fix: escape + in Base64 string regex pattern

[vishwaksen-1]

Description

Fixes the unescaped + character in the Base64 alphabet regex pattern.

Problem

The + character in line 20 was not escaped in the regex pattern /ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/. This caused it to be interpreted as a regex quantifier (meaning "one or more of the preceding character") instead of a literal + character that is part of the Base64 alphabet.

Solution

Escaped the + character as \+ to match it literally.

Changed:

- string: /ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/

To:

- string: /ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789\+/

Testing

• Ran python scripts/lint.py on the modified file
• Verified the pattern now correctly matches the Base64 alphabet

Closes #1101

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[mike-hunhoff]

Thanks @vishwaksen-1 , unfortunately tests are failing:

INFO     lint: collecting potentially referenced samples            lint.py:1238
INFO     lint: rule "reference Base64 string" does not match for     lint.py:409
         sample BFB9B5391A13D0AFD787E87AB90F14F5                                

 reference Base64 string
  FAIL: doesn't match on referenced example: Fix the rule logic or provide a 
different example

rules with FAIL:
  - reference Base64 string

Please investigate and address accordingly.

[vishwaksen-1]

Yes I'll go through that.

[vishwaksen-1]

It was a mistake on my end, I was accidentally running liter on previous version rather than the one I edited and hence missed it 😅.

I think it works now.

[vishwaksen-1]

Hi @mike-hunhoff I've made a commit correcting my mistake. Can you please check

[mike-hunhoff]

Hi @vishwaksen-1 , unfortunately lints are still failing, see:

 reference Base64 string
  FAIL: EOF format: end file with a single empty line
  FAIL: rule format incorrect: use scripts/capafmt.py or adjust as follows
  rule:
    meta:
      name: reference Base64 string
      namespace: data-manipulation/encoding/base64
      authors:
        - moritz.raabe@mandiant.com
      scopes:
        static: file
        dynamic: file
      att&ck:
        - Defense Evasion::Obfuscated Files or Information [T1027]
      mbc:
        - Data::Encode Data::Base64 [C0026.001]
        - Data::Check String [C0019]
      examples:
        - BFB9B5391A13D0AFD787E87AB90F14F5
        - 074072B261FC27B65C72671F13510C05
        - 5DB2D2BE20D59AA0BE6709A6850F1775
    features:
-     - string: 
"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"+     - 
string: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
?                                                                               
+

Please ensure all lints pass locally before requesting another review.

[mike-hunhoff]

closed due to inactive. Please reopen if you continue to work this pull request.