Bug: Whitespace Formatting Loop

[JohnConnorRF]

Hey guys,

I found a strange bug. Under certain conditions re-running yara_validator_cli.py with inplace modification adds unnecessary whitespace to a file

I've been using cccs-yara to help validate a repo of yara rules. As part of that workflow, the rules end up being checked pretty consistently with the flags -i -v for in place changes to be made. Rerunning the validation can add up to kilobytes of whitespace to a file.

A test yara rule which triggers the bug can be seen below:

rule TEST_WhitespaceFeedback {
    meta:
        author = "TEST"
        date = "2021-02-04"
        description = "Testing to see how repeated uses of the validator result in large whitespace getting added"
        version = "1.0"
        info = "TEST CASE"
        category = "INFO"
        id = "h6DuDsSCZf8tvpoqorxKB"
        fingerprint = "ef3a9feef8f376382ecb07a970b37790ba56b7adce6bf072acfb8c94e0858ba6"
        first_imported = "2021-02-04"
        last_modified = "2021-02-04"
        status = "TESTING"
        sharing = "TLP:WHITE"
        source = "TESTING"

    strings:
        $s1 = "test123"

         $s2 = "abc456"
        $s3 = "blah blah blah"

    condition:
        all of them
}

Note there is whitespace added longer than the usual tabs between $s1 and $s2.

[cccs-gm]

I will take a look into this first thing tomorrow morning. Thank you for bringing it to our attention.

[cccs-gm]

I found the source of the bug and the fix has just been merged into master. Thank you very much @JohnConnorRF for reporting this.

[JohnConnorRF]

Thanks for the prompt response. You’re support for this project is so helpful.