Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add new regex validator - SigmahqUnsupportedRegexGroupConstruct #15

Merged
merged 3 commits into from
Aug 11, 2024

Conversation

nasbench
Copy link
Member

@nasbench nasbench commented Aug 11, 2024

This PR adds SigmahqUnsupportedRegexGroupConstruct validator in order to check if a rule using the re modifier is using an unsupported group construct such as a negative lookahead. Such constructs are currently unsupported by multiple language such as rust and golang.

@nasbench nasbench requested review from thomaspatzke and frack113 and removed request for thomaspatzke and frack113 August 11, 2024 15:19
@nasbench
Copy link
Member Author

@thomaspatzke if you also could please provide feedback on this PR (as you are more versed in regex), that would be much appreciated.

Copy link
Member

@frack113 frack113 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@thomaspatzke
Copy link
Member

Good one! Perhaps we should even be more strict, turn it around and allowlist regular expression patterns instead of disallowing, as there might be further constructs that could be problematic constructs like (?(id)yes|no). Anyways, the current approach already should catch commonly used REs.

@thomaspatzke thomaspatzke merged commit 362b868 into SigmaHQ:main Aug 11, 2024
12 checks passed
@nasbench nasbench deleted the add-lookahead-test branch August 11, 2024 22:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants