search

Northern-Lights / yara-parser

Tools for parsing rulesets using the exact grammar as YARA. Written in Go.
MIT License
82 stars 9 forks source link

Strings duplicate check disallows multiple anonymous `$` strings #1

Closed Northern-Lights closed 6 years ago

Northern-Lights commented 6 years ago

Because we are using a map for strings, the anonymous $ identifier cannot be duplicated in the yara-parser implementation. This would be allowed in libyara.

We should probably just follow libyara and make the strings and metas lists (slices), and then check at runtime that string identifiers are not being duplicated, making an exception for the anonymous $ identifier.

Northern-Lights commented 6 years ago

Fixed in 04a2e45cd6a35e90fc907ff8909429a0b6c05176