I have a rule that looks like this:
import "cuckoo"
rule domain {
condition:
cuckoo.network.dns_lookup(/example.com/)
}
yago fails with this error: {"lexical":"error","line":"4","msg":"Line 4: illegal regex modifier ())"}exit status 1
The method processCondition
makes accommodations for module.variable
, but it does not consider the following:
module.variable.<anything>
module.function(<anything
In this particular case, it believes that )
is being used as a modifier, when in fact it is used to end the function.
In the fix, functions with multiple parameters should be taken into consideration, e.g. if there is a ,
between parameters within the parentheses.