lexicon consistency checks
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 0
- Forks
- 1
- PR merge metrics
- No merged PRs in 30d
Description
YARA has no way to share regex fragments between rules. that means rules covering the same "family" of patterns have to duplicate regex lexicons. things like:
- network tools:
curl|wget|nc|netcat|socat|scp|rsync|ssh - credential file paths:
~/.aws,~/.ssh,~/.kube/config,.env,.netrc, ... - secret-sounding env var suffixes:
KEY|TOKEN|SECRET|PASSWORD|...
human code review for this just won't scale
proposal
a test file (lexicon_consistency.test.ts) that reads the .yar files, extracts the known lexicons from a canonical rule, and asserts they appear verbatim in every rule participating in the family. narrow but catches the exact drift class we've already seen
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with lexicon_consistency.test.ts and inspect how the repository’s .yar files and canonical rules are organized. Implement the proposed consistency checks, then run the relevant TypeScript test command; done means participating rules contain each canonical family lexicon verbatim and drift is reported.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- security, testing-qa
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 68/100