@automattic/yara 2.3.0 → 2.5.0

package/.dockerignore

@@ -0,0 +1,6 @@
+Dockerfile
+README.md
+build/
+deps/yara-*
+example/
+node_modules/

package/.github/dependabot.yml

@@ -0,0 +1,14 @@
+# https://help.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
+# https://docs.github.com/en/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/configuration-options-for-dependency-updates#package-ecosystem
+version: 2
+
+updates:
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "daily"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: daily

package/.github/workflows/build.yml

@@ -0,0 +1,108 @@
+# Here we build the yara.node binary, package it and copy it to the repository.
+# Both MacOS and Linux (Debian-based) versions are built here.
+name: Build the binary
+
+on:
+  push:
+    branches: [ master ]
+  pull_request:
+
+# allow these jobs to commit to the repository
+permissions:
+  contents: write
+
+jobs:
+  # We need to use the node-yara binary on Debian 10.x machines
+  # hence we're using the container to build it
+  build-debian:
+    strategy:
+      fail-fast: false
+      matrix:
+        node-version:
+#        - '14'
+        - '16'
+#        - '18'
+
+    runs-on: ubuntu-22.04
+
+    steps:
+    - uses: actions/checkout@v3
+
+    - name: Build binaries inside the container
+      run: |
+        set -x
+        
+        # what's the package version?
+        # e.g.  Binary staged at "build/stage/Automattic/node-yara/raw/master/binaries/yara-v2.5.0-linux-x64.tar.gz"
+        export PACKAGE_VERSION=$(jq -r .version package.json)
+
+        # build inside the container and copy the package to the host
+        docker build -t yara/debian .
+        docker images
+        docker run --rm --volume /tmp:/tmp yara/debian cp ./binaries/yara-v${PACKAGE_VERSION}-linux-x64.tar.gz /tmp
+        ls -lh /tmp/yara-v${PACKAGE_VERSION}-*
+
+        # copy it to the repository clone and see if there's a difference
+        cp /tmp/yara-v${PACKAGE_VERSION}-* ./binaries
+        git status  --porcelain
+
+    # By default, the commit is made in the name of "GitHub Actions"
+    # and co-authored by the user that made the last commit.
+    # https://github.com/marketplace/actions/git-auto-commit
+    - name: Commit the changes to the binary files
+      if: false  # node-gyp builds are not reproducible, hence each build would create a "new" commit -> disabling for now (comment out this line if needed)
+      uses: stefanzweifel/git-auto-commit-action@v4
+      with:
+        ref: ${{ github.head_ref }}  # https://github.com/marketplace/actions/git-auto-commit#checkout-the-correct-branch
+        commit_message: Commit the binary package changes for Linux / Node.js ${{ matrix.node-version }}
+        file_pattern: './binaries/*.tar.gz'
+
+
+  build-macos:
+    strategy:
+      fail-fast: false
+      matrix:
+        node-version:
+#        - '14'
+        - '16'
+#        - '18'
+
+    runs-on: macos-12
+
+    steps:
+    - uses: actions/checkout@v3
+
+    - name: Setup MacOs
+      run: brew install autoconf automake libmagic
+
+    - name: Use Node.js ${{ matrix.node-version }}
+      uses: actions/setup-node@master
+      with:
+        node-version: ${{ matrix.node-version }}
+
+    - name: Build binaries with node-pre-gyp
+      run: |
+        set -x
+        npm install --ignore-scripts
+        time -p npx node-pre-gyp configure rebuild
+
+        otool -L build/Release/yara.node
+
+        npx node-pre-gyp configure package
+
+        cp ./build/stage/Automattic/node-yara/raw/master/binaries/yara-*.tar.gz ./binaries
+        git status  --porcelain
+
+    - name: Run tests
+      run: npm test
+
+    # By default, the commit is made in the name of "GitHub Actions"
+    # and co-authored by the user that made the last commit.
+    # https://github.com/marketplace/actions/git-auto-commit
+    - name: Commit the changes to the binary files
+      if: false  # node-gyp builds are not reproducible, hence each build would create a "new" commit -> disabling for now (comment out this line if needed)
+      uses: stefanzweifel/git-auto-commit-action@v4
+      with:
+        ref: ${{ github.head_ref }}  # https://github.com/marketplace/actions/git-auto-commit#checkout-the-correct-branch
+        commit_message: Commit the binary package changes for MacOS / Node.js ${{ matrix.node-version }}
+        file_pattern: './binaries/*.tar.gz'

