VirusTotal / yara-python

The Python interface for YARA
http://virustotal.github.io/yara/
Apache License 2.0
646 stars 179 forks source link

Add a "warnings" member to Rules. #208

Closed wxsBSD closed 2 years ago

wxsBSD commented 2 years ago

When compiling rules that have warnings currently the only way to know they have warnings is to specify error_on_warning=True to yara.compile(). This will throw an exception that you can then check the warnings member of, like this:

r = 'rule a { strings: $a = "a" condition: $a } rule b { strings: $b = "b" condition: $b }'

try:
    rules = yara.compile(source=r, error_on_warning=True)
except yara.WarningError as e:
    print(e.warnings)

This stops the compilation process, so if you're trying to just know if there are warnings but still run the rules there is no good way to do it without using the exception mechanism and then compiling the rules a second time (with error_on_warning not set).

This patch adds a warnings member to the compiled Rules object, which is always set to a list of warning strings. If you want to error on warning you can still use error_on_warning=True in yara.compile() and get the normal behavior, but if you just want to compile and know if there are warnings you can now use this new member without having to compile a second time.

Suggested by: Tom Lancaster Fixes: #207