capa
capa copied to clipboard
check if basic block child of correct type
we should add a check to the following code that verifies the single child statement is of the expected type:
https://github.com/fireeye/capa/blob/14e65c46011aca908863a770ec925cc222dc7f93/capa/rules.py#L347-L354
from my understanding a single subscope child statement must be one of and
, or
, optional
, not
, N or more
?
however, it looks like we have a rule (maybe more I haven't verified) that have gotten away with a single subscope child statement of any type e.g.
https://github.com/fireeye/capa-rules/blob/1ff994f7916d66e39b4b5b8dbb310d0e0b051f7f/compiler/rust/compiled-with-rust.yml#L1-L14
do we need to restrict the type of the single subscope child statement? I feel like this is the intention, but capa doesn't enforce this. IMO we should enforce the type to avoid confusion e.g. if I can nest one mnemonic
under basic block
why can't I nest two?
thoughts @Ana06 , @mr-tz , @williballenthin ?
yes, the subscope should have a single child item, one of and/or/X or more.
a subscope block is translated (behind the scenes) into a separate capa rule and all capa rules should have a single root element. therefore, we should enforce the same at each subscope.
looks like this is only enforced during deserialization, though we should probably have a lint for it, too
https://github.com/fireeye/capa/blob/master/capa/rules.py#L565-L568