fix(processing): compile filter regex at init and raise SigmaConfigurationError on invalid pattern#511
Open
Romil2112 wants to merge 1 commit into
Open
Conversation
…ationError on invalid pattern Closes SigmaHQ#509. The filter field on ExternalSourceBaseTransformation was recompiled from scratch on every _parse_plaintext and _parse_csv call. A malformed pattern raised a bare re.error at parse time rather than SigmaConfigurationError at pipeline-load time, breaking structured error handling and bypassing the convention used throughout pySigma. Store the compiled pattern in _filter_pattern at __post_init__ (raising SigmaConfigurationError on bad input) and reuse it in both parse methods. This mirrors the existing reg_filter_output design and makes configuration errors surface early.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #509.
Summary
The
filterfield onExternalSourceBaseTransformationwas recompiled on every_parse_plaintextand_parse_csvcall. A malformed pattern raised a barere.errorat parse time rather thanSigmaConfigurationErrorat pipeline-load time — inconsistent with every other regex field in pySigma and breaking callers that catchSigmaError.This PR adds a
_filter_patternprivate field, compiles the regex once in__post_init__(raisingSigmaConfigurationErroron bad input), and reuses it in both parse methods. The change mirrors the existingreg_filter_outputdesign exactly.Changes
sigma/processing/transformations/external.py_filter_pattern: re.Pattern[str] | Nonedataclass field__post_init__: compilefiltereagerly; raiseSigmaConfigurationErroron bad regex_parse_plaintext,_parse_csv: use_filter_patterninstead ofre.compile(self.filter)tests/test_external_placeholder_transformations.pytest_filter_invalid_regex_raises_at_init— bad pattern →SigmaConfigurationErrorat constructiontest_filter_pattern_compiled_at_init— valid pattern →_filter_patternset and correctAll 59 existing external-placeholder tests continue to pass.