-
Notifications
You must be signed in to change notification settings - Fork 42
Open
Description
yaramod fails to parse the following rule
rule test
{
meta:
description = "Test yaramod"
condition:
for any s in ("foo", "bar") : ( "foobar" contains s )
}
With error yaramod.ParserError: Error at test.yara:6.50-57: operator 'contains' expects string on the right-hand side of the expression
Error occurs starting in version 3.21.0, before that it gives an error that integer set expects integer type
.
I'm guessing that this has to do with Yara 4.0 allowing for..in to iterate over things other than numbers. While yaramod does parse the for..in portion correctly, but when parsing the condition contains
thinks s
is an int, when it is really a string.
https://yara.readthedocs.io/en/stable/writingrules.html#iterators
Metadata
Metadata
Assignees
Labels
No labels