Test case:
private rule foo {
condition: true
}
rule bar {
condition: foo
}
If you test it with yara testcase.yara /dev/null, it prints a match as expected. However, defining foo as a falsy value prints no matches:
$ yara testcase.yara /dev/null
bar /dev/null
$ yara -d foo="" testcase.yara /dev/null
$ yara -d foo=0 testcase.yara /dev/null
I understand that this is a logically ambiguous case, but I think that the current behaviour is unexpected. I expected the private rule to have precedence over the variable, or an error to be thrown.
Thanks!
Test case:
If you test it with
yara testcase.yara /dev/null, it prints a match as expected. However, definingfooas a falsy value prints no matches:I understand that this is a logically ambiguous case, but I think that the current behaviour is unexpected. I expected the private rule to have precedence over the variable, or an error to be thrown.
Thanks!