search

SigmaHQ / pySigma

Python library to parse and convert Sigma rules into queries (and whatever else you could imagine)
GNU Lesser General Public License v2.1
395 stars 101 forks source link

Fix Detection Field Validation in rule.py #224

Closed twpZero closed 4 months ago

twpZero commented 5 months ago

SigmaDetectionItem.from_mapping was previously accepting ':' as valid input from fields,
allowing users to create rules with field such as Image:endswith: value.

Those inputs should be considered as malformed yaml.
Suggested Fix : raise SigmaDetectionError

thomaspatzke commented 4 months ago

See comment in issue. Colons are allowed and we don't want to add any restrictions on the field names as there might be valid use cases for colons and likely other characters.