Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

lib rules not included in scoped rules #398

Closed
mr-tz opened this issue Jan 20, 2021 · 1 comment
Closed

lib rules not included in scoped rules #398

mr-tz opened this issue Jan 20, 2021 · 1 comment
Milestone

Comments

@mr-tz
Copy link
Collaborator

mr-tz commented Jan 20, 2021

This was observed in mandiant/capa-rules#225.

Thorough lints fail to validate lib rules, because we ignore "lib" rules here:
https://github.com/fireeye/capa/blob/20ce29b0333741c3f677fc501e3c7e34dc062077/capa/rules.py#L864-L879

Possible solutions:

  • remove "lib" exclusion (easy, however, there may be undesired side-effects @williballenthin?)
  • add RuleSet.lib_rules (not as easy)
  • to only change the linter, set all rules' lib meta to False (hacky)
@mike-hunhoff
Copy link
Collaborator

This appears to be causing issues in the rule generator plugin as well e.g. when a user attempts to create a new lib rule the plugin cannot make a match because the rule isn't included in the final ruleset (as no dependencies yet exist):

With lib: true:

Screen Shot 2021-01-21 at 2 03 28 PM

Without lib: true:

Screen Shot 2021-01-21 at 2 02 50 PM

This also prevents existing lib rules with no dependencies from showing up in the rule generator under matched rules, even though these rules may match the current function.

@mr-tz mr-tz added this to the v1.5.0 milestone Jan 22, 2021
mr-tz added a commit that referenced this issue Jan 27, 2021
mr-tz added a commit that referenced this issue Jan 28, 2021
@mr-tz mr-tz closed this as completed Jan 28, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants