mirror of
https://github.com/mandiant/capa.git
synced 2026-06-12 19:11:32 -07:00
fix: correct capa/subscope-rule key in RuleMetadata.from_capa
`RuleMetadata.from_capa` used `rule.meta.get("capa/subscope", False)` and
`Field(False, alias="capa/subscope")`, but the actual key set by
`_extract_subscope_rules_rec` is `"capa/subscope-rule"`. This caused
`is_subscope_rule` to always be `False` in every `RuleMetadata` instance,
making downstream filters in `render/utils.py`, `render/vverbose.py`, and
`scripts/import-to-ida.py` ineffective (though subscope rules are already
excluded from `ResultDocument` before reaching those callers).
This commit is contained in:
committed by
Willi Ballenthin
parent
1ef6298b45
commit
eb81901d71
@@ -102,7 +102,7 @@ def load_analysis(bv):
|
||||
for rule in doc["rules"].values():
|
||||
if rule["meta"].get("lib"):
|
||||
continue
|
||||
if rule["meta"].get("capa/subscope"):
|
||||
if rule["meta"].get("capa/subscope-rule"):
|
||||
continue
|
||||
if rule["meta"]["scopes"].get("static") != "function":
|
||||
continue
|
||||
|
||||
Reference in New Issue
Block a user