jeromehadorn/yara-json

YARA C Module for finding key and values in JSON files

yara-json's Issues

key_exists doesnt work for keys which contain a dot when trying to check for a nested key

Hi :)

First of all, very big thanks for this! This already helps tons!

After trying it, I wanted to work with a json like this:

{
  "body": "Hello Alice!",
  "format": "org.matrix.custom.html",
  "formatted_body": "Hello \u003ca href='https://matrix.to/#/@alice:example.org'\u003eAlice\u003c/a\u003e!",
  "m.mentions": {
    "user_ids": [
      "@alice:example.org",
      "@alice:example.org",
      "@alice:example.org",
      "@alice:example.org"
    ]
  },
  "msgtype": "m.text"
}

The specification of matrix.org which defines this json uses lots of java like namespacing in their keys. However, when I tried to write a yara condition it can't match since there are dots in the keys and the module is using that to split it:

For example: json.key_exists("m.mentions.user_ids") won't work since it searches for user_ids in mentions in m.

The code at

YARA-JSON/json.c

Line 44 in 4b63c79

// Split key into possible subcomponents - separated by '.'

probably needs some kind of escape sequence support. Would it be possible to add that? I am sadly not good at all in C hence I am asking rather than making a PR :)