Merge pull request #303 from frack113:reverse_regex

Return a SigmaString if the regex is empty
SigmaHQ · Nov 10, 2024 · 380ec89 · 380ec89
2 parents 6480171 + 01fcbeb
commit 380ec89
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/sigma/processing/transformations.py b/sigma/processing/transformations.py
@@ -1000,7 +1000,7 @@ def apply_string_value(self, field: str, val: SigmaString) -> Optional[SigmaStri
 
         # empty string can not be convert into a simple regex
         if val == "":
-            return SigmaRegularExpression("")
+            return val
 
         for sc in val.s:  # iterate over all SigmaString components (strings and special chars)
             if isinstance(sc, str):  # if component is a string

diff --git a/tests/test_processing_transformations.py b/tests/test_processing_transformations.py
@@ -1548,7 +1548,7 @@ def test_regex_transformation_empty_string(dummy_pipeline):
     detection_item = SigmaDetectionItem("field", [], [SigmaString("")])
     transformation = RegexTransformation(method="plain")
     transformation.apply_detection_item(detection_item)
-    assert detection_item.value[0] == SigmaRegularExpression("")
+    assert detection_item.value[0] == SigmaString("")
 
 
 def test_regex_transformation_case_insensitive_bracket_method(dummy_pipeline):