yara-x 1.15.0

A pure Rust implementation of YARA.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62

use pretty_assertions::assert_eq;

#[test]
fn get_filetype() {
    assert_eq!(
        "RISC OS music file",
        crate::modules::magic::get_type(b"Maestro\r").unwrap()
    )
}

#[test]
fn get_mimetype() {
    assert_eq!(
        "text/plain",
        crate::modules::magic::get_mime_type(b"foobar").unwrap()
    )
}

#[test]
fn e2e_test() {
    let rules = crate::compile(
        r#"
    import "magic"
    rule t { 
      condition: 
        magic.type() == "RISC OS music file" and 
        magic.mime_type() == "text/plain" and 
        // Call the functions twice, in order to exercise the caching
        // mechanism.
        magic.type() == "RISC OS music file" and 
        magic.mime_type() == "text/plain"
    }"#,
    )
    .unwrap();

    let mut scanner = crate::scanner::Scanner::new(&rules);
    let results = scanner.scan(b"Maestro\r").unwrap();

    assert_eq!(results.matching_rules().len(), 1);
}

// Test case that covers the following issue:
// https://github.com/robo9k/rust-magic/issues/358
#[test]
fn magic_crash() {
    let rules = crate::compile(
        r#"
    import "magic"
    rule t {
      condition:
        magic.mime_type() == "foo"
    }"#,
    )
    .unwrap();

    let mut scanner = crate::scanner::Scanner::new(&rules);
    let results = scanner
        .scan(&[0x00, 0x00, 0xfe, 0xff, 0xff, 0xff, 0x2a, 0x08])
        .unwrap();

    assert_eq!(results.matching_rules().len(), 0);
}