Added warning on unknown escape sequences (#1880)

* Added warning on unknown escape sequences * fixed memory leaks and different output when using regex as operand with strict-escape parameter * Remove some unwanted characters from strict escaping, add testcases
VirusTotal · Aug 23, 2023 · d7e67ff · d7e67ff
1 parent e40b991
commit d7e67ff
Show file tree

Hide file tree

Showing 17 changed files with 625 additions and 297 deletions.
diff --git a/cli/yara.c b/cli/yara.c
@@ -157,6 +157,7 @@ static bool ignore_warnings = false;
 static bool fast_scan = false;
 static bool negate = false;
 static bool print_count_only = false;
+static bool strict_escape = false;
 static bool fail_on_warnings = false;
 static bool rules_are_compiled = false;
 static bool disable_console_logs = false;
@@ -192,6 +193,12 @@ args_option_t options[] = {
         &print_count_only,
         _T("print only number of matches")),
 
+    OPT_BOOLEAN(
+        'E',
+        _T("strict-escape"),
+        &strict_escape,
+        _T("warn on unknown escape sequences")),
+
     OPT_STRING_MULTI(
         'd',
         _T("define"),
@@ -1565,6 +1572,11 @@ int _tmain(int argc, const char_t** argv)
 
     yr_compiler_set_callback(compiler, print_compiler_error, &cr);
 
+    if (strict_escape)
+      compiler->strict_escape = true;
+    else
+      compiler->strict_escape = false;
+
     if (!compile_files(compiler, argc, argv))
       exit_with_code(EXIT_FAILURE);
 

diff --git a/cli/yarac.c b/cli/yarac.c
@@ -73,6 +73,7 @@ static char* ext_vars[MAX_ARGS_EXT_VAR + 1];
 static bool ignore_warnings = false;
 static bool show_version = false;
 static bool show_help = false;
+static bool strict_escape = false;
 static bool fail_on_warnings = false;
 static long max_strings_per_rule = DEFAULT_MAX_STRINGS_PER_RULE;
 
@@ -103,6 +104,12 @@ args_option_t options[] = {
 
     OPT_BOOLEAN('h', _T("help"), &show_help, _T("show this help and exit")),
 
+    OPT_BOOLEAN(
+        'E',
+        _T("strict-escape"),
+        &strict_escape,
+        _T("warn on unknown escape sequences")),
+
     OPT_LONG(
         0,
         _T("max-strings-per-rule"),
@@ -233,6 +240,11 @@ int _tmain(int argc, const char_t** argv)
 
   yr_compiler_set_callback(compiler, report_error, &cr);
 
+  if (strict_escape)
+    compiler->strict_escape = true;
+  else
+    compiler->strict_escape = false;
+
   if (!compile_files(compiler, argc, argv))
     exit_with_code(EXIT_FAILURE);
 

diff --git a/libyara/base64.c b/libyara/base64.c
@@ -361,7 +361,7 @@ int _yr_base64_create_regexp(
   // printf("%s\n", re_str);
 
   FAIL_ON_ERROR_WITH_CLEANUP(
-      yr_re_parse(re_str, re_ast, re_error), yr_free(re_str));
+      yr_re_parse(re_str, re_ast, re_error, RE_PARSER_FLAG_NONE), yr_free(re_str));
 
   yr_free(re_str);
 

diff --git a/libyara/compiler.c b/libyara/compiler.c
@@ -240,6 +240,7 @@ YR_API int yr_compiler_create(YR_COMPILER** compiler)
   new_compiler->re_ast_clbk_user_data = NULL;
   new_compiler->last_error = ERROR_SUCCESS;
   new_compiler->last_error_line = 0;
+  new_compiler->strict_escape = false;
   new_compiler->current_line = 0;
   new_compiler->file_name_stack_ptr = 0;
   new_compiler->fixup_stack_head = NULL;