From 1a902eaf903328707a5070cb65031d0a21623833 Mon Sep 17 00:00:00 2001 From: "Victor M. Alvarez" Date: Tue, 14 May 2024 12:42:55 +0200 Subject: [PATCH] docs: some additions to the documentation. --- site/content/docs/api/c.md | 24 +++++++++++++++++++++++- site/content/docs/api/python.md | 22 ++++++++++++++++++++++ 2 files changed, 45 insertions(+), 1 deletion(-) diff --git a/site/content/docs/api/c.md b/site/content/docs/api/c.md index 9bb66768f..f91053ed6 100644 --- a/site/content/docs/api/c.md +++ b/site/content/docs/api/c.md @@ -148,11 +148,33 @@ rules in text form and compile them into a [YRX_RULES](#yrx_rules) object. ```c enum YRX_RESULT yrx_compiler_create( + uint32_t flags, struct YRX_COMPILER **compiler); ``` Creates a new compiler. It must be destroyed -with [yrx_compiler_destroy](#yrx_compiler_destroy). +with [yrx_compiler_destroy](#yrx_compiler_destroy). The `flags` argument can be +0, or any +combination of the following flags: + +* YRX_COLORIZE_ERRORS + + Add colors to error messages. + +* YRX_RELAXED_RE_ESCAPE_SEQUENCES + + Historically, YARA has accepted any character preceded by a backslash in a + regular expression, regardless of whether the sequence is valid. For example, + `\n`, `\t`, and `\w` are valid escape sequences in a regexp, but `\N`, `\T`, + and `\j` are not. YARA accepts all of these sequences. Valid escape + sequences are interpreted according to their special meaning (`\n` as a + new-line, `\w` as a word character, etc.), while invalid escape sequences are + interpreted simply as the character that appears after the backslash. Thus, + `\N` becomes `N`, and `\j` becomes `j`. + + When this flag is set, YARA-X exhibits the same behaviour as YARA and accepts + these invalid escape sequences. By default, invalid escape sequences produce + an error in YARA-X. #### yrx_compiler_destroy diff --git a/site/content/docs/api/python.md b/site/content/docs/api/python.md index 67d3f5a26..d0799825e 100644 --- a/site/content/docs/api/python.md +++ b/site/content/docs/api/python.md @@ -125,6 +125,28 @@ rules = yara_x.compile("rule test { condition: true }") Type that represents a YARA-X compiler. It takes one or more sets of YARA rules in text form and compile them into a [Rules](#rules) object. +#### .__init__(relaxed_re_escape_sequences=False) + +Compiler constructor. The `relaxed_re_escape_sequences` determines whether +the compiler accepts invalid escape sequences in regular expressions. + +Historically, YARA has accepted any character preceded by a backslash in a +regular expression, regardless of whether the sequence is valid. For example, +`\n`, `\t` and `\w` are valid escape sequences in a regexp, but `\N`, `\T` and +`\j` are not. YARA accepts all of these sequences. Valid escape sequences are +interpreted according to their special meaning (`\n` as a new-line, `\w` as a +word character, etc.), while invalid escape sequences are interpreted simply as +the character that appears after the backslash. Thus, `\N` becomes `N`, and `\j` +becomes `j`. By setting `relaxed_re_escape_sequences` to `True` the compiler +behaves as the YARA compiler and accepts these invalid escape sequences. + +###### Example + +```python +compiler = yara_x.Compiler(relaxed_re_escape_sequences=True) +compiler.add_source("rule test { $a = /\Release/ condition: $a }") +``` + #### .add_source(string) Adds some YARA source code to be compiled. Raises an exception if the source