package/.github/workflows/debian-tests.yml

@@ -0,0 +1,44 @@
+# Check if the binaries we have in this repository actually work when "npm i" is run
+name: Install and test the binary
+
+on:
+  push:
+    branches: [ master ]
+  pull_request:
+
+jobs:
+  test:
+    strategy:
+      fail-fast: false
+      matrix:
+        node-version:
+#        - '14'
+        - '16.16'
+#        - '18'
+        container:
+        - 'node:16.16-buster-slim'
+        - 'node:16.16-bullseye-slim'
+        - 'debian:unstable-slim'
+
+    runs-on: 'ubuntu-22.04'  # the host system for the Action to be run, tests will be run inside the containers defined above
+
+    container:
+      image: ${{ matrix.container }}
+
+    steps:
+    - uses: actions/checkout@v3
+
+    - name: Use Node.js ${{ matrix.node-version }}
+      if: matrix.container == 'debian:unstable-slim'  # node:16.16 containers already have Node.js installed, obviously :)
+      uses: actions/setup-node@master
+      with:
+        node-version: ${{ matrix.node-version }}
+
+    - name: Print distro and Node.js version information
+      run: cat /etc/os-release && node -v && npm -v
+
+    - name: Install the package
+      run: npm install
+
+    - name: Run the tests
+      run: npm test

package/.github/workflows/npmpublish.yml

@@ -13,7 +13,7 @@ jobs:
   publish-npm:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
       - uses: actions/setup-node@v1
         with:
           node-version: 14

package/.github/workflows/tests.yml

@@ -1,7 +1,5 @@
-# This workflow will do a clean install of node dependencies, build the source code and run tests
-# For more information see: https://help.github.com/actions/language-and-framework-guides/using-nodejs-with-github-actions
-
-name: Tests
+# Check if the binaries we have in this repository actually work when "npm i" is run
+name: Install and test the binary
 
 on:
   push:
@@ -10,26 +8,29 @@ on:
 
 jobs:
   test:
-    runs-on: ubuntu-latest
-
     strategy:
       fail-fast: false
       matrix:
         node-version:
-        - '14.x'
-        - '16.x'
+#        - '14'
+        - '16'
+#        - '18'
+        os:
+        - 'ubuntu-22.04'
+        - 'macos-12'
+
+    runs-on: ${{ matrix.os }}
 
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v3
+
     - name: Use Node.js ${{ matrix.node-version }}
-      uses: actions/setup-node@v1
+      uses: actions/setup-node@master
       with:
         node-version: ${{ matrix.node-version }}
 
-    - name: Install dependencies
-      run: |
-        sudo apt-get install libyara-dev
-        npm install
+    - name: Install the package
+      run: npm install
 
-#     - name: Run tests
-#       run: npm test
+    - name: Run the tests
+      run: npm test

package/.nvmrc

@@ -0,0 +1 @@
+16.16.0

package/Dockerfile

@@ -0,0 +1,40 @@
+# this container is used to build binaries for Debian 10 (aka oldstable)
+FROM node:16.16-buster-slim
+
+RUN apt-get update -y && \
+	apt-get install -y \
+		autoconf \
+		build-essential \
+		curl \
+		libmagic-dev \
+		libssl-dev \
+		libtool \
+		pkg-config \
+		python3 \
+		time
+
+WORKDIR /opt/a8c/node-yara
+ENV HOME /opt/a8c/node-yara
+
+# leverage the build cache by copying only the dependencies definition
+COPY package.json .
+RUN npm install --ignore-scripts
+
+# now, let's copy the rest of the code
+COPY . .
+
+# we do not need root anymore
+RUN chown -R nobody:nogroup ${HOME}
+USER nobody
+
+# build and test it
+RUN time -p npx node-pre-gyp configure rebuild && \
+	npm t
+
+# see dynamic dependencies
+RUN ldd build/Release/yara.node
+
+# prepare a tar.gz package and copy it to the binaries/ directory
+RUN npx node-pre-gyp package && \
+	cp build/stage/Automattic/node-yara/raw/master/binaries/yara-*.tar.gz ./binaries && \
+	ls -lh ./binaries

