This PR fixes the issue https://github.com/google/timesketch/issues/3027, by simply passing the text of a sigma rule (rule_text instead of it's already escaped version doc) to sigmatools. sigmatools does the parsing and escaping of yaml by itself.
yaml.safe_load_all is still used for yaml-parsing (making sure, that the format is right) within this function, before calling the sigmatools library.
Like mentioned in the issue, the previous version led to ParserErrors, due to "double escaping" via yaml.safe_load_all in specific cases.
The PR also fixes one sigma_util.py test, which was failing mistakenly.
This PR fixes the issue https://github.com/google/timesketch/issues/3027, by simply passing the text of a sigma rule (
rule_textinstead of it's already escaped versiondoc) tosigmatools.sigmatoolsdoes the parsing and escaping of yaml by itself.yaml.safe_load_allis still used for yaml-parsing (making sure, that the format is right) within this function, before calling thesigmatoolslibrary.Like mentioned in the issue, the previous version led to ParserErrors, due to "double escaping" via
yaml.safe_load_allin specific cases.The PR also fixes one
sigma_util.pytest, which was failing mistakenly.Checks
Closing issues closes #3027