gitea-mirror/capa
1
0
Fork 0
mirror of https://github.com/mandiant/capa.git synced 2026-06-12 19:11:32 -07:00
Code Issues Packages Projects Releases Wiki Activity

fix: parenthesize s_type checks in capa2yara so kid.name guard applies to And/Or/Not uniformly

Browse Source 
Without parentheses, Python's operator precedence caused `kid.name != "Some"`
to only guard the `Not` branch; `And` and `Or` kids named `"Some"` would
bypass the Some-handling block and enter recursive convert_rule unguarded.
This commit is contained in:
Willi Ballenthin
2026-04-22 22:15:00 +03:00
committed by Willi Ballenthin
parent fc7f0533d7
commit ae4c2ec82d
2 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/capa2yara.py
+1 -1
View File
@@ -414,7 +414,7 @@ def convert_rule(rule, rulename, cround, depth):
# this is "x or more". could be coded for strings TODO
return "BREAK", "Some aka x or more (TODO)", rule_comment, incomplete
if s_type == "And" or s_type == "Or" or s_type == "Not" and kid.name != "Some":
if (s_type == "And" or s_type == "Or" or s_type == "Not") and kid.name != "Some":
logger.info("doing bool with recursion: %r", kid)
logger.info("kid coming: %r", kid.name)
# logger.info("grandchildren: " + repr(kid.children))