pySigma 2.0.0__tar.gz → 2.0.1__tar.gz

{pysigma-2.0.0 → pysigma-2.0.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pySigma
-Version: 2.0.0
+Version: 2.0.1
 Summary: Sigma rule processing and conversion tools
 License-Expression: LGPL-2.1-only
 License-File: LICENSE

{pysigma-2.0.0 → pysigma-2.0.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "pySigma"
-version = "2.0.0"
+version = "2.0.1"
 license = "LGPL-2.1-only"
 description = "Sigma rule processing and conversion tools"
 authors = [

{pysigma-2.0.0 → pysigma-2.0.1}/sigma/collection.py

@@ -205,6 +205,7 @@ class SigmaCollection:
                             rule,
                             collect_errors,
                             source,
+                            policy=policy,
                         )
                         parsed_rules.append(parsed_filter_rule)
                         errors.extend(parsed_filter_rule.errors)  # Propagate errors from rule

{pysigma-2.0.0 → pysigma-2.0.1}/sigma/conditions.py

@@ -248,10 +248,10 @@ class ConditionSelector(ConditionItem):
         """
         Resolve all detection identifiers referenced by the selector.
         """
-        import sigma
+        from sigma.policy import default_policy
 
         policy = detections.policy
-        engine = (policy or sigma.default_policy).regex_engine
+        engine = (policy or default_policy).regex_engine
         if self.pattern == "them":
             r = engine.compile(".*")
         else:

{pysigma-2.0.0 → pysigma-2.0.1}/sigma/conversion/base.py

@@ -767,8 +767,10 @@ class Backend(ABC):
         ]
         rule.set_conversion_result(finalized_queries)
         rule.set_conversion_states(states)
-
-        return finalized_queries
+        if rule._output:
+            return finalized_queries
+        else:
+            return []
 
     @abstractmethod
     def convert_correlation_event_count_rule(

{pysigma-2.0.0 → pysigma-2.0.1}/sigma/filters.py

@@ -71,7 +71,7 @@ class SigmaGlobalFilter(SigmaDetections):
 
         return cls(
             detections={
-                name: SigmaDetection.from_definition(definition, source)
+                name: SigmaDetection.from_definition(definition, source, policy)
                 for name, definition in detections.items()
                 if name
                 not in (
@@ -82,6 +82,7 @@ class SigmaGlobalFilter(SigmaDetections):
             rules=rules,
             condition=condition,
             source=source,
+            policy=policy,
         )
 
     def to_dict(self: Self) -> dict[str, Any]:
@@ -163,7 +164,9 @@ class SigmaFilter(SigmaRuleBase):
 
         # parse detections
         try:
-            filter_global_filter = SigmaGlobalFilter.from_dict(sigma_filter["filter"], source)
+            filter_global_filter = SigmaGlobalFilter.from_dict(
+                sigma_filter["filter"], source, policy=policy
+            )
         except KeyError:
             filter_global_filter = EmptySigmaGlobalFilter()
             errors.append(

{pysigma-2.0.0 → pysigma-2.0.1}/sigma/modifiers.py

@@ -40,7 +40,7 @@ from sigma.types import (
     TimestampPart,
     SigmaStringPartType,
 )
-from sigma.exceptions import SigmaRuleLocation, SigmaTypeError, SigmaValueError
+from sigma.exceptions import SigmaModifiedError, SigmaRuleLocation, SigmaTypeError, SigmaValueError
 
 if TYPE_CHECKING:
     from .rule import SigmaDetectionItem
@@ -418,6 +418,7 @@ class SigmaWindowsDashModifier(SigmaValueModifier[SigmaString, SigmaExpansion]):
     en_dash = chr(int("2013", 16))
     em_dash = chr(int("2014", 16))
     horizontal_bar = chr(int("2015", 16))
+    max_expanded_dashes = 3
 
     def modify(self, val: SigmaString) -> SigmaExpansion:
         def callback(p: Placeholder) -> Iterator[str | Placeholder]:
@@ -426,12 +427,24 @@ class SigmaWindowsDashModifier(SigmaValueModifier[SigmaString, SigmaExpansion]):
             else:
                 yield p
 
