From bcf8feb6a41d900d23dfc12675df6e060de8c048 Mon Sep 17 00:00:00 2001 From: "Victor M. Alvarez" Date: Mon, 20 Jul 2026 11:54:50 +0200 Subject: [PATCH 1/5] ci: move WASM tests to dedicated workflow This change adjusts the workflow triggers, allowing WASM tests to run specifically on tag creation (for releases) and via manual workflow dispatch, rather than on every push or pull request. This helps optimize CI resource usage by only running these tests when necessary. --- .github/workflows/tests.yaml | 67 --------------------------- .github/workflows/wasm_tests.yaml | 76 +++++++++++++++++++++++++++++++ 2 files changed, 76 insertions(+), 67 deletions(-) create mode 100644 .github/workflows/wasm_tests.yaml diff --git a/.github/workflows/tests.yaml b/.github/workflows/tests.yaml index 5437eeaf..cefaba76 100644 --- a/.github/workflows/tests.yaml +++ b/.github/workflows/tests.yaml @@ -190,70 +190,3 @@ jobs: env: RUSTDOCFLAGS: ${{ matrix.rust_flags }} - browser-wasm: - name: Browser WASM - runs-on: ubuntu-latest - env: - CARGO_TERM_COLOR: always - steps: - - name: Checkout sources - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - - name: Install Rust toolchain - uses: dtolnay/rust-toolchain@master - with: - toolchain: stable - target: wasm32-unknown-unknown - - - name: Install Node.js - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 - with: - node-version: 22 - - - name: Install Chrome and ChromeDriver - id: setup-chrome - uses: browser-actions/setup-chrome@2e1d749697dd1612b833dba4a722266286fbefcd # v2.1.2 - with: - chrome-version: stable - install-dependencies: true - install-chromedriver: true - - - name: Add ChromeDriver to PATH - run: echo "$(dirname '${{ steps.setup-chrome.outputs.chromedriver-path }}')" >> "$GITHUB_PATH" - - - name: Install wasm-pack - run: cargo install --locked wasm-pack --version 0.14.0 - - - name: Install wasm-bindgen CLI - run: cargo install --locked wasm-bindgen-cli --version 0.2.113 - - - name: Install terser - run: npm install --global terser - - - name: Write webdriver.json - run: | - cat > js-wasm/webdriver.json <> "$GITHUB_PATH" + + - name: Install wasm-pack + run: cargo install --locked wasm-pack --version 0.14.0 + + - name: Install wasm-bindgen CLI + run: cargo install --locked wasm-bindgen-cli --version 0.2.113 + + - name: Install terser + run: npm install --global terser + + - name: Write webdriver.json + run: | + cat > js-wasm/webdriver.json < Date: Tue, 21 Jul 2026 08:56:28 +0200 Subject: [PATCH 2/5] chore(deps-dev): bump brace-expansion in /ls/editors/code (#714) Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion) from 1.1.12 to 1.1.16. - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](https://github.com/juliangruber/brace-expansion/compare/v1.1.12...v1.1.16) --- updated-dependencies: - dependency-name: brace-expansion dependency-version: 1.1.16 dependency-type: indirect ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- ls/editors/code/package-lock.json | 42 +++++++++++++++---------------- 1 file changed, 21 insertions(+), 21 deletions(-) diff --git a/ls/editors/code/package-lock.json b/ls/editors/code/package-lock.json index 30114169..ead3b61a 100644 --- a/ls/editors/code/package-lock.json +++ b/ls/editors/code/package-lock.json @@ -278,9 +278,9 @@ } }, "node_modules/@eslint/config-array/node_modules/brace-expansion": { - "version": "1.1.12", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz", - "integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==", + "version": "1.1.16", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz", + "integrity": "sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==", "dev": true, "license": "MIT", "dependencies": { @@ -352,9 +352,9 @@ } }, "node_modules/@eslint/eslintrc/node_modules/brace-expansion": { - "version": "1.1.12", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz", - "integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==", + "version": "1.1.16", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz", + "integrity": "sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==", "dev": true, "license": "MIT", "dependencies": { @@ -1304,9 +1304,9 @@ } }, "node_modules/@vscode/vsce/node_modules/brace-expansion": { - "version": "5.0.6", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz", - "integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==", + "version": "5.0.7", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz", + "integrity": "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==", "dev": true, "license": "MIT", "dependencies": { @@ -1534,9 +1534,9 @@ "license": "BSD-2-Clause" }, "node_modules/brace-expansion": { - "version": "2.0.2", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.2.tgz", - "integrity": "sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==", + "version": "2.1.2", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.2.tgz", + "integrity": "sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==", "license": "MIT", "dependencies": { "balanced-match": "^1.0.0" @@ -2258,9 +2258,9 @@ } }, "node_modules/eslint/node_modules/brace-expansion": { - "version": "1.1.12", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz", - "integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==", + "version": "1.1.16", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz", + "integrity": "sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==", "dev": true, "license": "MIT", "dependencies": { @@ -2691,9 +2691,9 @@ } }, "node_modules/glob/node_modules/brace-expansion": { - "version": "5.0.6", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz", - "integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==", + "version": "5.0.7", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz", + "integrity": "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==", "dev": true, "license": "MIT", "dependencies": { @@ -3581,9 +3581,9 @@ } }, "node_modules/minimatch/node_modules/brace-expansion": { - "version": "5.0.3", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.3.tgz", - "integrity": "sha512-fy6KJm2RawA5RcHkLa1z/ScpBeA762UF9KmZQxwIbDtRJrgLzM10depAiEQ+CXYcoiqW1/m96OAAoke2nE9EeA==", + "version": "5.0.7", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz", + "integrity": "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==", "dev": true, "license": "MIT", "dependencies": { From 0b7752b531ba5e9ee6ca3f70122cfae5389f2525 Mon Sep 17 00:00:00 2001 From: "Victor M. Alvarez" Date: Wed, 22 Jul 2026 10:31:35 +0200 Subject: [PATCH 3/5] tests: add test case for rules that use `them` but don't define patterns. --- lib/src/compiler/tests/testdata/errors/155.in | 1 + lib/src/compiler/tests/testdata/errors/155.out | 7 +++++++ 2 files changed, 8 insertions(+) create mode 100644 lib/src/compiler/tests/testdata/errors/155.in create mode 100644 lib/src/compiler/tests/testdata/errors/155.out diff --git a/lib/src/compiler/tests/testdata/errors/155.in b/lib/src/compiler/tests/testdata/errors/155.in new file mode 100644 index 00000000..e18e1a5e --- /dev/null +++ b/lib/src/compiler/tests/testdata/errors/155.in @@ -0,0 +1 @@ +rule test { condition: 50% of them } \ No newline at end of file diff --git a/lib/src/compiler/tests/testdata/errors/155.out b/lib/src/compiler/tests/testdata/errors/155.out new file mode 100644 index 00000000..5440318b --- /dev/null +++ b/lib/src/compiler/tests/testdata/errors/155.out @@ -0,0 +1,7 @@ +error[E016]: no matching patterns + --> line:1:31 + | +1 | rule test { condition: 50% of them } + | ^^^^ there's no pattern in this set + | + = note: this rule doesn't define any patterns \ No newline at end of file From 89df3f7208b2a799c35dfa8e36103c1469d6b090 Mon Sep 17 00:00:00 2001 From: "Victor M. Alvarez" Date: Wed, 22 Jul 2026 10:49:54 +0200 Subject: [PATCH 4/5] fix: issue with large regular expressions. Prevents panics during scan due to regular expressions that are too large. Introduces a new `Hir::build_automata` method that centralizes the logic for compiling a regex's High-level Intermediate Representation (HIR) into an automata. This method encapsulates the NFA size limit configuration and provides a more specific `regex is too large` error message when the limit is exceeded during compilation. --- lib/src/compiler/ir/ast2ir.rs | 11 ++++++++- lib/src/compiler/rules.rs | 17 ++++--------- lib/src/compiler/tests/testdata/errors/156.in | 4 ++++ .../compiler/tests/testdata/errors/156.out | 5 ++++ lib/src/re/hir.rs | 24 +++++++++++++++++++ 5 files changed, 47 insertions(+), 14 deletions(-) create mode 100644 