diff --git a/yara-x/src/compiler/tests/mod.rs b/yara-x/src/compiler/tests/mod.rs index 1b8e65d2d..940826920 100644 --- a/yara-x/src/compiler/tests/mod.rs +++ b/yara-x/src/compiler/tests/mod.rs @@ -387,6 +387,36 @@ fn globals() { .len(), 2 ); + + #[cfg(feature = "test_proto2-module")] + { + let mut compiler = Compiler::new(); + + compiler + .define_global("str_foo", "foo") + .unwrap() + .add_source( + r#" + import "test_proto2-module" + rule foo { + condition: + str_foo == "foo" and + for all s in test_proto2.array_string: (s != str_foo) + }"#, + ) + .unwrap(); + + let rules = compiler.build(); + + assert_eq!( + Scanner::new(&rules) + .scan(&[]) + .expect("scan should not fail") + .matching_rules() + .len(), + 1 + ); + } } #[test] @@ -476,47 +506,3 @@ fn import_modules() { .add_source(r#"import "test_proto2" rule bar {condition: test_proto2.int32_zero == 0}"#) .is_ok()); } - -#[cfg(feature = "test_proto2-module")] -#[test] -fn issue() { - let mut compiler = Compiler::new(); - - compiler - .define_global("global_bool", false) - .unwrap() - .add_source( - r#"import "test_proto2" rule foo { - condition: - for all s in test_proto2.array_string: (s != "foo") - }"#, - ) - .unwrap(); - - let rules = compiler.build(); - let mut scanner = Scanner::new(&rules); - let _ = scanner.scan(b"foobar").unwrap(); -} - -#[test] -fn issue2() { - let mut compiler = Compiler::new(); - - compiler - .add_source( - r#" - import "hash" - import "pe" - rule winti_blackfly_rich_header - { - condition: - hash.md5(pe.rich_signature.clear_data) =="6e89f2fff33a5c1cd4c94c13f54f9e2c" or - hash.md5(pe.rich_signature.clear_data) =="52667216065ac5c098808eedfec7d70b" - }"#, - ) - .unwrap(); - - let rules = compiler.build(); - let mut scanner = Scanner::new(&rules); - let _ = scanner.scan(b"foobar").unwrap(); -} diff --git a/yara-x/src/modules/test_proto2/tests/mod.rs b/yara-x/src/modules/test_proto2/tests/mod.rs index 1f368d11c..66cd084ac 100644 --- a/yara-x/src/modules/test_proto2/tests/mod.rs +++ b/yara-x/src/modules/test_proto2/tests/mod.rs @@ -243,4 +243,11 @@ fn test_proto2_module() { // [(yara.field_options).name = "bool_yara"]; // condition_true!(r#"test_proto2.bool_yara"#); + + condition_true!( + r#" + test_proto2.add(test_proto2.int64_one, test_proto2.int64_one) == 2 and + test_proto2.add(test_proto2.int64_one, test_proto2.int64_zero) == 1 and + "# + ); }