-
Notifications
You must be signed in to change notification settings - Fork 491
feat: add inline YARA rules support #1164
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
should be merged after #1162 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Looks good to me, thanks!
4e065c8
to
7fcf74a
Compare
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## develop #1164 +/- ##
===========================================
+ Coverage 68.00% 68.03% +0.02%
===========================================
Files 161 161
Lines 15801 15813 +12
===========================================
+ Hits 10746 10758 +12
Misses 5055 5055
Flags with carried forward coverage won't be shown. Click here to find out more.
🚀 New features to boost your workflow:
|
7fcf74a
to
037795c
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM.
PR Description by GH Copilot
This pull request refactors and enhances the injection detection module by improving configuration validation, supporting inline YARA rules, and adding new tests. The changes aim to make the code more modular, robust, and easier to extend.
Refactoring and Validation Improvements:
_validate_unpack_config
tovalidate_injection_config
and updated it to focus solely on validating the configuration without unpacking values. [1] [2]extract_injection_config
to handle the extraction and processing of configuration values, separating concerns for better modularity.action_option
andyara_path
to ensure stricter checks and clearer error messages. [1] [2]Support for Inline YARA Rules:
yara_rules
dictionary in the configuration. This allows rules to be loaded directly from strings instead of files. [1] [2]load_rules
function to handle both file-based and inline rule sources.Test Suite Enhancements:
validate_injection_config
andextract_injection_config
functions. [1] [2]test_load_inline_yara_rules
, to validate the functionality of inline YARA rules.Other Changes:
yara_path
optional in theInjectionDetection
configuration and added the newyara_rules
field._validate_unpack_config
references across the codebase.