package/Makefile

@@ -0,0 +1,34 @@
+
+BASE=$(shell pwd)
+OSNAME=$(shell uname)
+
+CFGOPTS += --with-crypto
+CFGOPTS += --enable-magic
+
+ifeq ($(OSNAME),Darwin)
+CFLAGS  += -I/usr/local/include/node
+CFLAGS  += -I/usr/local/include
+LDFLAGS += -L/usr/local/lib
+endif
+
+YARA?=4.2.3
+
+libyara: yara
+
+yara:
+	-rm -rf $(BASE)/build/yara
+	-rm -rf $(BASE)/deps/yara-$(YARA)
+	test -f $(BASE)/deps/yara-$(YARA).tar.gz || curl -L -k https://github.com/VirusTotal/yara/archive/v$(YARA).tar.gz > $(BASE)/deps/yara-$(YARA).tar.gz
+	cd $(BASE)/deps && tar -xzvf yara-$(YARA).tar.gz
+	cd $(BASE)/deps/yara-$(YARA) && ./bootstrap.sh
+	cd $(BASE)/deps/yara-$(YARA) && \
+			CFLAGS="$(CFLAGS)" \
+			LDFLAGS="$(LDFLAGS)" \
+			./configure \
+					$(CFGOPTS) \
+					--enable-static \
+					--disable-shared \
+					--with-pic \
+					--prefix=$(BASE)/build/yara
+	cd $(BASE)/deps/yara-$(YARA) && make
+	cd $(BASE)/deps/yara-$(YARA) && make install

package/README.md

@@ -5,18 +5,7 @@ This module implements [YARA][yara] bindings for [Node.js][nodejs].
 
 **This module is supported on Linux and MacOS (using homebrew) platforms only**
 
-This module uses the installed version of libyara.  You should download,
-compile and install your preferred version, or use one of the following
-commands using your system package manager:
-
-	# CentOS/Red Hat
-	sudo yum install yara-devel
-	
-	# Debian/Ubuntu
-	sudo apt-get install libyara-dev
-	
-	# MacOS (using homebrew)
-	sudo brew install yara
+This module is built [using libyara 4.2.3](https://github.com/Automattic/node-yara/blob/master/Makefile#L14) and is statically linked against [libmagic](https://linux.die.net/man/3/libmagic).
 
 This module is installed using [node package manager (npm)][npm]:
 
@@ -24,7 +13,34 @@ This module is installed using [node package manager (npm)][npm]:
 	# during installation using node-gyp.  A suitable build chain
 	# must be configured before installation.
 
-	npm install @automattic/yara
+	npm i --save "yara@npm:@automattic/yara@latest"
+
+# Developing
+
+Or when developing this module, run the following after cloning the repo:
+
+1. Clone the repo.
+2. Make sure the dependencies are installed.
+
+For Linux see the `Dockerfile`. For MacOS run `brew install autoconf automake libmagic`.
+
+3. Make sure that you're using the proper Node.js version by running `nvm use`.
+4. Run:
+```
+$ npm install --ignore-scripts
+
+$ ./node_modules/.bin/node-pre-gyp configure rebuild
+(...)
+  SOLINK_MODULE(target) Release/yara.node
+
+$ ./node_modules/.bin/node-pre-gyp package
+(...)
+node-pre-gyp info package Binary staged at "build/stage/Automattic/node-yara/raw/master/binaries/yara-v2.4.0-darwin-x64.tar.gz"
+node-pre-gyp info ok 
+
+$ mv build/stage/Automattic/node-yara/raw/master/binaries/yara-*.tar.gz ./binaries
+```
+5. Now you have a new `yara.tar.gz` archives in the `binaries` directory.
 
 It is loaded using the `require()` function:
 

package/binaries/README.md

@@ -0,0 +1,36 @@
+Binaries
+========
+
+These are pre-build binaries coming from the GH Action in this repository. They're used by `node-gyp` and fetched when you run `npm i` for `node-yara` package.
+
+For instance:
+
+```
+node-yara$ npm i
+
+> @automattic/yara@2.4.0 install
+> node-pre-gyp install --fallback-to-build
+
+node-pre-gyp info it worked if it ends with ok
+node-pre-gyp info using node-pre-gyp@1.0.10
+node-pre-gyp info using node@16.16.0 | linux | x64
+node-pre-gyp info check checked for "/tmp/node-yara/build/Release/yara.node" (not found)
+node-pre-gyp http GET https://github.com/Automattic/node-yara/raw/master/binaries/yara-v2.4.0-linux-x64.tar.gz
+node-pre-gyp info install unpacking Release/.deps/Release/obj.target/yara/src/yara.o.d
+node-pre-gyp info install unpacking Release/.deps/Release/obj.target/yara.node.d
+node-pre-gyp info install unpacking Release/.deps/Release/yara.node.d
+node-pre-gyp info install unpacking Release/.deps/build/yara.d
+node-pre-gyp info install unpacking Release/obj.target/yara/src/yara.o
+node-pre-gyp info install unpacking Release/obj.target/yara.node
+node-pre-gyp info extracted file count: 6 
+[@automattic/yara] Success: "/tmp/node-yara/build/Release/yara.node" is installed via remote
+node-pre-gyp info ok 
+node-pre-gyp info install unpacking Release/yara.node
+
+up to date, audited 119 packages in 4s
+
+22 packages are looking for funding
+  run `npm fund` for details
+
+found 0 vulnerabilities
+```