+        with_placeholders = val.replace_with_placeholder(re.compile("\\B[-/]\\b"), "_windash")
+        expanded_dashes = sum(
+            1
+            for part in with_placeholders.s
+            if isinstance(part, Placeholder) and part.name == "_windash"
+        )
+        if expanded_dashes > self.max_expanded_dashes:
+            raise SigmaModifiedError(
+                "windash modifier expands at most three dash occurrences in one value; "
+                "split multiple dash expansions into separate ORed string match conditions "
+                "with one dash expanded",
+                source=self.source,
+            )
+
         return SigmaExpansion(
             cast(
                 list[SigmaType],
-                val.replace_with_placeholder(
-                    re.compile("\\B[-/]\\b"), "_windash"
-                ).replace_placeholders(callback),
+                with_placeholders.replace_placeholders(callback),
             )
         )
 
@@ -445,7 +458,7 @@ class SigmaRegularExpressionModifier(SigmaValueModifier[SigmaString, SigmaRegula
                 "Regular expression modifier only applicable to unmodified values",
                 source=self.source,
             )
-        return SigmaRegularExpression(val.original)
+        return SigmaRegularExpression(val.original, policy=self.detection_item.policy)
 
 
 class SigmaRegularExpressionFlagModifier(

{pysigma-2.0.0 → pysigma-2.0.1}/sigma/policy/__init__.py

@@ -18,3 +18,8 @@ class SigmaPolicy:
     allow_template_vars: bool = False
     vars_allowed_paths: tuple[str, ...] | None = None
     allow_external_sources: bool = False
+
+
+from sigma.policy.profiles import SafePolicy  # noqa: E402
+
+default_policy: SigmaPolicy = SafePolicy

{pysigma-2.0.0 → pysigma-2.0.1}/sigma/processing/finalization.py

@@ -132,7 +132,7 @@ class NestedFinalizer(Finalizer):
             finalizer_cls = finalizers[finalizer_type]
             import sigma as _sigma
 
-            effective_policy = policy or _sigma.default_policy
+            effective_policy = policy or _sigma.policy.default_policy
             if issubclass(finalizer_cls, TemplateBase):
                 finalizer["policy"] = policy
                 finalizer["restrict_template_path"] = not effective_policy.allow_external_sources

{pysigma-2.0.0 → pysigma-2.0.1}/sigma/processing/pipeline.py

@@ -27,6 +27,7 @@ from sigma.processing.tracking import FieldMappingTracking
 from sigma.processing.transformations import transformations
 from sigma.processing.transformations.external import ExternalSourceBaseTransformation
 from sigma.rule import SigmaDetectionItem, SigmaRule
+from sigma.rule.base import check_alias_expansion
 from sigma.correlations import SigmaCorrelationRule
 from sigma.processing.transformations.base import PreprocessingTransformation, Transformation
 from sigma.processing.postprocessing import (
@@ -353,7 +354,7 @@ class ProcessingItemBase:
         }
         import sigma as _sigma
 
-        effective_policy = policy or _sigma.default_policy
+        effective_policy = policy or _sigma.policy.default_policy
         if issubclass(transformation_class, TemplateBase):
             params["policy"] = policy
             params["restrict_template_path"] = not effective_policy.allow_external_sources
@@ -810,9 +811,9 @@ class ProcessingPipeline:
         Prefer the policy attached to this pipeline and fall back to the
         global default policy only if no pipeline policy is set.
         """
-        import sigma
+        from sigma.policy import default_policy
 
-        return self.policy or sigma.default_policy
+        return self.policy or default_policy
 
     def resolve_regex_engine(self) -> "RegexEngine":
         """Return the effective regex engine for this pipeline."""
@@ -826,6 +827,10 @@ class ProcessingPipeline:
     ) -> "ProcessingPipeline":
         """Instantiate processing pipeline from a parsed processing item description."""
 
+        # Validate aliases once at the pipeline root so nested from_dict calls don't
+        # repeatedly traverse already checked substructures.
+        check_alias_expansion(d, SigmaConfigurationError)
+
         custom_keys = [
             k
             for k in d.keys()
@@ -845,7 +850,7 @@ class ProcessingPipeline:
 
         import sigma as _sigma
 
-        effective_policy = policy or _sigma.default_policy
+        effective_policy = policy or _sigma.policy.default_policy
 
         vars = d.get("vars", dict())  # default: no variables
 
@@ -938,7 +943,7 @@ class ProcessingPipeline:
         import dataclasses
         import sigma as _sigma
 
-        effective_policy = policy or _sigma.default_policy
+        effective_policy = policy or _sigma.policy.default_policy
         if effective_policy.vars_allowed_paths is None and source_path is not None:
             policy = dataclasses.replace(
                 effective_policy,

