fix(dsl): quoted strings

exein-io · Apr 18, 2024 · cc992ea · cc992ea
1 parent 346f73a
commit cc992ea
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 8 deletions.
diff --git a/crates/modules/rules-engine/src/dsl.lalrpop b/crates/modules/rules-engine/src/dsl.lalrpop
@@ -70,7 +70,7 @@ Comma<T>: Vec<T> = {
 }
 
 Value: String = {
-    r#""\S+""# => <>.trim_matches('"').to_string(),
+    r#""([^"\\]|\\.)*""# => <>.trim_matches('"').to_string(),
     r"[0-9]+" => <>.to_string()
 }
 

diff --git a/rules/basic-rules.yaml b/rules/basic-rules.yaml
@@ -74,14 +74,14 @@
     this technique to search for, analyze, or manipulate private keys or passwords on the system.
   condition: (
     payload.filename ENDS_WITH "/find" AND (payload.argv CONTAINS "id_rsa" OR payload.argv CONTAINS "id_dsa")
-  ) OR (
-    payload.filename ENDS_WITH "grep" AND (
-      payload.argv CONTAINS "BEGIN PRIVATE"
-        OR payload.argv CONTAINS "BEGIN RSA PRIVATE" 
-        OR payload.argv CONTAINS "BEGIN DSA PRIVATE"
-        OR payload.argv CONTAINS "BEGIN EC PRIVATE"
+    ) OR (
+      payload.filename ENDS_WITH "grep" AND (
+        payload.argv CONTAINS "BEGIN PRIVATE"
+          OR payload.argv CONTAINS "BEGIN RSA PRIVATE"
+          OR payload.argv CONTAINS "BEGIN DSA PRIVATE"
+          OR payload.argv CONTAINS "BEGIN EC PRIVATE"
+      )
     )
-  )
 
 
 # Add allowed files