8u1a/plyara

Fail to parse empty metadata

Closed this issue · 1 comments

dradu commented

There seems to be an when parsing metadata with emty value

I took the following example from YARA website and replace my_identifier_1 value with an empty one.

rule MetadataExample
{
meta:
my_identifier_1 = ""
my_identifier_2 = 24
my_identifier_3 = true

strings:
    $my_text_string = "text here"
    $my_hex_string = { E2 34 A1 C8 23 FB }

condition:
    $my_text_string or $my_hex_string

}

Error:
Illegal character " at line

8u1a commented

Thanks for reporting dradu. Updated t_STRING to accept empty strings and added a unit test to assert this behavior.