Skip to content

Defining variables with the same name as private rules leads to undesired behaviour #920

@CapacitorSet

Description

@CapacitorSet

Test case:

private rule foo {
    condition: true
}

rule bar {
    condition: foo
}

If you test it with yara testcase.yara /dev/null, it prints a match as expected. However, defining foo as a falsy value prints no matches:

$ yara testcase.yara /dev/null
bar /dev/null
$ yara -d foo="" testcase.yara /dev/null
$ yara -d foo=0 testcase.yara /dev/null

I understand that this is a logically ambiguous case, but I think that the current behaviour is unexpected. I expected the private rule to have precedence over the variable, or an error to be thrown.

Thanks!

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions