mandiant / mandiant/capa

stale cache can crash with _RuleFeatureIndex.bytes_prefix_index AttributeError

Open
#2,961 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Python
Stars
6.2k
Forks
726
Avg merge
11d 11h
Merged PRs (30d)
7

Description

capa can crash when a stale rules cache (from older _RuleFeatureIndex schema) is loaded.
Current error: AttributeError: '_RuleFeatureIndex' object has no attribute 'bytes_prefix_index' during matching.
Expected behavior is cache invalidation/rebuild instead of runtime failure.
This impacts normal analysis and scripts that rely on cached rule loading.
Suggested fix: bump cache format (or equivalent invalidation) and handle schema mismatch as cache-miss.

Contributor guide

Open the contributing guide

Research direction

Start by locating the cache-loading path and the _RuleFeatureIndex definition, then reproduce matching with a cache created from the older schema. Verify that the schema mismatch is treated as a cache miss and that the cache is invalidated or rebuilt without an AttributeError during normal analysis and cached rule loading.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
tooling
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.