Repository: mandiant/capa
File: capa/render/result_document.py (Python)

Code before:
                            # for example, the feature might be `match: anti-analysis/packer`
                            # which matches against "generic unpacker" and "UPX".
                            # in this case, doc[locations] contains locations for *both* of those.
                            #
                            # rule_matches contains the matches for the specific rule.
                            # this is a subset of doc[locations].
                            #
                            # so, grab only the locations for current rule.

                            # keep this in sync with the block above.
                            if isinstance(location, DynamicCallAddress):
                                if location in rule_matches:
                                    children.append(Match.from_capa(rules, capabilities, rule_matches[location]))
                                else:
                                    matches_in_thread = sorted(
                                        [
                                            (a.id, m)
                                            for a, m in rule_matches.items()
                                            if isinstance(a, DynamicCallAddress)
                                            and a.thread == location.thread
                                            and a.id <= location.id
                                        ]
                                    )
                                    if matches_in_thread:
                                        _, most_recent_match = matches_in_thread[-1]
                                        children.append(Match.from_capa(rules, capabilities, most_recent_match))
                            else:
                                if location in rule_matches:
                                    children.append(Match.from_capa(rules, capabilities, rule_matches[location]))

        return cls(
            success=success,
            node=node,
            children=tuple(children),
            locations=tuple(locations),
            captures={capture: tuple(captures[capture]) for capture in captures},
        )

    def to_capa(self, rules_by_name: dict[str, capa.rules.Rule]) -> capa.engine.Result:
        children = [child.to_capa(rules_by_name) for child in self.children]
        statement = node_to_capa(self.node, [child.statement for child in children])

        if isinstance(self.node, FeatureNode):
            feature = self.node.feature

            if isinstance(feature, (frzf.SubstringFeature, frzf.RegexFeature)):
                matches = {capture: {loc.to_capa() for loc in locs} for capture, locs in self.captures.items()}

                if isinstance(feature, frzf.SubstringFeature):
                    assert isinstance(statement, capa.features.common.Substring)
                    statement = capa.features.common._MatchedSubstring(statement, matches)

Review comment (suggestion):
`matches_in_thread` may be empty if `location` is from a different matched rule within the same namespace.

Code after:
                            # for example, the feature might be `match: anti-analysis/packer`
                            # which matches against "generic unpacker" and "UPX".
                            # in this case, doc[locations] contains locations for *both* of those.
                            #
                            # rule_matches contains the matches for the specific rule.
                            # this is a subset of doc[locations].
                            #
                            # so, grab only the locations for current rule.

                            # keep this in sync with the block above.
                            if isinstance(location, DynamicCallAddress):
                                if location in rule_matches:
                                    children.append(Match.from_capa(rules, capabilities, rule_matches[location]))
                                else:
                                    matches_in_thread = sorted(
                                        [
                                            (a.id, m)
                                            for a, m in rule_matches.items()
                                            if isinstance(a, DynamicCallAddress)
                                            and a.thread == location.thread
                                            and a.id <= location.id
                                        ]
                                    )
                                    # namespace matches may not occur within the same thread as the result, so only
                                    # proceed if a match within the same thread is found
                                    if matches_in_thread:
                                        _, most_recent_match = matches_in_thread[-1]
                                        children.append(Match.from_capa(rules, capabilities, most_recent_match))
                            else:
                                if location in rule_matches:
                                    children.append(Match.from_capa(rules, capabilities, rule_matches[location]))

        return cls(
            success=success,
            node=node,
            children=tuple(children),
            locations=tuple(locations),
            captures={capture: tuple(captures[capture]) for capture in captures},
        )

    def to_capa(self, rules_by_name: dict[str, capa.rules.Rule]) -> capa.engine.Result:
        children = [child.to_capa(rules_by_name) for child in self.children]
        statement = node_to_capa(self.node, [child.statement for child in children])

        if isinstance(self.node, FeatureNode):
            feature = self.node.feature

            if isinstance(feature, (frzf.SubstringFeature, frzf.RegexFeature)):
                matches = {capture: {loc.to_capa() for loc in locs} for capture, locs in self.captures.items()}

                if isinstance(feature, frzf.SubstringFeature):