Merge pull request #154 from Res260/fixescaperegex

Fix a bug where SigmaRegularExpression.escape() was buggy when using …

sigma/types.py

@@ -1,5 +1,9 @@
-from math import inf
+import re
+from abc import ABC
+from dataclasses import dataclass, field
 from enum import Enum, auto
+from ipaddress import IPv4Network, IPv6Network, ip_network
+from math import inf
 from typing import (
     ClassVar,
     Dict,
@@ -14,18 +18,14 @@
     Callable,
     Iterator,
 )
-from abc import ABC
-from dataclasses import dataclass, field
-from enum import Enum, auto
-import re
+
 from sigma.exceptions import (
     SigmaPlaceholderError,
     SigmaRuleLocation,
     SigmaValueError,
     SigmaRegularExpressionError,
     SigmaTypeError,
 )
-from ipaddress import IPv4Network, IPv6Network, ip_network
 
 
 class SpecialChars(Enum):
@@ -644,9 +644,13 @@ def escape(
                 if e is not None
             ]
         )
-        pos = [  # determine positions of matches in regular expression
-            m.start() for m in re.finditer(r, self.regexp)
-        ]
+        pos = (
+            [  # determine positions of matches in regular expression
+                m.start() for m in re.finditer(r, self.regexp)
+            ]
+            if r is not ""
+            else []
+        )
         ranges = zip([None, *pos], [*pos, None])  # string chunk ranges with escapes in between
         ranges = list(ranges)
 

tests/test_types.py

@@ -1,6 +1,14 @@
-from ipaddress import IPv4Network, IPv6Network
 import re
+from ipaddress import IPv4Network, IPv6Network
+
 import pytest
+
+from sigma.exceptions import (
+    SigmaPlaceholderError,
+    SigmaTypeError,
+    SigmaValueError,
+    SigmaRegularExpressionError,
+)
 from sigma.types import (
     SigmaBool,
     SigmaCasedString,
@@ -17,12 +25,6 @@
     sigma_type,
     SigmaCIDRExpression,
 )
-from sigma.exceptions import (
-    SigmaPlaceholderError,
-    SigmaTypeError,
-    SigmaValueError,
-    SigmaRegularExpressionError,
-)
 
 
 @pytest.fixture
@@ -509,6 +511,18 @@ def test_re_escape_without_escape():
     )
 
 
+def test_re_escape_with_escape_escape_char_param():
+    # See issue #153 https://github.com/SigmaHQ/pySigma/issues/153
+    assert (
+        SigmaRegularExpression("bitsadmin\\.exe").escape(escape_escape_char=True)
+        == "bitsadmin\\\\.exe"
+    )
+    assert (
+        SigmaRegularExpression("bitsadmin\\.exe").escape(escape_escape_char=False)
+        == "bitsadmin\\.exe"
+    )
+
+
 def test_bool():
     assert SigmaBool(True).boolean == True