Rule().matches stuck, no result returned

[tianguoxin]

rule_engine is a great feature to use, but I'm running into some issues. The following code will get stuck, no error will be reported, and there will be no return value Looking forward to your reply and good luck

for myrule in [ Rule('TargetFilename.as_lower =~ "c:\\\windows\\\system32\\(.?)+.exe"', context=Context(default_value=None)), Rule('TargetFilename.as_lower =~ "c:\\\windows\\\system32\\(.?)+.wncryt"', context=Context(default_value=None)), Rule('TargetFilename.as_lower =~ "c:\\\windows\\\system32\\(.?)+.ini"', context=Context(default_value=None)), Rule('TargetFilename.as_lower =~ "c:\\\windows\\\system32\\(.?)+.bat"', context=Context(default_value=None)), Rule('TargetFilename.as_lower =~ "c:\\\windows\\\system32\\(.*?)+.bin"', context=Context(default_value=None)), ]: print(myrule.matches({'RuleName': '-', 'UtcTime': '2023-05-29 08:59:49.311', 'ProcessGuid': '{8ec1d6e5-fad3-6473-4300-00000000b000}', 'ProcessId': '3972', 'Image': 'C:\WINDOWS\System32\svchost.exe', 'TargetFilename': 'c:\windows\system32\winevt\logs\archive-microsoft-windows-sysmon%4operational', 'CreationUtcTime': '2023-05-29 08:59:49.311', 'User': 'NT AUTHORITY\LOCAL SERVICE'}))

[zeroSteiner]

Looks like a string escaping issue. Until I get around to fixing it (which I may or may not do) you can add more back slashes. The literal slashes in the path for the regex (\) should be replaced with four (\\\\). Two are each to put a literal slash into the interpreted string. Then the resulting two for a literal slash in the regex.

I'll need to look into if this is actually a bug and if fixing it makes sense without breaking backwards compatibility.

[zeroSteiner]

I don't think this makes sense to implement with an update to the string data type. This would probably be best implemented through a syntax for raw strings like what Python has (as prefixed with r). I think it'd only require updates to the parser code, because the result would still be a string expression. It probably wouldn't be too difficult. If a ticket requesting that is opened, I might look into it, but I'm going to close this out as there isn't exactly an issue here.