Skip to content

match genops operands case-sensitively against unsafe strings #45

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
abdul-khaliq-khalid wants to merge 1 commit into
base: main
Choose a base branch
from
Open

match genops operands case-sensitively against unsafe strings #45

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 12 additions & 8 deletions saferpickle.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -565,19 +565,23 @@ def _categorize_genops(
unknown_results: Set[str] = set()

for line in filtered_output:
line_in_lowercase = line.lower()
# Match against the operand as-is. Python module and attribute names are
# case-sensitive and the string lists / patterns are case-sensitive too, so
# lowercasing here hides the mixed-case unsafe names (VirtualAlloc,
# CreateThread, RtlMoveMemory, WaitForSingleObject, Crypto, ...) that a
# global can carry.
unsafe_match = any(
unsafe_string in line_in_lowercase
unsafe_string in line
for unsafe_string in constants.UNSAFE_STRINGS
) and re.findall(utils.unsafe_pattern, line_in_lowercase)
) and re.findall(utils.unsafe_pattern, line)
safe_match = any(
safe_string in line_in_lowercase
safe_string in line
for safe_string in constants.SAFE_STRINGS
) and re.findall(utils.safe_pattern, line_in_lowercase)
) and re.findall(utils.safe_pattern, line)
suspicious_match = any(
suspicious_string in line_in_lowercase
suspicious_string in line
for suspicious_string in constants.SUSPICIOUS_STRINGS
) and re.findall(utils.suspicious_pattern, line_in_lowercase)
) and re.findall(utils.suspicious_pattern, line)

if unsafe_match:
for match in unsafe_match:
Expand All @@ -590,7 +594,7 @@ def _categorize_genops(
suspicious_results.add(match)
else:
# Only check for unknown if no other categories matched
unknown_match = re.findall(utils.unknown_pattern, line_in_lowercase)
unknown_match = re.findall(utils.unknown_pattern, line)
if unknown_match:
for match in unknown_match:
unknown_results.add(match)
Expand Down