get the normal behavior, but if
      you just want to compile and know if there are warnings you can now use this new
      member without having to compile a second time.
      
      Suggested by: Tom Lancaster
      Fixes: #207
      Wesley Shields authored
  3. 10 Mar, 2022 2 commits
  4. 04 Mar, 2022 7 commits
  5. 08 Feb, 2022 1 commit
  6. 22 Oct, 2021 2 commits
  7. 06 Oct, 2021 2 commits
  8. 05 Oct, 2021 1 commit
  9. 31 Aug, 2021 4 commits
  10. 30 Jun, 2021 1 commit
    • Release GIL while compiling Yara rules (#183) · 46f7e1ff
      * Release GIL when compiling rules.
      
      The compilation is a blocking operation and can be potentially CPU
      intensive. There is no reason to hold GIL.
      
      * Lock the GIL in callback to prevent segmentation fault.
      
      To be uniform with other callbacks and to prevent the SIGSEGV we have to
      lock the GIL while we want to interact with python objects. The callback
      is called from a C code releases GIL. Other callback functions use the same
      locking strategy.
      Oliver Nemček authored
  11. 21 Jun, 2021 1 commit
  12. 26 Apr, 2021 1 commit
  13. 16 Apr, 2021 1 commit
  14. 18 Mar, 2021 2 commits
  15. 16 Mar, 2021 2 commits
  16. 15 Mar, 2021 1 commit
  17. 12 Mar, 2021 4 commits
  18. 23 Feb, 2021 2 commits
    • Add support for exposing runtime warnings via a callback. (#160) · d20e6f16
      Add support for a "warnings_callback" argument to Rules.match(). If provided the
      function definition needs to be:
      
      def warnings_callback(warning_type, message)
      
      The callback will be called with a warning type of yara.WARNING_TOO_MANY_MATCHES
      and the message will be a string indicating which rule caused the warning. I
      think a warning type and a message is reasonably flexible in case we introduce
      other runtime warnings in the future.
      
      If a callback is not provided we print a warning on stderr using the normal
      python warning system. It's worth noting the function I'm using was introduced
      in python 3.2. I can switch it to something more portable if you don't want to
      pull support for 2.x yet.
      
      While I'm here, also chase the renaming of rules_list_head and other list
      variables so that it can compile with latest yara master.
      Wesley Shields authored
    • Added check for stdbool.h header and forcing its use (#159) · a7e5627b
      When compiling YARA without Python bindings, stdbool.h is actually used
      if it can be used. However Python bindings completely ignore it resulting
      in YARA defining its own bool type with sizeof(bool) == sizeof(int).
      However before [#1377](https://github.com/VirusTotal/yara/pull/1377), this
      can result in different compilation units using different sizes of
      bool type and chaos ensues.
      Marek Milkovič authored
  19. 03 Feb, 2021 2 commits
  20. 27 Jan, 2021 1 commit
  21. 18 Jan, 2021 1 commit