Closed cccs-rs closed 2 years ago
Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).
For more information, open the CLA check for this pull request.
But this breaks backward compatibility, right? People that are already using Match.meta
do not expect to receive an array when they do Match.meta['malware']
. We should keep with the approach followed in #74, add a new function for those that want to retrieve metadata with multiple values.
But this breaks backward compatibility, right? People that are already using
Match.meta
do not expect to receive an array when they doMatch.meta['malware']
. We should keep with the approach followed in #74, add a new function for those that want to retrieve metadata with multiple values.
Could a flag in Rules.match()
control this behaviour, say via a param overwrite_meta_values
?
The flag will have the default state to maintain backwards compatibility, but for those that want this feature, they can change the flag.
Not sure if it's ideal to have a special function that outputs arrays for all metadata since it could just be a flag that changes the output from Dict[str, str]
to Dict[str, List[str]]
.
Yes, an argument allow_duplicate_metadata
to Rules.match()
that changes that behaviour should be fine. The default value would be False
, which means that Match.meta
will be a dictionary a Dict[key, value]
as it is now. If the value is True
, Match.meta
will be a Dict[key, [value1, value2, ....]]
.
bump?
bump
bump
bump
bump
bump
bump
@cccs-rs, adding the same comment every week is not going to speed up things. It's ok to ping the maintainers from time to time, but not at this rate.
I also miss a test case for this new feature.
Derivation of: https://github.com/VirusTotal/yara-python/pull/74 😍
This allows the
Match.meta
values to becomes lists if there are rule meta with the same name but different values. This is also to bring output from the Python library more inline with the output from the commandline.ie. Suppose there's a match given for the following rule:
The corresponding values in
Match.meta['malware']
will be:["BAD THING", "REALLY BAD THING"]
instead of just"REALLY BAD THING"