There was no way to get back to the rule identifier when trying to get back the rule to which the string causing TOO_MANY_MATCHES belongs. This patch makes it so that rule namespace, rule identifier and string identifier are passed as namedtuple with 3 attributes - namespace, rule and string, all containing their respective identifier. This change breaks the current API contract as it changes the type of the argument passed to the callback so I'd understand if it is merged when 4.2.0 is closer to release.
One more change that I also sneaked in is changing the identifiers to be passed as strings and not as byte sequences.
Even though the support for Python 2 already ended, this PR also still keeps the compatibility with Python 2.6+.
There was no way to get back to the rule identifier when trying to get back the rule to which the string causing
TOO_MANY_MATCHESbelongs. This patch makes it so that rule namespace, rule identifier and string identifier are passed asnamedtuplewith 3 attributes -namespace,ruleandstring, all containing their respective identifier. This change breaks the current API contract as it changes the type of the argument passed to the callback so I'd understand if it is merged when 4.2.0 is closer to release.One more change that I also sneaked in is changing the identifiers to be passed as strings and not as byte sequences.
Even though the support for Python 2 already ended, this PR also still keeps the compatibility with Python 2.6+.
Also needs VirusTotal/yara#1519 to be merged.