mirror of
https://github.com/mandiant/capa.git
synced 2025-12-23 07:28:34 -08:00
Merge branch 'linter-lib-checks'
This commit is contained in:
2
rules
2
rules
Submodule rules updated: e5db226844...a16242d0a5
@@ -203,6 +203,31 @@ class UnusualMetaField(Lint):
|
|||||||
return False
|
return False
|
||||||
|
|
||||||
|
|
||||||
|
class LibRuleNotInLibDirectory(Lint):
|
||||||
|
name = 'lib rule not found in lib directory'
|
||||||
|
recommendation = 'Move the rule to the `lib` subdirectory of the rules path'
|
||||||
|
|
||||||
|
def check_rule(self, ctx, rule):
|
||||||
|
if is_nursery_rule(rule):
|
||||||
|
return False
|
||||||
|
|
||||||
|
if 'lib' not in rule.meta:
|
||||||
|
return False
|
||||||
|
|
||||||
|
return '/lib/' not in posixpath.normpath(rule.meta['capa/path'])
|
||||||
|
|
||||||
|
|
||||||
|
class LibRuleHasNamespace(Lint):
|
||||||
|
name = 'lib rule has a namespace'
|
||||||
|
recommendation = 'Remove the namespace from the rule'
|
||||||
|
|
||||||
|
def check_rule(self, ctx, rule):
|
||||||
|
if 'lib' not in rule.meta:
|
||||||
|
return False
|
||||||
|
|
||||||
|
return 'namespace' in rule.meta
|
||||||
|
|
||||||
|
|
||||||
class FeatureStringTooShort(Lint):
|
class FeatureStringTooShort(Lint):
|
||||||
name = 'feature string too short'
|
name = 'feature string too short'
|
||||||
recommendation = 'capa only extracts strings with length >= 4; will not match on "{:s}"'
|
recommendation = 'capa only extracts strings with length >= 4; will not match on "{:s}"'
|
||||||
@@ -270,6 +295,8 @@ META_LINTS = (
|
|||||||
MissingExampleOffset(),
|
MissingExampleOffset(),
|
||||||
ExampleFileDNE(),
|
ExampleFileDNE(),
|
||||||
UnusualMetaField(),
|
UnusualMetaField(),
|
||||||
|
LibRuleNotInLibDirectory(),
|
||||||
|
LibRuleHasNamespace(),
|
||||||
)
|
)
|
||||||
|
|
||||||
|
|
||||||
@@ -388,6 +415,10 @@ def collect_samples(path):
|
|||||||
continue
|
continue
|
||||||
if name.endswith('.i64'):
|
if name.endswith('.i64'):
|
||||||
continue
|
continue
|
||||||
|
if name.endswith('.frz'):
|
||||||
|
continue
|
||||||
|
if name.endswith('.fnames'):
|
||||||
|
continue
|
||||||
|
|
||||||
path = os.path.join(root, name)
|
path = os.path.join(root, name)
|
||||||
|
|
||||||
|
|||||||
Reference in New Issue
Block a user