Coverage for /pythoncovmergedfiles/medio/medio/usr/local/lib/python3.8/site-packages/pygments/lexers/yara.py: 100%

1""" 

2 pygments.lexers.yara 

3 ~~~~~~~~~~~~~~~~~~~~ 

4 

5 Lexers for YARA. 

6 

7 :copyright: Copyright 2006-2023 by the Pygments team, see AUTHORS. 

8 :license: BSD, see LICENSE for details. 

9""" 

10 

11from pygments.lexer import RegexLexer, words 

12from pygments.token import Comment, String, Name, Text, Punctuation, Operator, Keyword, Whitespace, Number, Generic 

13 

14__all__ = ['YaraLexer'] 

15 

16class YaraLexer(RegexLexer): 

17 """ 

18 For YARA rules 

19 

20 .. versionadded:: 2.16.0 

21 """ 

22 

23 name = 'YARA' 

24 url = 'https://virustotal.github.io/yara/' 

25 aliases = ['yara', 'yar'] 

26 filenames = ['*.yar'] 

27 mimetypes = ['text/x-yara'] 

28 

29 tokens = { 

30 'root': [ 

31 (r'\s+', Whitespace), 

32 (r'//.*?$', Comment.Single), 

33 (r'\#.*?$', Comment.Single), 

34 (r'/\*', Comment.Multiline, 'comment'), 

35 (words(('rule', 'private', 'global', 'import', 'include'), 

36 prefix=r'\b', suffix=r'\b'), 

37 Keyword.Declaration), 

38 (words(('strings', 'condition', 'meta'), prefix=r'\b', suffix=r'\b'), 

39 Keyword), 

40 (words(('ascii', 'at', 'base64', 'base64wide', 'condition', 'contains', 

41 'endswith', 'entrypoint', 'filesize', 'for', 'fullword', 'icontains', 

42 'iendswith', 'iequals', 'in', 'include', 'int16', 'int16be', 'int32', 

43 'int32be', 'int8', 'int8be', 'istartswith', 'matches', 'meta', 'nocase', 

44 'none', 'of', 'startswith', 'strings', 'them', 'uint16', 'uint16be', 

45 'uint32', 'uint32be', 'uint8', 'uint8be', 'wide', 'xor', 'defined'), 

46 prefix=r'\b', suffix=r'\b'), 

47 Name.Builtin), 

48 (r'(true|false)\b', Keyword.Constant), 

49 (r'(and|or|not|any|all)\b', Operator.Word), 

50 (r'(\$\w+)', Name.Variable), 

51 (r'"[^"]*"', String.Double), 

52 (r'\'[^\']*\'', String.Single), 

53 (r'\{.*?\}$', Number.Hex), 

54 (r'(/.*?/)', String.Regex), 

55 (r'[a-z_]\w*', Name), 

56 (r'[$(){}[\].?+*|]', Punctuation), 

57 (r'[:=,;]', Punctuation), 

58 (r'.', Text) 

59 ], 

60 'comment': [ 

61 (r'[^*/]+', Comment.Multiline), 

62 (r'/\*', Comment.Multiline, '#push'), 

63 (r'\*/', Comment.Multiline, '#pop'), 

64 (r'[*/]', Comment.Multiline) 

65 ] 

66 }