package/binding.gyp

@@ -1,5 +1,24 @@
 {
   "targets": [
+    {
+      "target_name": "action_before_build",
+      "type": "none",
+      "copies": [],
+      "conditions": [
+        ['OS == "linux"', {
+          "copies": [{
+            "files": [ "/usr/lib/x86_64-linux-gnu/libmagic.a" ],
+            "destination": "build/"
+          }],
+        }],
+        ['OS == "mac"', {
+          "copies": [{
+            "files": [ "/usr/local/opt/libmagic/lib/libmagic.a" ],
+            "destination": "build/"
+          }],
+        }],
+      ],
+    },
     {
       "target_name": "yara",
       "sources": [
@@ -10,10 +29,12 @@
         "-fno-rtti"
       ],
       "include_dirs": [
-        "<!(node -e 'require(\"nan\")')"
+        "<!(node -e 'require(\"nan\")')",
+        "./build/yara/include"
       ],
       "libraries": [
-        "-lyara"
+        "../build/libmagic.a",
+        "../build/yara/lib/libyara.a"
       ],
       "conditions": [
         [
@@ -24,6 +45,21 @@
             }
           }
         ]
+      ],
+      "actions": [
+        {
+          "action_name": "build_libyara",
+          "inputs": [
+            "deps"
+          ],
+          "outputs": [
+            "build/yara"
+          ],
+          "action": [
+            "make",
+            "libyara"
+          ]
+        }
       ]
     }
   ]

package/package.json

@@ -1,14 +1,26 @@
 {
   "name": "@automattic/yara",
-  "version": "2.3.0",
+  "version": "2.5.0",
   "description": "Automattic's fork of YARA support for Node.js",
   "main": "index.js",
   "directories": {
     "example": "example"
   },
   "dependencies": {
-    "nan": "2.14.*",
-    "typescript": "^3.8.3"
+    "@mapbox/node-pre-gyp": "^1.0.10",
+    "nan": "2.17.*",
+    "typescript": "^4.9.5"
+  },
+  "scripts": {
+    "test": "mocha test/*",
+    "install": "node-pre-gyp install --fallback-to-build"
+  },
+  "binary": {
+    "module_name": "yara",
+    "module_path": "./build/Release",
+    "host": "https://github.com/",
+    "remote_path": "/Automattic/node-yara/raw/master/binaries/",
+    "package_name": "{module_name}-v{version}-{platform}-{arch}.tar.gz"
   },
   "contributors": [
     {
@@ -31,5 +43,8 @@
     "yara"
   ],
   "author": "NoSpaceships Ltd <hello@nospaceships.com>",
-  "license": "MIT"
+  "license": "MIT",
+  "devDependencies": {
+    "mocha": "^10.0.0"
+  }
 }

package/src/yara.cc

@@ -7,6 +7,7 @@
 #include <string>
 #include <sstream>
 #include <mutex>
+#include <iostream>
 
 #include <errno.h>
 #include <stdio.h>
@@ -42,9 +43,9 @@ enum VarType {
 #define ERROR_UNKNOWN_STRING "ERROR_UNKNOWN"
 
 void compileCallback(int error_level, const char* file_name, int line_number,
-		const char* message, void* user_data);
+		const YR_RULE* rule, const char* message, void* user_data);
 
-int scanCallback(int message, void* data, void* param);
+int scanCallback(YR_SCAN_CONTEXT* scan_context, int message, void* data, void* param);
 
 const char* getErrorString(int code) {
 	size_t count = error_codes.count(code);
@@ -515,11 +516,15 @@ private:
 };
 
 void compileCallback(int error_level, const char* file_name, int line_number,
-		const char* message, void* user_data) {
+		const YR_RULE* rule, const char* message, void* user_data) {
 	CompileArgs* args = (CompileArgs*) user_data;
 
 	std::ostringstream oss;
-	oss << args->rule_config->index << ":" << line_number << ":" << message << ":" << file_name;
+	oss << args->rule_config->index << ":" << line_number << ":" << message << ":";
+
+	if (file_name != NULL) {
+		oss << file_name;
+	}
 
 	if (error_level == YARA_ERROR_LEVEL_WARNING)
 		args->configure->warnings.push_back(oss.str());
@@ -860,7 +865,7 @@ private:
 	ScanReq* scan_req_;
 };
 
