search

CERT-Polska / karton

Distributed malware processing framework based on Python, Redis and S3.
https://karton-core.readthedocs.io/en/latest/
BSD 3-Clause "New" or "Revised" License
387 stars 45 forks source link

Unintuitive logic of header filters with negated fields #222

Closed psrok1 closed 1 year ago

psrok1 commented 1 year ago

Multiple negated filters are unintuitive due to OR operator between them:

In[2]: Task({
    "type": "sample", 
    "kind": "runnable", 
    "platform": "win32"
}).matches_filters([
    {"type": "sample", "platform": "!win*"}, 
    {"type": "sample", "platform": "!linux"}
])
Out[2]: True

Above filter can be translated to(type:sample AND NOT platform:win*) OR (type:sample AND NOT platform:linux). So {type: "sample", platform: "win32"} matches the right side of OR expression, which is perfectly logical, but not desired behavior.

Found by @Antelox.