From e6a7e43391ba6785c2d99a840bf368d57f8cd3b3 Mon Sep 17 00:00:00 2001 From: Willi Ballenthin Date: Wed, 22 Apr 2026 09:24:25 +0300 Subject: [PATCH] fix: find_dynamic_limitations_from_cli overwrites instead of OR-ing Closes #3019 --- CHANGELOG.md | 2 ++ capa/main.py | 4 ++-- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 9e65528c..29f990bd 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -23,6 +23,8 @@ - fix: load_one_jsonl_from_path: finally block runs on unrelated exceptions @williballenthin #3018 +- fix: find_dynamic_limitations_from_cli overwrites instead of OR-ing @williballenthin #3019 + ### capa Explorer Web ### capa Explorer IDA Pro plugin diff --git a/capa/main.py b/capa/main.py index 91147353..9e561b10 100644 --- a/capa/main.py +++ b/capa/main.py @@ -781,7 +781,7 @@ def find_static_limitations_from_cli(args, rules: RuleSet, file_extractors: list # file limitations that rely on non-file scope won't be detected here. # nor on FunctionName features, because pefile doesn't support this. - found_file_limitation = has_static_limitation(rules, pure_file_capabilities) + found_file_limitation |= has_static_limitation(rules, pure_file_capabilities) if found_file_limitation: # bail if capa encountered file limitation e.g. a packed binary # do show the output in verbose mode, though. @@ -805,7 +805,7 @@ def find_dynamic_limitations_from_cli(args, rules: RuleSet, file_extractors: lis found_dynamic_limitation = False for file_extractor in file_extractors: pure_dynamic_capabilities = find_file_capabilities(rules, file_extractor, {}) - found_dynamic_limitation = has_dynamic_limitation(rules, pure_dynamic_capabilities) + found_dynamic_limitation |= has_dynamic_limitation(rules, pure_dynamic_capabilities) if found_dynamic_limitation: # bail if capa encountered file limitation e.g. a dotnet sample is detected