{pysigma-2.0.0 → pysigma-2.0.1}/sigma/processing/regex.py

@@ -24,14 +24,14 @@ class ProcessingRegularExpressionMixin:
 
     def resolve_regex_engine(self) -> RegexEngine:
         """Return the effective regex engine for this processing context."""
-        import sigma
+        from sigma.policy import default_policy
 
         _pipeline = getattr(self, "_pipeline", None)
         if _pipeline is None:
             _policy = getattr(self, "policy", None)
             if _policy is not None:
                 return _policy.regex_engine  # type: ignore[no-any-return]
-            return sigma.default_policy.regex_engine
+            return default_policy.regex_engine
         return _pipeline.resolve_regex_engine()  # type: ignore[no-any-return]
 
     def compile_regex(self, pattern: str) -> RegexPattern:

{pysigma-2.0.0 → pysigma-2.0.1}/sigma/processing/transformations/external.py

@@ -27,6 +27,7 @@ import yaml
 from sigma.exceptions import SigmaConfigurationError, SigmaSecurityError, SigmaValueError
 from sigma.policy.regex_engine import RegexPattern
 from sigma.processing.transformations.placeholder import BasePlaceholderTransformation
+from sigma.rule.base import check_alias_expansion
 from sigma.types import Placeholder, SigmaString
 from typing import TYPE_CHECKING
 
@@ -207,6 +208,7 @@ class ExternalSourceBaseTransformation(BasePlaceholderTransformation):
             parsed = yaml.safe_load(data)
         except yaml.YAMLError as e:
             raise SigmaValueError(f"Failed to parse YAML data: {e}") from e
+        check_alias_expansion(parsed, SigmaValueError)
         try:
             result = jq.all(self.jq_expression, parsed)
         except ValueError as e:

{pysigma-2.0.0 → pysigma-2.0.1}/sigma/rule/detection.py

@@ -76,6 +76,7 @@ class SigmaDetectionItem(ProcessingItemTrackingMixin, ParentChainMixin):
         init=False, repr=False, hash=False, compare=False
     )  # Copy of original values for conversion back to data structures (and YAML/JSON)
     auto_modifiers: bool = dataclasses.field(default=True, compare=False, repr=False)
+    policy: "SigmaPolicy | None" = dataclasses.field(default=None, compare=False, repr=False)
 
     def __post_init__(self: Self) -> None:
         if not isinstance(self.value, list) or not all(
@@ -116,6 +117,7 @@ class SigmaDetectionItem(ProcessingItemTrackingMixin, ParentChainMixin):
         key: str | None,
         val: list[float | str | bool | None] | float | str | bool | None,
         source: SigmaRuleLocation | None = None,
+        policy: "SigmaPolicy | None" = None,
     ) -> Self:
         """
         Constructs SigmaDetectionItem object from a mapping between field name containing
@@ -155,16 +157,17 @@ class SigmaDetectionItem(ProcessingItemTrackingMixin, ParentChainMixin):
             for v in val_list
         ]
 
-        return cls(field, modifiers, sigma_val, source=source)
+        return cls(field, modifiers, sigma_val, source=source, policy=policy)
 
     @classmethod
     def from_value(
         cls: type[Self],
         val: list[float | str | bool | None] | float | str | bool | None,
         source: SigmaRuleLocation | None = None,
+        policy: "SigmaPolicy | None" = None,
     ) -> Self:
         """Convenience method for from_mapping(None, value)."""
-        return cls.from_mapping(None, val, source=source)
+        return cls.from_mapping(None, val, source=source, policy=policy)
 
