Merge pull request #302 from frack113/null-regex

Deal with empty string for ignore_case_brackets
SigmaHQ · Nov 10, 2024 · ebbe618 · ebbe618
2 parents ad6f3c3 + 21feb6b
commit ebbe618
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 0 deletions.
diff --git a/sigma/processing/transformations.py b/sigma/processing/transformations.py
@@ -997,6 +997,11 @@ def __post_init__(self):
 
     def apply_string_value(self, field: str, val: SigmaString) -> Optional[SigmaString]:
         regex = ""
+
+        # empty string can not be convert into a simple regex
+        if val == "":
+            return SigmaRegularExpression("")
+
         for sc in val.s:  # iterate over all SigmaString components (strings and special chars)
             if isinstance(sc, str):  # if component is a string
                 if (

diff --git a/tests/test_processing_transformations.py b/tests/test_processing_transformations.py
@@ -1544,6 +1544,13 @@ def test_regex_transformation_plain_method(dummy_pipeline):
     assert detection_item.value[0] == SigmaRegularExpression("\\\\te\\.st.*va.ue")
 
 
+def test_regex_transformation_empty_string(dummy_pipeline):
+    detection_item = SigmaDetectionItem("field", [], [SigmaString("")])
+    transformation = RegexTransformation(method="plain")
+    transformation.apply_detection_item(detection_item)
+    assert detection_item.value[0] == SigmaRegularExpression("")
+
+
 def test_regex_transformation_case_insensitive_bracket_method(dummy_pipeline):
     detection_item = SigmaDetectionItem("field", [], [SigmaString("\\tE.sT*val?ue")])
     transformation = RegexTransformation(method="ignore_case_brackets")