lmco / laikaboss

Laika BOSS: Object Scanning System
Apache License 2.0
732 stars 155 forks source link

Add support for compiling from a string. #52

Closed wxsBSD closed 7 years ago

wxsBSD commented 7 years ago

Also, add support for clearing YARA rules from the cached set.

Note that in order to not pollute the logs when compiling from a string I have snipped log messages a bit. Also, apologies for all the whitespace fixes in here but we are sticklers for this kind of stuff, so much so that it's in everyone's editor to clean it up by default. I'm happy to remove all the whitespace fixes if you want, but I think it will be good to make the code whitespace clean over time.

marnao commented 7 years ago

Your last commit which returns an empty list if the rule does not compile alters the current behavior of this function.

When a rule does not compile, we expect an exception to be raised which would then get logged in the module error log. I didn't test it, but I think your original revision kept this behavior since you'd try to run the match function on None.

Is there a reason you made this change?

wxsBSD commented 7 years ago

I misunderstood how things are supposed to work. I've fixed that now, I think.

wxsBSD commented 7 years ago

I'm actually going to close this one out, since I have a much larger set of changes I'm working on which include improvements in this area and will just end up conflicting.