Skip to content

Only display unprintable pattern matches for matches of non-zero length#1175

Merged
egibs merged 2 commits into
chainguard-dev:mainfrom
egibs:accurate-string-reporting
Oct 24, 2025
Merged

Only display unprintable pattern matches for matches of non-zero length#1175
egibs merged 2 commits into
chainguard-dev:mainfrom
egibs:accurate-string-reporting

Conversation

@egibs

@egibs egibs commented Oct 24, 2025

Copy link
Copy Markdown
Member

We currently have an edge case when displaying matches for rules that contain strings which can produce unprintable characters (e.g., rules that are entirely hex strings).

Previously, the file report would show all of the rule's matched string patterns which made it hard to narrow down the actual culprit (falling back to yr scan is usually what I do).

This PR corrects the behavior by only showing pattern matches if the match is of non-zero length.

Before:

$ out/mal --format=strings scan .../usr/bin/kube-proxy
🔎 Scanning ".../usr/bin/kube-proxy"
Matches for .../usr/bin/kube-proxy [CRIT] (2 rules):
ESET_Kobalos [CRIT] (4 strings):
- $encrypted_strings_sizes
- $password_md5_digest
- $rsa_512_mod_header
- $strings_rc4_key
SIGNATURE_BASE_APT_MAL_LNX_Kobalos [CRIT] (4 strings):
- $encrypted_strings_sizes
- $password_md5_digest
- $rsa_512_mod_header
- $strings_rc4_key

💡 For detailed analysis, try "mal analyze <path>"

After:

$ out/mal --format=strings scan ...usr/bin/kube-proxy
🔎 Scanning "...usr/bin/kube-proxy"
Matches for ...usr/bin/kube-proxy [CRIT] (2 rules):
ESET_Kobalos [CRIT] (1 string):
- $rsa_512_mod_header
SIGNATURE_BASE_APT_MAL_LNX_Kobalos [CRIT] (1 string):
- $rsa_512_mod_header

💡 For detailed analysis, try "mal analyze <path>

Signed-off-by: egibs <20933572+egibs@users.noreply.github.com>
@egibs egibs requested a review from stevebeattie October 24, 2025 20:33
@egibs egibs enabled auto-merge (squash) October 24, 2025 20:48
Signed-off-by: egibs <20933572+egibs@users.noreply.github.com>

@stevebeattie stevebeattie left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Woo, nice fix,thanks!

@egibs egibs merged commit c0c044c into chainguard-dev:main Oct 24, 2025
13 checks passed
@egibs egibs deleted the accurate-string-reporting branch October 31, 2025 17:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants