[pull] main from VirusTotal:main

lib/src/compiler/ir/ast2ir.rs

@@ -73,6 +73,22 @@ pub(in crate::compiler) fn patterns_from_ast<'src>(
                     .span_to_code_loc(existing.identifier.span()),
             ));
         }
+        if let Some(existing) = ctx
+            .current_rule_patterns
+            .iter()
+            .find(|p| p.pattern() == pattern.pattern())
+        {
+            ctx.warnings.add(|| {
+                warnings::DuplicatePatternValue::build(
+                    ctx.report_builder,
+                    existing.identifier().name.to_string(),
+                    ctx.report_builder
+                        .span_to_code_loc(pattern.span().clone()),
+                    ctx.report_builder
+                        .span_to_code_loc(existing.span().clone()),
+                )
+            });
+        }
         if ctx.current_rule_patterns.len() == MAX_PATTERNS_PER_RULE {
             return Err(TooManyPatterns::build(
                 ctx.report_builder,

lib/src/compiler/tests/testdata/warnings/47.in

@@ -0,0 +1,7 @@
+rule duplicate_pattern_value_test {
+  strings:
+    $a = "duplicate_literal"
+    $b = "duplicate_literal"
+  condition:
+    $a and $b
+}

lib/src/compiler/tests/testdata/warnings/47.out

@@ -0,0 +1,7 @@
+warning[duplicate_pattern_value]: duplicate pattern value
+ --> line:3:5
+  |
+3 |     $a = "duplicate_literal"
+  |     ------------------------ pattern `$a` defined here first
+4 |     $b = "duplicate_literal"
+  |     ------------------------ duplicate of pattern `$a`

lib/src/compiler/tests/testdata/warnings/no_warnings.in

@@ -62,7 +62,7 @@ rule test_9 {
   strings:
     // suppress: text_as_hex
     $a = { 61 62 63 64 }
-    $b = { 61 62 63 64 } // suppress: text_as_hex
+    $b = { 61 62 63 64 } // suppress: text_as_hex,duplicate_pattern_value
   condition:
     $a and $b or true // suppress: invariant_expr
 }
@@ -72,7 +72,7 @@ rule test_9 {
 rule test_10 {
   strings:
     $a = { 61 62 63 64 }
-    $b = { 61 62 63 64 }
+    $b = { 61 62 63 64 } // suppress: duplicate_pattern_value
   condition:
     $a and $b or true
 }

lib/src/compiler/warnings.rs

@@ -23,6 +23,7 @@ pub enum Warning {
     ConsecutiveJumps(Box<ConsecutiveJumps>),
     DeprecatedField(Box<DeprecatedField>),
     DuplicateImport(Box<DuplicateImport>),
+    DuplicatePatternValue(Box<DuplicatePatternValue>),
     GlobalRuleMisuse(Box<GlobalRuleMisuse>),
     IgnoredModule(Box<IgnoredModule>),
     IgnoredRule(Box<IgnoredRule>),
@@ -814,4 +815,44 @@ pub struct GlobalRuleMisuse {
     report: Report,
     loc: CodeLoc,
     note: Option<String>,
+}
+
+/// Multiple patterns in the same rule have identical values.
+///
+/// This warning indicates that two or more patterns in the same rule have
+/// identical literal or regular expression values, which can lead to redundant
+/// scanning work.
+///
+/// ## Example
+///
+/// ```text
+/// warning[duplicate_pattern_value]: duplicate pattern value
+///  --> test.yar:4:9
+///   |
+/// 3 |         $a = "exact_duplicate_string"
+///   |              ------------------------ pattern `$a` defined here first
+/// 4 |         $b = "exact_duplicate_string"
+///   |              ------------------------ duplicate of pattern `$a`
+///   |
+/// ```
+#[derive(ErrorStruct, Debug, PartialEq, Eq)]
+#[associated_enum(Warning)]
+#[warning(
+    code = "duplicate_pattern_value",
+    title = "duplicate pattern value"
+)]
+#[label(
+    "duplicate of pattern `{existing_ident}`",
+    duplicate_loc
+)]
+#[label(
+    "pattern `{existing_ident}` defined here first",
+    existing_loc,
+    Level::NOTE
+)]
+pub struct DuplicatePatternValue {
+    report: Report,
+    existing_ident: String,
+    duplicate_loc: CodeLoc,
+    existing_loc: CodeLoc,
 }

lib/src/compiler/wsh.rs

@@ -88,7 +88,7 @@ where
             f: None,
             line_span: None,
             cst_stream: cst_events.into(),
-            suppress_re: Regex::new(r"suppress: (\w+)").unwrap(),
+            suppress_re: Regex::new(r"suppress: ([\w\s,]+)").unwrap(),
             pending_comments: vec![],
         }
     }
@@ -116,14 +116,14 @@ where
                     }
                     if let Some(code_span) = &comment.code_span
                         && let Some(hook) = &mut self.f
-                        && let Some(warning_id) = self
-                            .suppress_re
-                            .captures(comment.text)
-                            .and_then(|captures| captures.get(1))
-                            .map(|m| m.as_bytes())
-                            .and_then(|m| from_utf8(m).ok())
+                        && let Some(captures) =
+                            self.suppress_re.captures(comment.text)
+                        && let Some(m) = captures.get(1)
+                        && let Ok(s) = from_utf8(m.as_bytes())
                     {
-                        hook(warning_id, code_span.clone());
+                        for warning_id in s.split(',') {
+                            hook(warning_id.trim(), code_span.clone());
+                        }
                     }
                     comment.code_span.is_none()
                 });
@@ -207,4 +207,37 @@ rule test_2 { strings: /* suppress: bar */ $a = { 00 01 } condition: true }
 
         assert_eq!(map, expected);
     }
+
+    #[test]
+    fn multi_warning_suppression() {
+        let parser = Parser::new(
+            b"
+// suppress: foo, bar
+rule test_1 {
+    // suppress: baz, qux
+    condition: true
+}
+        ",
+        );
+
+        let mut map: HashMap<&str, Vec<Span>> = HashMap::new();
+
+        let cst =
+            WarningSuppressionHook::from(parser).hook(|warning, span| {
+                map.entry(warning).or_default().push(span);
+            });
+
+        let _ = cst.collect::<Vec<Event>>();
+
+        let expected: HashMap<_, _> = vec![
+            ("foo", vec![Span(23..84)]),
+            ("bar", vec![Span(23..84)]),
+            ("baz", vec![Span(67..82)]),
+            ("qux", vec![Span(67..82)]),
+        ]
+        .into_iter()
+        .collect();
+
+        assert_eq!(map, expected);
+    }
 }

playground/package.json

@@ -25,6 +25,6 @@
     "prettier": "^3.8.1",
     "rollup-plugin-visualizer": "^7.0.1",
     "typescript": "~5.9.3",
-    "vite": "^7.3.2"
+    "vite": "^7.3.5"
   }
 }