allow call as valid subscope for call scoped rules

mandiant · Nov 14, 2024 · 03e4778 · 03e4778
1 parent ec697c0
commit 03e4778
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 2 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -4,6 +4,8 @@
 
 ### New Features
 
+- allow call as valid subscope for call scoped rules @mr-tz
+
 ### Breaking Changes
 
 - remove support for Python 3.8 and use Python 3.10 as minimum now #1966 @mr-tz

diff --git a/capa/rules/__init__.py b/capa/rules/__init__.py
@@ -630,8 +630,8 @@ def build_statements(d, scopes: Scopes):
         )
 
     elif key == "call":
-        if all(s not in scopes for s in (Scope.FILE, Scope.PROCESS, Scope.THREAD)):
-            raise InvalidRule("call subscope supported only for the process and thread scopes")
+        if all(s not in scopes for s in (Scope.FILE, Scope.PROCESS, Scope.THREAD, Scope.CALL)):
+            raise InvalidRule("call subscope supported only for the process, thread, and call scopes")
 
         if len(d[key]) != 1:
             raise InvalidRule("subscope must have exactly one child statement")