Skip to content

Add a "warnings" member to Rules.#208

Merged
plusvic merged 1 commit intoVirusTotal:masterfrom
wxsBSD:fix_207
May 18, 2022
Merged

Add a "warnings" member to Rules.#208
plusvic merged 1 commit intoVirusTotal:masterfrom
wxsBSD:fix_207

Conversation

@wxsBSD
Copy link
Contributor

@wxsBSD wxsBSD commented May 16, 2022

When compiling rules that have warnings currently the only way to know they have
warnings is to specify error_on_warning=True to yara.compile(). This will throw
an exception that you can then check the warnings member of, like this:

r = 'rule a { strings: $a = "a" condition: $a } rule b { strings: $b = "b" condition: $b }'

try:
    rules = yara.compile(source=r, error_on_warning=True)
except yara.WarningError as e:
    print(e.warnings)

This stops the compilation process, so if you're trying to just know if there
are warnings but still run the rules there is no good way to do it without using
the exception mechanism and then compiling the rules a second time (with
error_on_warning not set).

This patch adds a warnings member to the compiled Rules object, which is always
set to a list of warning strings. If you want to error on warning you can still
use error_on_warning=True in yara.compile() and get the normal behavior, but if
you just want to compile and know if there are warnings you can now use this new
member without having to compile a second time.

Suggested by: Tom Lancaster
Fixes: #207

When compiling rules that have warnings currently the only way to know they have
warnings is to specify error_on_warning=True to yara.compile(). This will throw
an exception that you can then check the warnings member of, like this:

```
r = 'rule a { strings: $a = "a" condition: $a } rule b { strings: $b = "b" condition: $b }'

try:
    rules = yara.compile(source=r, error_on_warning=True)
except yara.WarningError as e:
    print(e.warnings)
```

This stops the compilation process, so if you're trying to just know if there
are warnings but still run the rules there is no good way to do it without using
the exception mechanism and then compiling the rules a second time (with
error_on_warning not set).

This patch adds a warnings member to the compiled Rules object, which is always
set to a list of warning strings. If you want to error on warning you can still
use error_on_warning=True in yara.compile() and get the normal behavior, but if
you just want to compile and know if there are warnings you can now use this new
member without having to compile a second time.

Suggested by: Tom Lancaster
Fixes: VirusTotal#207
@plusvic plusvic merged commit e14f096 into VirusTotal:master May 18, 2022
@wxsBSD wxsBSD deleted the fix_207 branch May 18, 2022 10:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

No warning triggered with bad rules in yara-python

2 participants