Browse Source

Merge branch 'mattnotmitt-chores/yara-update'

n1474335 5 years ago
parent
commit
3c165dd7e8
4 changed files with 21 additions and 6 deletions
  1. 3 3
      package-lock.json
  2. 1 1
      package.json
  3. 1 1
      src/core/operations/YARARules.mjs
  4. 16 1
      tests/node/tests/operations.mjs

+ 3 - 3
package-lock.json

@@ -8586,9 +8586,9 @@
       "integrity": "sha512-RqscTx95+RTKhFAyjedsboR0Lmo3zd8//EuRwQXkdWmsCwYlzarVRaiYg6kS1O8m10MCQkGdrnlK9L4eAmZUwA=="
     },
     "libyara-wasm": {
-      "version": "0.0.12",
-      "resolved": "https://registry.npmjs.org/libyara-wasm/-/libyara-wasm-0.0.12.tgz",
-      "integrity": "sha512-AjTe4FiBuH4F7HwGT/3UxoRenczXtrbM6oWGrifxb44LrkDh5VxRNg9zwfPpDA5Fcc1iYcXS0WVA/b3DGtD8cQ=="
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/libyara-wasm/-/libyara-wasm-1.0.1.tgz",
+      "integrity": "sha512-Vq0EcQ3HRJinFxxb00JZpjyX8NCerazVhSf3+TVt1c21T3pcEJJ3RkanAwT71lW6CCmmmKuNU4QwqsinmR6pKQ=="
     },
     "linkify-it": {
       "version": "2.2.0",

+ 1 - 1
package.json

@@ -122,7 +122,7 @@
     "jsrsasign": "8.0.12",
     "kbpgp": "2.1.3",
     "libbzip2-wasm": "0.0.4",
-    "libyara-wasm": "0.0.12",
+    "libyara-wasm": "^1.0.1",
     "lodash": "^4.17.15",
     "loglevel": "^1.6.3",
     "loglevel-message-prefix": "^3.0.0",

+ 1 - 1
src/core/operations/YARARules.mjs

@@ -61,7 +61,7 @@ class YARARules extends Operation {
      * @param {Object[]} args
      * @returns {string}
      */
-    run(input, args) {
+    async run(input, args) {
         if (isWorkerEnvironment())
             self.sendStatusMessage("Instantiating YARA...");
         const [rules, showStrings, showLengths, showMeta, showCounts] = args;

+ 16 - 1
tests/node/tests/operations.mjs

@@ -31,7 +31,7 @@ import {
     cartesianProduct,
     CSSMinify,
     toBase64,
-    toHex,
+    toHex
 } from "../../../src/node/index";
 import chef from "../../../src/node/index.mjs";
 import TestRegister from "../../lib/TestRegister.mjs";
@@ -1059,5 +1059,20 @@ ExifImageHeight: 57`);
         assert.equal(unzipped.value[0].data, "some content");
     }),
 
+    it("YARA Rule Matching", async () => {
+        const input = "foobar foobar bar foo foobar";
+        const output = "Rule \"foo\" matches (4 times):\nPos 0, length 3, identifier $re1, data: \"foo\"\nPos 7, length 3, identifier $re1, data: \"foo\"\nPos 18, length 3, identifier $re1, data: \"foo\"\nPos 22, length 3, identifier $re1, data: \"foo\"\nRule \"bar\" matches (4 times):\nPos 3, length 3, identifier $re1, data: \"bar\"\nPos 10, length 3, identifier $re1, data: \"bar\"\nPos 14, length 3, identifier $re1, data: \"bar\"\nPos 25, length 3, identifier $re1, data: \"bar\"\n";
+
+        const res = await chef.YARARules(input, {
+            rules: "rule foo {strings: $re1 = /foo/ condition: $re1} rule bar {strings: $re1 = /bar/ condition: $re1}",
+            showStrings: true,
+            showStringLengths: true,
+            showMetadata: true
+        });
+
+        assert.equal(output, res.value);
+    }),
+
+
 ]);