From f82e453440316c4cd12f248612bcfc36eee4f585 Mon Sep 17 00:00:00 2001
From: William Ballenthin <william.ballenthin@fireeye.com>
Date: Fri, 26 Jun 2020 18:31:52 -0600
Subject: [PATCH] linter: learn to check for unusual meta fields

closes #24
---
 scripts/lint.py | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/scripts/lint.py b/scripts/lint.py
index 78a22832..5c1701ce 100644
--- a/scripts/lint.py
+++ b/scripts/lint.py
@@ -183,6 +183,22 @@ class DoesntMatchExample(Lint):
                 return True
 
 
+class UnusualMetaField(Lint):
+    name = 'unusual meta field'
+    recommendation = 'Remove the unusual meta field'
+
+    def check_rule(self, ctx, rule):
+        for key in rule.meta.keys():
+            if key in capa.rules.META_KEYS:
+                continue
+            if key in capa.rules.HIDDEN_META_KEYS:
+                continue
+            logger.debug("unusual meta field: %s", key)
+            return True
+
+        return False
+
+
 class FeatureStringTooShort(Lint):
     name = 'feature string too short'
     recommendation = 'capa only extracts strings with length >= 4; will not match on "{:s}"'
@@ -235,6 +251,7 @@ META_LINTS = (
     MissingExamples(),
     MissingExampleOffset(),
     ExampleFileDNE(),
+    UnusualMetaField(),
 )