Skip to content

fix(processing): compile filter regex at init and raise SigmaConfigurationError on invalid pattern#511

Open
Romil2112 wants to merge 1 commit into
SigmaHQ:mainfrom
Romil2112:fix/filter-regex-init-validation
Open

fix(processing): compile filter regex at init and raise SigmaConfigurationError on invalid pattern#511
Romil2112 wants to merge 1 commit into
SigmaHQ:mainfrom
Romil2112:fix/filter-regex-init-validation

Conversation

@Romil2112

Copy link
Copy Markdown

Closes #509.

Summary

The filter field on ExternalSourceBaseTransformation was recompiled on every _parse_plaintext and _parse_csv call. A malformed pattern raised a bare re.error at parse time rather than SigmaConfigurationError at pipeline-load time — inconsistent with every other regex field in pySigma and breaking callers that catch SigmaError.

This PR adds a _filter_pattern private field, compiles the regex once in __post_init__ (raising SigmaConfigurationError on bad input), and reuses it in both parse methods. The change mirrors the existing reg_filter_output design exactly.

Changes

  • sigma/processing/transformations/external.py

    • New _filter_pattern: re.Pattern[str] | None dataclass field
    • __post_init__: compile filter eagerly; raise SigmaConfigurationError on bad regex
    • _parse_plaintext, _parse_csv: use _filter_pattern instead of re.compile(self.filter)
  • tests/test_external_placeholder_transformations.py

    • test_filter_invalid_regex_raises_at_init — bad pattern → SigmaConfigurationError at construction
    • test_filter_pattern_compiled_at_init — valid pattern → _filter_pattern set and correct

All 59 existing external-placeholder tests continue to pass.

…ationError on invalid pattern

Closes SigmaHQ#509.

The filter field on ExternalSourceBaseTransformation was recompiled from
scratch on every _parse_plaintext and _parse_csv call. A malformed pattern
raised a bare re.error at parse time rather than SigmaConfigurationError at
pipeline-load time, breaking structured error handling and bypassing the
convention used throughout pySigma.

Store the compiled pattern in _filter_pattern at __post_init__ (raising
SigmaConfigurationError on bad input) and reuse it in both parse methods.
This mirrors the existing reg_filter_output design and makes configuration
errors surface early.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

filter regex compiled on every parse call without init-time validation in external placeholder transformations

1 participant