fix(types): transparent slicing for zero stop and friendlier YAML errors - #529
Open
nkbeast wants to merge 1 commit into
Open
fix(types): transparent slicing for zero stop and friendlier YAML errors#529nkbeast wants to merge 1 commit into
nkbeast wants to merge 1 commit into
Conversation
* SigmaString slicing treated a zero stop index as "no end" because
`idx.stop or inf` maps the falsy int 0 to inf. s[:0], s[0:0] and
s[1:0] therefore returned non-empty strings instead of the empty
SigmaString, breaking the documented transparent compatibility
with str slicing. Use `idx.stop if idx.stop is not None else inf`.
* SigmaRule.from_yaml crashed with a raw AttributeError on empty or
comment-only YAML documents (yaml.load returns None). Treat the
empty document as an empty mapping so the usual collected/raised
rule validation errors are produced instead.
* The duplicate YAML key error message printed the literal text
'{k}' instead of the offending key due to a missing f-string.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Three small, independent fixes around rule parsing and
SigmaStringsemantics.1.
SigmaStringslicing with a zero stop index (sigma/types.py)SigmaString.__getitem__usedend = idx.stop or inf, mapping the falsy integer0toinf. As a results[:0],s[0:0],s[1:0]ands[1:1]returned non-empty slices instead of the emptySigmaString, unlike plainstr:Fix:
end = idx.stop if idx.stop is not None else inf.2. Empty/comment-only YAML documents crash with raw
AttributeError(sigma/rule/base.py)SigmaRule.from_yaml("")or a comment-only document parses toNoneandfrom_dict(None)crashes withAttributeError: 'NoneType' object has no attribute 'get'. Ruleset directories routinely contain leftover empty.ymlfiles, so batch tooling blows up with a raw exception. Empty documents now go through the normal validation path and produce collected/raisedSigmaErrors likeSigmaTitleError.3. Duplicate-key error prints the literal
{k}(sigma/rule/base.py)raise yaml.error.YAMLError("Duplicate key '{k}'")is missing thefprefix, so the diagnostic literally saysDuplicate key '{k}'instead of naming the offending key. Now reports e.g.Duplicate key 'selection'.Tests
test_string_index_slice_zero_stop(tests/test_types.py) —[:0],[0:0],[1:0],[1:1],[-1:0]all returnSigmaString("")test_sigmarule_fromyaml_empty/test_sigmarule_fromyaml_empty_collect_errors(tests/test_rule.py)test_sigmarule_fromyaml_duplicate_key_reports_key— asserts the key name appears in the messageVerification
pytest tests/test_types.py tests/test_rule.py— 296 passedmypy— clean (66 files)black --check— clean