Skip to content

feat: add inline YARA rules support - #1164

Merged
Pouyanpi merged 4 commits into
developfrom
feat/inmemory-yara-rules
May 5, 2025
Merged

feat: add inline YARA rules support#1164
Pouyanpi merged 4 commits into
developfrom
feat/inmemory-yara-rules

Conversation

@Pouyanpi

@Pouyanpi Pouyanpi commented May 1, 2025

Copy link
Copy Markdown
Collaborator

PR Description by GH Copilot

This pull request refactors and enhances the injection detection module by improving configuration validation, supporting inline YARA rules, and adding new tests. The changes aim to make the code more modular, robust, and easier to extend.

Refactoring and Validation Improvements:

  • Renamed _validate_unpack_config to validate_injection_config and updated it to focus solely on validating the configuration without unpacking values. [1] [2]
  • Introduced extract_injection_config to handle the extraction and processing of configuration values, separating concerns for better modularity.
  • Enhanced validation logic for action_option and yara_path to ensure stricter checks and clearer error messages. [1] [2]

Support for Inline YARA Rules:

  • Added support for defining YARA rules inline via a new yara_rules dictionary in the configuration. This allows rules to be loaded directly from strings instead of files. [1] [2]
  • Updated the load_rules function to handle both file-based and inline rule sources.

Test Suite Enhancements:

  • Updated existing tests to use the new validate_injection_config and extract_injection_config functions. [1] [2]
  • Added a new test, test_load_inline_yara_rules, to validate the functionality of inline YARA rules.

Other Changes:

  • Made yara_path optional in the InjectionDetection configuration and added the new yara_rules field.
  • Updated imports and removed unused _validate_unpack_config references across the codebase.

@Pouyanpi Pouyanpi changed the title Feat/inmemory yara rules feat: add inline YARA rules support May 1, 2025
@Pouyanpi Pouyanpi added the enhancement New feature or request label May 1, 2025
@Pouyanpi Pouyanpi added this to the v0.14.0 milestone May 1, 2025
@Pouyanpi
Pouyanpi requested a review from erickgalinkin May 1, 2025 14:16
@Pouyanpi

Pouyanpi commented May 1, 2025

Copy link
Copy Markdown
Collaborator Author

should be merged after #1162

@erickgalinkin erickgalinkin left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to me, thanks!

@Pouyanpi
Pouyanpi marked this pull request as ready for review May 2, 2025 06:49
@Pouyanpi
Pouyanpi force-pushed the feat/inmemory-yara-rules branch from 4e065c8 to 7fcf74a Compare May 2, 2025 06:53
@codecov-commenter

codecov-commenter commented May 2, 2025

Copy link
Copy Markdown

Codecov Report

Attention: Patch coverage is 91.42857% with 3 lines in your changes missing coverage. Please review.

Project coverage is 68.03%. Comparing base (6d55b82) to head (037795c).

Files with missing lines Patch % Lines
...oguardrails/library/injection_detection/actions.py 90.90% 3 Missing ⚠️
Additional details and impacted files
@@             Coverage Diff             @@
##           develop    #1164      +/-   ##
===========================================
+ Coverage    68.00%   68.03%   +0.02%     
===========================================
  Files          161      161              
  Lines        15801    15813      +12     
===========================================
+ Hits         10746    10758      +12     
  Misses        5055     5055              
Flag Coverage Δ
python 68.03% <91.42%> (+0.02%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines Coverage Δ
nemoguardrails/rails/llm/config.py 89.63% <100.00%> (+0.01%) ⬆️
...oguardrails/library/injection_detection/actions.py 80.16% <90.90%> (+1.98%) ⬆️
🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@Pouyanpi
Pouyanpi force-pushed the feat/inmemory-yara-rules branch from 7fcf74a to 037795c Compare May 2, 2025 12:31
@Pouyanpi
Pouyanpi requested a review from trebedea May 2, 2025 12:31

@trebedea trebedea left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.

@Pouyanpi
Pouyanpi merged commit 0ba9909 into develop May 5, 2025
@Pouyanpi
Pouyanpi deleted the feat/inmemory-yara-rules branch May 5, 2025 07:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants