Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(placeholders): allow regex valuelist transformation #322

Open
wants to merge 3 commits into
base: main
Choose a base branch
from

Conversation

m4dh4t
Copy link
Contributor

@m4dh4t m4dh4t commented Feb 13, 2025

No description provided.

@@ -706,9 +705,26 @@ class SigmaRegularExpression(SigmaType):
SigmaRegularExpressionFlag.DOTALL: "s",
}

def __post_init__(self):
def __init__(
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there a specific reason to use __init__ instead of __post_init__? A string regexp can also be replaced in __post_init__.

@@ -689,12 +689,11 @@ class SigmaRegularExpressionFlag(Enum):
DOTALL = auto()


@dataclass
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would prefer to keep this as dataclass for the provided features, consistency and clean structure.

Comment on lines +720 to +727
def __eq__(self, other: "SigmaRegularExpression") -> bool:
if isinstance(other, self.__class__):
return self.regexp == other.regexp and self.flags == other.flags
else:
raise NotImplementedError(
"SigmaRegularExpression can only be compared with another SigmaRegularExpression"
)

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unnecessary to implement in a dataclass.

@m4dh4t
Copy link
Contributor Author

m4dh4t commented Feb 18, 2025

Regarding the transition of SigmaRegularExpression from the original dataclass, I made this change at the very end to prevent any confusion about the API and prevent typing issues should a typechecker be added to the project down the line.

If we use a dataclass and set regexp to be a SigmaString, the caller will expect the SigmaRegularExpression to be initialized directly with a SigmaString, rather than a str. Without directly looking at the __post_init__ hook, he will not be aware that he can pass a str that is then going to be converted.

On the other hand, using Union[SigmaString, str] makes it clear that a str can be passed at initialization, but does not reflect that once initialized only a SigmaString will be kept.

Moving away from a dataclass seemed like a clean alternative to make both the initialization API and the class API itself clear while still honoring the typing.

If we decide to keep it as a dataclass with a SigmaString only, I think we should remove the implicit conversion made in __post_init__ and update the various places where the constructor is called to reflect this change.

@thomaspatzke
Copy link
Member

Moving away from a dataclass seemed like a clean alternative to make both the initialization API and the class API itself clear while still honoring the typing.

If we decide to keep it as a dataclass with a SigmaString only, I think we should remove the implicit conversion made in __post_init__ and update the various places where the constructor is called to reflect this change.

Init-only variables are the solution for such situations in dataclasses. Here the init-only variable would be the str or Union[str, SigmaString] and is passed to __post_init__ which converts it then into the SigmaString-only self.regexp value, that must be defined as dataclass field with init=False.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants