[develop] Commas in YARA metadata create multiple rule matches

[austinbyers]

The logic to parse the output into JSON format presumably splits fields by comma, but YARA metadata can also include commas. The result is what looks like multiple different rule matches when there is actually only one.

Steps to Reproduce

Compile yextend from the develop branch.

test.yara:

rule dummy_true {
    meta:
        description = "One, Two, Three"

    condition:
        true
}

LD_LIBRARY_PATH=/usr/local/lib ./yextend -r test.yara -t test.yara -j produces the following:

[
    {
        "file_name": "test.yara",
        "file_signature_MD5": "8aa26a676c45edd7953962f9442abcfb",
        "file_size": 103,
        "scan_results": [
            {
                "file_signature_MD5": "8aa26a676c45edd7953962f9442abcfb",
                "file_size": 103,
                "non_archive_file_name": "test.yara",
                "scan_type": "Yara Scan (Goodwill guess  Encrypted file detected)",
                "yara_matches_found": true,
                "yara_rule_id": "dummy_true:[description=One"
            },
            {
                "file_signature_MD5": "8aa26a676c45edd7953962f9442abcfb",
                "file_size": 103,
                "non_archive_file_name": "test.yara",
                "scan_type": "Yara Scan (Goodwill guess  Encrypted file detected)",
                "yara_matches_found": true,
                "yara_rule_id": "Two"
            },
            {
                "file_signature_MD5": "8aa26a676c45edd7953962f9442abcfb",
                "file_size": 103,
                "non_archive_file_name": "test.yara",
                "scan_type": "Yara Scan (Goodwill guess  Encrypted file detected)",
                "yara_matches_found": true,
                "yara_rule_id": "Three]"
            }
        ],
        "yara_matches_found": true,
        "yara_ruleset_file_name": "test.yara"
    }
]

As you can see, it looks like 3 separate matches with 3 different rule IDs

[dre]

Fix posted in the develop branch and will be part of the next release.

[austinbyers]

Fantastic, thanks so much! Was not expecting this to be fixed in the next release 👍