     def disable_conversion_to_plain(self: Self) -> None:
         """
@@ -315,19 +318,20 @@ class SigmaDetection(ParentChainMixin):
             Mapping[str, Any] | list[int | float | str | bool | None] | float | str | bool | None
         ),
         source: SigmaRuleLocation | None = None,
+        policy: "SigmaPolicy | None" = None,
     ) -> Self:
         """Instantiate an appropriate SigmaDetection object from a parsed Sigma detection definition."""
         if isinstance(definition, Mapping):  # key-value-definition (case 1)
             return cls(
                 detection_items=[
-                    SigmaDetectionItem.from_mapping(key, val, source)
+                    SigmaDetectionItem.from_mapping(key, val, source, policy)
                     for key, val in definition.items()
                 ],
                 source=source,
             )
         elif isinstance(definition, (str, int, float, bool, type(None))):  # plain value (case 2)
             return cls(
-                detection_items=[SigmaDetectionItem.from_value(definition, source)],
+                detection_items=[SigmaDetectionItem.from_value(definition, source, policy)],
                 source=source,
             )
         elif isinstance(definition, list):  # list of items (case 3)
@@ -335,14 +339,14 @@ class SigmaDetection(ParentChainMixin):
                 {str, int, float, bool, type(None)}
             ):  # list of values: create one detection item containing all values
                 return cls(
-                    detection_items=[SigmaDetectionItem.from_value(definition, source)],
+                    detection_items=[SigmaDetectionItem.from_value(definition, source, policy)],
                     source=source,
                 )
             else:
                 return cls(
                     detection_items=[
                         SigmaDetection.from_definition(
-                            item, source
+                            item, source, policy
                         )  # nested SigmaDetection in other cases
                         for item in definition
                     ],
@@ -548,7 +552,7 @@ class SigmaDetections:
         check_alias_expansion(detections, sigma_exceptions.SigmaDetectionError, source)
         return cls(
             detections={
-                name: SigmaDetection.from_definition(definition, source)
+                name: SigmaDetection.from_definition(definition, source, policy)
                 for name, definition in detections.items()
                 if name not in ("condition",)
             },

{pysigma-2.0.0 → pysigma-2.0.1}/sigma/types.py

@@ -128,6 +128,7 @@ class SigmaString(SigmaType):
     s: list[
         SigmaStringPartType
     ]  # the string is represented as sequence of strings and characters with special meaning
+    max_placeholder_expansions: ClassVar[int] = 200
 
     def __init__(self, s: str | None = None, escape: bool = True):
         """
@@ -544,6 +545,8 @@ class SigmaString(SigmaType):
 
         The callback can return a plain string, a SpecialChars instance (for insertion of wildcards) or a Placeholder (e.g. to keep
         the placeholder for later processing pipeline items).
+
+        The total number of expanded strings is limited to max_placeholder_expansions.
         """
         if (
             not self.contains_placeholder()
@@ -558,15 +561,20 @@ class SigmaString(SigmaType):
                 placeholder = s[i]
                 suffix = SigmaString()
                 suffix.s = s[i + 1 :]
-                return [
-                    prefix + replacement + result_suffix
-                    for replacement in callback(
-                        cast(Placeholder, placeholder)
-                    )  # iterate over all callback result values
+                results: list[SigmaString] = []
+                for replacement in callback(
+                    cast(Placeholder, placeholder)
+                ):  # iterate over all callback result values
                     for result_suffix in suffix.replace_placeholders(
                         callback
-                    )  # iterate over all result values of calling this method with the SigmaString remainder
-                ]
+                    ):  # iterate over all result values of calling this method with the SigmaString remainder
+                        results.append(prefix + replacement + result_suffix)
+                        if len(results) > self.max_placeholder_expansions:
+                            raise SigmaValueError(
+                                "Placeholder expansion exceeds maximum of "
+                                f"{self.max_placeholder_expansions} items"
+                            )
+                return results
         return [self]
 
     def __iter__(self) -> Iterable[SigmaStringPartType]:
@@ -828,9 +836,9 @@ class SigmaRegularExpression(SigmaType):
 
     def compile(self) -> None:
         """Verify if regular expression is valid by compiling it"""
-        import sigma
+        from sigma.policy import default_policy
 
-        engine = (self.policy or sigma.default_policy).regex_engine
+        engine = (self.policy or default_policy).regex_engine
         try:
             flags = 0
             for flag in self.flags:

{pysigma-2.0.0 → pysigma-2.0.1}/sigma/validation.py

@@ -3,6 +3,7 @@ from typing import Any, DefaultDict, Iterable, Iterator, Type
 from uuid import UUID
 from sigma.exceptions import SigmaConfigurationError, SigmaValidatorConfigurationParsingError
 from sigma.rule import SigmaRule
+from sigma.rule.base import check_alias_expansion
 from sigma.validators.base import SigmaRuleValidator, SigmaValidationIssue
 import yaml
 
@@ -56,6 +57,8 @@ class SigmaValidator:
         :return: Instantiated SigmaValidator
         :rtype: SigmaValidator
         """
+        check_alias_expansion(d, SigmaConfigurationError)
+
         # Build validator class set
         vs = set()
         for v in d.get("validators", []):

pysigma-2.0.0/sigma/__init__.py

@@ -1,6 +0,0 @@
-from __future__ import annotations
-
-from sigma.policy import SigmaPolicy
-from sigma.policy.profiles import SafePolicy
-
-default_policy: SigmaPolicy = SafePolicy