feat: implement pattern count, pattern length and pattern offset expr…

…essions
VirusTotal · Jul 8, 2024 · d9a6e86 · d9a6e86
1 parent 699137e
commit d9a6e86
Show file tree

Hide file tree

Showing 7 changed files with 453 additions and 12 deletions.
diff --git a/parser-ng/src/parser/cst/syntax_kind.rs b/parser-ng/src/parser/cst/syntax_kind.rs
@@ -99,6 +99,9 @@ pub enum SyntaxKind {
 
     IDENT,
     PATTERN_IDENT,
+    PATTERN_LENGTH,
+    PATTERN_OFFSET,
+    PATTERN_COUNT,
 
     IMPORT_STMT,
     RULE_DECL,
@@ -232,6 +235,9 @@ impl SyntaxKind {
             SyntaxKind::REGEXP => TokenId::REGEXP,
             SyntaxKind::IDENT => TokenId::IDENT,
             SyntaxKind::PATTERN_IDENT => TokenId::PATTERN_IDENT,
+            SyntaxKind::PATTERN_LENGTH => TokenId::PATTERN_LENGTH,
+            SyntaxKind::PATTERN_OFFSET => TokenId::PATTERN_OFFSET,
+            SyntaxKind::PATTERN_COUNT => TokenId::PATTERN_COUNT,
 
             SyntaxKind::COLON => TokenId::COLON,
             SyntaxKind::COMMA => TokenId::COMMA,
@@ -339,6 +345,10 @@ impl From<&Token> for SyntaxKind {
             // Identifiers
             Token::IDENT(_) => SyntaxKind::IDENT,
             Token::PATTERN_IDENT(_) => SyntaxKind::PATTERN_IDENT,
+            Token::PATTERN_OFFSET(_) => SyntaxKind::PATTERN_OFFSET,
+            Token::PATTERN_COUNT(_) => SyntaxKind::PATTERN_COUNT,
+            Token::PATTERN_LENGTH(_) => SyntaxKind::PATTERN_LENGTH,
+
             // Trivia
             Token::COMMENT(_) => SyntaxKind::COMMENT,
             Token::WHITESPACE(_) => SyntaxKind::WHITESPACE,

diff --git a/parser-ng/src/parser/mod.rs b/parser-ng/src/parser/mod.rs
@@ -1246,15 +1246,18 @@ impl<'src> InternalParser<'src> {
     ///
     /// ```text
     /// PRIMARY_EXPR := (
-    ///     FLOAT_LIT           |
-    ///     INTEGER_LIT         |
-    ///     STRING_LIT          |
-    ///     REGEXP              |
-    ///     `filesize`          |
-    ///     `entrypoint`        |
-    ///     `-` TERM            |
-    ///     `~` TERM            |
-    ///     `(` EXPR `)`        |
+    ///     FLOAT_LIT                          |
+    ///     INTEGER_LIT                        |
+    ///     STRING_LIT                         |
+    ///     REGEXP                             |
+    ///     `filesize`                         |
+    ///     `entrypoint`                       |
+    ///     PATTERN_COUNT (`in` RANGE)?        |
+    ///     PATTERN_OFFSET (`[` EXPR `]`)?     |
+    ///     PATTERN_LENGTH (`[` EXPR `]`)?     |
+    ///     `-` TERM                           |
+    ///     `~` TERM                           |
+    ///     `(` EXPR `)`                       |
     ///     IDENT (`.` IDENT)*
     /// )
     /// ``
@@ -1269,6 +1272,15 @@ impl<'src> InternalParser<'src> {
                     | FILESIZE_KW
                     | ENTRYPOINT_KW))
             })
+            .alt(|p| {
+                p.expect(t!(PATTERN_COUNT))
+                    .opt(|p| p.expect(t!(IN_KW)).range())
+            })
+            .alt(|p| {
+                p.expect(t!(PATTERN_OFFSET | PATTERN_LENGTH)).opt(|p| {
+                    p.expect(t!(L_BRACKET)).expr().expect(t!(R_BRACKET))
+                })
+            })
             .alt(|p| p.expect(t!(MINUS)).term())
             .alt(|p| p.expect(t!(BITWISE_NOT)).term())
             .alt(|p| p.expect(t!(L_PAREN)).expr().expect(t!(R_PAREN)))

diff --git a/parser-ng/src/parser/tests/testdata/expr-4.in b/parser-ng/src/parser/tests/testdata/expr-4.in
@@ -0,0 +1,42 @@
+rule test_1 {
+   strings:
+     $a = "foo"
+   condition:
+     $a
+}
+
+rule test_2 {
+   strings:
+     $a = "foo"
+   condition:
+     $a in (0..10)
+}
+
+
+rule test_3 {
+   strings:
+     $a = "foo"
+   condition:
+     $a at filesize
+}
+
+rule test_4 {
+   strings:
+     $a = "foo"
+   condition:
+     #a in (0..10)
+}
+
+rule test_5 {
+   strings:
+     $a = "foo"
+   condition:
+     @a == 10 and @a[0] == 10
+ }
+
+ rule test_6 {
+    strings:
+      $a = "foo"
+    condition:
+      !a == 10 and !a[1+1] == 10
+  }