Skip to content

Commit

Permalink
Select hash for context and SHA1 & MD5, solve issue avast#136
Browse files Browse the repository at this point in the history
New:  Select hash for context and SHA1 & MD5
New: Case ignore in hashes, because why not
Bugfix: Only show "Select hash for context" next to valid hashes

Solve avast#136
  • Loading branch information
ruppde authored and MatejKastak committed Oct 23, 2023
1 parent a0348ce commit 4505ba1
Show file tree
Hide file tree
Showing 4 changed files with 19 additions and 13 deletions.
1 change: 1 addition & 0 deletions .gitignore
Original file line number Diff line number Diff line change
Expand Up @@ -2,3 +2,4 @@
.ropeproject
__pycache__
dist
*.swp
13 changes: 7 additions & 6 deletions tests/unit/test_utils.py
Original file line number Diff line number Diff line change
Expand Up @@ -67,12 +67,13 @@ def test_first_non_space():


def test_is_sha():
assert utils.is_sha256_hash("f3b7edffa346c23f24beba4d93880f358532085b3598319fed0cfa3010bbe675")
assert not utils.is_sha256_hash("")
assert utils.is_sha256_hash("a" * 64)
assert not utils.is_sha256_hash("A" * 64)
assert not utils.is_sha256_hash(" " + "A" * 64)
assert not utils.is_sha256_hash("A" * 64 + " ")
assert utils.is_hash("f3b7edffa346c23f24beba4d93880f358532085b3598319fed0cfa3010bbe675")
assert utils.is_hash("93880f358532085b3598319fed0cfa3010bbe675")
assert utils.is_hash("8532085b3598319fed0cfa3010bbe675")
assert utils.is_hash("8532085B3598319FED0CFA3010BBE675")
assert not utils.is_hash("")
assert not utils.is_hash(" " + "A" * 64)
assert not utils.is_hash("A" * 64 + " ")


def test_range_from_line(mocker: MockerFixture):
Expand Down
4 changes: 2 additions & 2 deletions yls/server.py
Original file line number Diff line number Diff line change
Expand Up @@ -477,7 +477,7 @@ def code_lens_eval(yara_file: yaramod.YaraFile) -> list[lsp_types.CodeLens]:
for rule in utils.yaramod_rules_in_file(yara_file):
for meta in rule.metas:
# Consider only hash metas that have valid hash as value
if meta.key != "hash" and not utils.is_sha256_hash(meta.value.pure_text):
if meta.key != "hash" or not utils.is_hash(meta.value.pure_text):
continue

# Create code lens for debugging
Expand Down Expand Up @@ -595,7 +595,7 @@ async def command_eval_set_context(ls: YaraLanguageServer, args: list[Any]) -> N
utils.log_command(YaraLanguageServer.COMMAND_EVAL_SET_CONTEXT)
log.debug(f"{args=}")

if len(args) != 2 or not utils.is_sha256_hash(args[0]):
if len(args) != 2 or not utils.is_hash(args[0]):
return

_hash = args[0]
Expand Down
14 changes: 9 additions & 5 deletions yls/utils.py
Original file line number Diff line number Diff line change
Expand Up @@ -484,11 +484,15 @@ def debug_hover(document: Document, position: lsp_types.Position) -> lsp_types.H
return lsp_types.Hover(contents=f"Token = {token}\nLSP Position = {position}")


def is_sha256_hash(i: str) -> bool:
"""Check if the `i` looks like a sha256 hash.
def is_hash(i: str) -> bool:
"""Check if the `i` looks like a md5, sha1 or sha256 hash.
We accept only lowercase hashes because it is the same behavior as YRTC."""
return re.fullmatch("[0-9a-f]{64}", i) is not None
We accept upper and lowercase hashes"""
return (
re.fullmatch("[0-9a-f]{32}", i, flags=re.IGNORECASE) or
re.fullmatch("[0-9a-f]{40}", i, flags=re.IGNORECASE) or
re.fullmatch("[0-9a-f]{64}", i, flags=re.IGNORECASE)
) is not None


def markdown_content(value: str) -> lsp_types.MarkupContent:
Expand Down Expand Up @@ -526,7 +530,7 @@ def yaramod_rule_has_hashes(rule: yaramod.Rule) -> bool:
"""Check if YARA rule contains sample hashes in hash meta."""
for meta in rule.metas:
# Consider only hash metas that have valid hash as value
if meta.key != "hash" or not is_sha256_hash(meta.value.pure_text):
if meta.key != "hash" or not is_hash(meta.value.pure_text):
continue

return True
Expand Down

0 comments on commit 4505ba1

Please sign in to comment.