Skip to content

Commit

Permalink
Discard partial or expressions (#190)
Browse files Browse the repository at this point in the history
  • Loading branch information
nazywam authored May 19, 2020
1 parent 77db2a3 commit 770f083
Show file tree
Hide file tree
Showing 3 changed files with 13 additions and 3 deletions.
4 changes: 1 addition & 3 deletions src/lib/yaraparse.py
Original file line number Diff line number Diff line change
Expand Up @@ -332,10 +332,8 @@ def or_expr(self, condition: OrExpression) -> Optional[UrsaExpression]:

if left and right:
return UrsaExpression.or_(left, right)
elif not left and not right:
return None
else:
return left or right
return None

def pare_expr(
self, condition: ParenthesesExpression
Expand Down
11 changes: 11 additions & 0 deletions src/tests/yararules/testdata/or_corner_case.yar
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
rule or_corner_case
{
meta:
description = "presents the problem with discarding other branch from *or* expressions"
date = "2020-05-19"
strings:
$a = "this is a legit string"
$b = /[a-f]{10}/
condition:
$a or $b
}
1 change: 1 addition & 0 deletions src/tests/yararules/testdata/or_corner_case.yar.txt
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
(({}))

0 comments on commit 770f083

Please sign in to comment.