search

VirusTotal / yara-python

The Python interface for YARA
http://virustotal.github.io/yara/
Apache License 2.0
648 stars 179 forks source link

Add support for exposing runtime warnings via a callback. #160

Closed wxsBSD closed 3 years ago

wxsBSD commented 3 years ago

Add support for a "warnings_callback" argument to Rules.match(). If provided the function definition needs to be:

def warnings_callback(warning_type, message)

The callback will be called with a warning type of yara.WARNING_TOO_MANY_MATCHES and the message will be a string indicating which rule caused the warning. I think a warning type and a message is reasonably flexible in case we introduce other runtime warnings in the future.

If a callback is not provided we print a warning on stderr using the normal python warning system. It's worth noting the function I'm using was introduced in python 3.2. I can switch it to something more portable if you don't want to pull support for 2.x yet.

While I'm here, also chase the renaming of rules_list_head and other list variables so that it can compile with latest yara master.

I've also added a test case for the callback.

wxsBSD commented 3 years ago

The yara submodule will need to be updated for this to work. I wasn't sure how to do that in this PR so I skipped it.

wxsBSD commented 3 years ago

Also, I will update documentation once the API is set.