-int scanCallback(int message, void* data, void* param) {
+int scanCallback(YR_SCAN_CONTEXT* scan_context, int message, void* data, void* param) {
 	AsyncScan* async_scan = (AsyncScan*) param;
 
 	YR_RULE* rule;
@@ -896,7 +901,7 @@ int scanCallback(int message, void* data, void* param) {
 			}
 
 			yr_rule_strings_foreach(rule, string) {
-				yr_string_matches_foreach(string, match) {
+				yr_string_matches_foreach(scan_context, string, match) {
 					std::ostringstream oss;
 					oss << match->offset << ":" << match->match_length << ":" << string->identifier;
 
@@ -944,6 +949,8 @@ int scanCallback(int message, void* data, void* param) {
 NAN_METHOD(ScannerWrap::ReconfigureVariables) {
 	Nan::HandleScope scope;
 
+
+
 	ScannerWrap* scanner = ScannerWrap::Unwrap<ScannerWrap>(info.This());
 
 	std::lock_guard<std::mutex> lock(scanner->mutex);
@@ -1152,7 +1159,7 @@ NAN_METHOD(ScannerWrap::Scan) {
 
 	Local<Object> req = Nan::To<Object>(info[0]).ToLocalChecked();
 
-	char* filename = NULL;
+	std::string filename;
 	char *buffer = NULL;
 	int64_t offset = 0;
 	int64_t length = 0;
@@ -1160,8 +1167,10 @@ NAN_METHOD(ScannerWrap::Scan) {
 	int32_t timeout = 0;
 	int32_t matched_bytes = 0;
 
+
 	if (Nan::Get(req, Nan::New("filename").ToLocalChecked()).ToLocalChecked()->IsString()) {
 		Local<String> s = Nan::To<String>(Nan::Get(req, Nan::New("filename").ToLocalChecked()).ToLocalChecked()).ToLocalChecked();
+
 		filename = *Nan::Utf8String(s);
 	} else if (Nan::Get(req, Nan::New("buffer").ToLocalChecked()).ToLocalChecked()->IsObject()) {
 		Local<Object> o = Nan::To<Object>(Nan::Get(req, Nan::New("buffer").ToLocalChecked()).ToLocalChecked()).ToLocalChecked();
@@ -1226,7 +1235,7 @@ NAN_METHOD(ScannerWrap::Scan) {
 		}
 	}
 
-	if ((! filename) && (! buffer)) {
+	if ((filename.empty()) && (! buffer)) {
 		Nan::ThrowError("Either filename of buffer is required");
 		return;
 	}
@@ -1246,8 +1255,9 @@ NAN_METHOD(ScannerWrap::Scan) {
 
 	ScanReq* scan_req = new ScanReq();
 
-	if (filename)
-		scan_req->filename = filename;
+	if (!filename.empty()) {
+		scan_req->filename = filename.c_str();
+	}		
 
 	scan_req->buffer = buffer;
 	scan_req->offset = offset;
@@ -1268,6 +1278,7 @@ NAN_METHOD(ScannerWrap::Scan) {
 	Nan::AsyncQueueWorker(async_scan);
 
 	info.GetReturnValue().Set(info.This());
+
 }
 
 }; /* namespace yara */

package/test/unit_index.js_scanner.configure.js

@@ -54,7 +54,7 @@ describe("index.js", function() {
 					var expErrors = [{
 						index: 0,
 						line: 1,
-						message: "syntax error, unexpected '}', expecting <condition>"
+						message: "syntax error"
 					}]
 
 					assert.deepEqual(error.errors, expErrors)
@@ -78,7 +78,7 @@ describe("index.js", function() {
 					var expErrors = [{
 						index: 0,
 						line: 1,
-						message: "syntax error, unexpected '}', expecting <condition>"
+						message: "syntax error"
 					}]
 
 					assert.deepEqual(error.errors, expErrors)
@@ -114,7 +114,7 @@ describe("index.js", function() {
 						{
 							index: 0,
 							line: 4,
-							message: 'Using literal string "stephen" in a boolean operation.'
+							message: 'using literal string "stephen" in a boolean operation.'
 						}
 					]
 
@@ -160,7 +160,7 @@ describe("index.js", function() {
 					var expErrors = [{
 						index: 0,
 						line: 4,
-						message: "syntax error, unexpected hex string, expecting identifier"
+						message: "syntax error"
 					}]
 
 					assert.deepEqual(error.errors, expErrors)