lib/src/compiler/tests/testdata/errors/156.in create mode 100644 lib/src/compiler/tests/testdata/errors/156.out diff --git a/lib/src/compiler/ir/ast2ir.rs b/lib/src/compiler/ir/ast2ir.rs index ea6aea48..ced8cdf9 100644 --- a/lib/src/compiler/ir/ast2ir.rs +++ b/lib/src/compiler/ir/ast2ir.rs @@ -519,13 +519,22 @@ fn expr_from_ast( } ast::Expr::Regexp(regexp) => { - re::parser::Parser::new() + let hir = re::parser::Parser::new() .relaxed_re_syntax(ctx.relaxed_re_syntax) .parse(regexp.as_ref()) .map_err(|err| { re_error_to_compile_error(ctx.report_builder, regexp, err) })?; + hir.build_automata().map_err(|err| { + InvalidRegexp::build( + ctx.report_builder, + err.to_string(), + ctx.report_builder.span_to_code_loc(regexp.span()), + None, + ) + })?; + ctx.ir .constant(TypeValue::Regexp(Some(Regexp::new(regexp.literal)))) } diff --git a/lib/src/compiler/rules.rs b/lib/src/compiler/rules.rs index 0ccff08e..548226cb 100644 --- a/lib/src/compiler/rules.rs +++ b/lib/src/compiler/rules.rs @@ -475,20 +475,11 @@ impl Rules { let parser = re::parser::Parser::new() .relaxed_re_syntax(self.relaxed_re_syntax); - let hir = parser.parse(&re).unwrap().into_inner(); + let hir = parser.parse(&re).unwrap(); - // Set a size limit for the NFA automata. The default limit (10MB) is - // too small for certain regexps seen in YARA rules in the wild, see: - // https://github.com/VirusTotal/yara-x/issues/85 - let config = regex_automata::meta::Config::new() - .nfa_size_limit(Some(50 * 1024 * 1024)); - - regex_automata::meta::Builder::new() - .configure(config) - .build_from_hir(&hir) - .unwrap_or_else(|err| { - panic!("error compiling regex `{}`: {:#?}", re.as_str(), err) - }) + hir.build_automata().unwrap_or_else(|err| { + panic!("error compiling regex `{}`: {:#?}", re.as_str(), err) + }) } /// Returns a compiled multi-pattern `RegexSet` for a given `RegexSetId`. diff --git a/lib/src/compiler/tests/testdata/errors/156.in b/lib/src/compiler/tests/testdata/errors/156.in new file mode 100644 index 00000000..fbd303da --- /dev/null +++ b/lib/src/compiler/tests/testdata/errors/156.in @@ -0,0 +1,4 @@ +rule test { + condition: + "abc" matches /([a-z]{1000}){1000}/ +} \ No newline at end of file diff --git a/lib/src/compiler/tests/testdata/errors/156.out b/lib/src/compiler/tests/testdata/errors/156.out new file mode 100644 index 00000000..5b4c2a41 --- /dev/null +++ b/lib/src/compiler/tests/testdata/errors/156.out @@ -0,0 +1,5 @@ +error[E014]: invalid regular expression + --> line:3:21 + | +3 | "abc" matches /([a-z]{1000}){1000}/ + | ^^^^^^^^^^^^^^^^^^^^^ regex is too large \ No newline at end of file diff --git a/lib/src/re/hir.rs b/lib/src/re/hir.rs index 228141a4..3f72a37e 100644 --- a/lib/src/re/hir.rs +++ b/lib/src/re/hir.rs @@ -318,6 +318,30 @@ impl Hir { self.inner } + /// Builds a [`regex_automata::meta::Regex`] from this HIR. + pub fn build_automata( + &self, + ) -> Result { + // Set a size limit for the NFA automata. The default limit (10MB) is + // not enough for certain regular expressions seen in the wild, see: + // https://github.com/VirusTotal/yara-x/issues/85 + let config = regex_automata::meta::Config::new() + .nfa_size_limit(Some(50 * 1024 * 1024)); + + regex_automata::meta::Builder::new() + .configure(config) + .build_from_hir(&self.inner) + .map_err(|err| { + if err.size_limit().is_some() { + anyhow::anyhow!("regex is too large") + } else if let Some(syntax_error) = err.syntax_error() { + anyhow::anyhow!("{}", syntax_error) + } else { + anyhow::anyhow!("{}", err) + } + }) + } + /// Returns the length (in bytes) of the smallest string matched by this HIR. /// /// A return value of `0` is possible and occurs when the HIR can match an From 1f449ab0028bb4203b687a0df25cf5dd7bf4febd Mon Sep 17 00:00:00 2001 From: William Durand Date: Wed, 22 Jul 2026 12:01:18 +0200 Subject: [PATCH 5/5] ci: move wasm_tests workflow to upstream-workflows/ --- .github/{workflows => upstream-workflows}/wasm_tests.yaml | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename .github/{workflows => upstream-workflows}/wasm_tests.yaml (100%) diff --git a/.github/workflows/wasm_tests.yaml b/.github/upstream-workflows/wasm_tests.yaml similarity index 100% rename from .github/workflows/wasm_tests.yaml rename to .github/upstream-workflows/wasm_tests.yaml