Skip to content

Clam 2001 regex slash colon#653

Merged
val-ms merged 3 commits intoCisco-Talos:mainfrom
val-ms:CLAM-2001-regex-slash-colon
Sep 8, 2022
Merged

Clam 2001 regex slash colon#653
val-ms merged 3 commits intoCisco-Talos:mainfrom
val-ms:CLAM-2001-regex-slash-colon

Conversation

@val-ms
Copy link
Contributor

@val-ms val-ms commented Jul 25, 2022

  • Fix issue loading regex sigs containing '/' and ':'

    There is an issue parsing PCRE patterns if the pattern contains a '/' in
    the middle, followed by a ':'. When splitting the subsignature (or yara
    regex string) by ':' delimiters to identify the offset, it will
    inadvertently think that the '/' in the middle of the sig is the end of
    the PCRE string and will therefore consider the ':' in the string as
    valid delimiter instead of ignoring it for being inside of the regex
    string.

    The solution I came up with is to ignore all content after a '/' when
    tokenizing rather than ignoring content between a matching pair of /'s.
    This works for LDB signatures because PCRE subsignatures are always
    the last subsignature and because a ':' never comes after the PCRE
    string.
    It works for YARA rules because the cli_tokenize() function is only
    ever used on the regex strings, never on the whole rule.

    Fixes: Version 0.105 load yara regex failed #594

  • Test: Add test for LDB & Yara regex rules with : + /

  • Also update generated sys.rs file (unrelated, just neglected in previous change)

val-ms added 3 commits July 25, 2022 12:56
There is an issue parsing PCRE patterns if the pattern contains a '/' in
the middle, followed by a ':'.  When splitting the subsignature (or yara
regex string) by ':' delimiters to identify the offset, it will
inadvertently think that the '/' in the middle of the sig is the end of
the PCRE string and will therefore consider the ':' in the string as
valid delimiter instead of ignoring it for being inside of the regex
string.

The solution I came up with is to ignore all content after a '/' when
tokenizing rather than ignoring content between a matching pair of /'s.
This works for LDB signatures because PCRE subsignatures are always
the last subsignature and because a ':' never comes *after* the PCRE
string.
It works for YARA rules because the `cli_tokenize()` function is only
ever used on the regex strings, never on the whole rule.

Fixes: Cisco-Talos#594
@ragusaa ragusaa self-requested a review August 8, 2022 18:25
@val-ms val-ms added the 🍒cherry-pick-candidate A PR that should be backported once approved. label Sep 7, 2022
@val-ms val-ms merged commit 8b6e53a into Cisco-Talos:main Sep 8, 2022
@val-ms val-ms deleted the CLAM-2001-regex-slash-colon branch September 8, 2022 04:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

🍒cherry-pick-candidate A PR that should be backported once approved.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Version 0.105 load yara regex failed

2 participants