Broken Syntax Highlighting

[infosec-intern]

Broken Syntax Highlighting

[infosec-intern]

Working on pushing out the fix in 1.6.5 now. This did uncover another issue with improper identification of invalid escaped slashes too, which I'll try to fix & test more comprehensively. No need for that to interrupt this though. Great work @DissectMalware, and thanks again for bringing the issue up @Neo23x0. If you find more of these please don't hesitate to bring them up

[infosec-intern]

This looks fixed in version 1.6.5, which is now available in the marketplace. I'm gonna close this issue, but if this problem persists please feel free to reopen this or create a new issue.

[DissectMalware]

     {
      "name": "string.quoted.double.yara",
      "begin": "\"",
      "end": "[^\\\\]\"",
      "patterns": [
        {
          "name": "invalid.illegal.missing.escape.yara",
          "match": "[^\\\\]\\\\[^\\\\\"]"
        }
      ]
    }

changing [^\\\\]" to (?<=[^\\])(\((\\)*\))?" should solve the issue

zero or even numbers of backslash chars -> valid
odd numbers of backslash chars -> invalid

\\\\" -> valid
\\\\\" invalid

vscode-yara/yara/syntaxes/yara.tmLanguage.json

Line 148 in fe196db

"end": "[^\\\\]\"",

[DissectMalware]

Changed the following file

%USERPROFILE%.vscode\extensions\infosec-intern.yara-1.6.4\yara\syntaxes\yara.tmLanguage.json

    {
      "name": "string.quoted.double.yara",
      "begin": "\"",
      "end": "(?<=[^\\\\])(\\\\((\\\\\\\\)*\\\\))?\"",
      "patterns": [
        {
          "name": "invalid.illegal.missing.escape.yara",
          "match": "[^\\\\]\\\\[^\\\\\"]"
        }
      ]
    }

After saving the change and reopening the VS Code, you should see:

[infosec-intern]

Dang, I really thought I had this sewed up in that version. Thanks for opening the issue @Neo23x0 and the writeup @DissectMalware! I'll get to fixing this later today