Repository: mandiant/capa
File: scripts/lint.py (Python)

Code before:
    level = Lint.WARN

    def check_features(self, ctx: Context, features: list[Feature]):
        for feature in features:
            if isinstance(feature, (Regex,)):
                assert isinstance(feature.value, str)

                pat = feature.value.removeprefix("/")
                pat = pat.removesuffix("/i").removesuffix("/")

                index = pat.find(".")
                if index == -1:
                    return False

                if index < len(pat) - 1:
                    if pat[index + 1] in ("*", "+", "?", "{"):
                        # like "/VB5!.*/"
                        return False

                if index == 0:
                    # like "/.exe/"
                    self.recommendation = self.recommendation_template.format(feature.value)
                    return True

                if pat[index - 1] != "\\":
                    # like "/test.exe/"
                    self.recommendation = self.recommendation_template.format(feature.value)
                    return True

                if pat[index - 1] == "\\":
                    for i, char in enumerate(pat[0:index][::-1]):
                        if char == "\\":
                            continue

                        if i % 2 == 0:
                            # like "/\\\\.\\pipe\\VBoxTrayIPC/"
                            self.recommendation = self.recommendation_template.format(feature.value)
                            return True

                        break

        return False


class FeatureNegativeNumber(Lint):
    name = "feature value is negative"
    recommendation = "specify the number's two's complement representation"
    recommendation_template = (
        "capa treats number features as unsigned values; you may specify the number's two's complement "
        + 'representation; will not match on "{:d}"'
    )

Review comment (suggestion):
```suggestion
                    # like "/test.exe/" which should be "/test\.exe/"
```

Code after:
    level = Lint.WARN

    def check_features(self, ctx: Context, features: list[Feature]):
        for feature in features:
            if isinstance(feature, (Regex,)):
                assert isinstance(feature.value, str)

                pat = feature.value.removeprefix("/")
                pat = pat.removesuffix("/i").removesuffix("/")

                index = pat.find(".")
                if index == -1:
                    return False

                if index < len(pat) - 1:
                    if pat[index + 1] in ("*", "+", "?", "{"):
                        # like "/VB5!.*/"
                        return False

                if index == 0:
                    # like "/.exe/" which should be "/\.exe/"
                    self.recommendation = self.recommendation_template.format(feature.value)
                    return True

                if pat[index - 1] != "\\":
                    # like "/test.exe/" which should be "/test\.exe/"
                    self.recommendation = self.recommendation_template.format(feature.value)
                    return True

                if pat[index - 1] == "\\":
                    for i, char in enumerate(pat[0:index][::-1]):
                        if char == "\\":
                            continue

                        if i % 2 == 0:
                            # like "/\\\\.\\pipe\\VBoxTrayIPC/"
                            self.recommendation = self.recommendation_template.format(feature.value)
                            return True

                        break

        return False


class FeatureNegativeNumber(Lint):
    name = "feature value is negative"
    recommendation = "specify the number's two's complement representation"
    recommendation_template = (
        "capa treats number features as unsigned values; you may specify the number's two's complement "
        + 'representation; will not match on "{:d}"'
    )