Add command line flag for preventing the use of compiled rules inadvertently.

docs/commandline.rst

@@ -5,17 +5,24 @@ Running YARA from the command-line
 **********************************
 
 In order to invoke YARA you’ll need two things: a file with the rules you want
-to use (either in source code or compiled form) and the target to be scanned.
-The target can be a file, a folder, or a process. ::
+to use and the target to be scanned. The target can be a file, a folder, or a
+process. ::
 
   yara [OPTIONS] RULES_FILE TARGET
 
+In YARA 3.8 and below ``RULES_FILE`` was allowed to be a file with rules in source
+form or in compiled form indistinctly. In YARA 3.9 you need to explictly specify
+that ``RULES_FILE`` contains compiled rules by using the -C flag. ::
 
-``RULES_FILE`` can be passed directly in source code form, or can be previously
-compiled with the ``yarac`` tool. You may prefer to use your rules in compiled
-form if you are going to invoke YARA multiple times with the same rules. This
-way you’ll save time, because for YARA it is faster to load compiled rules than
-compiling the same rules over and over again.
+  yara [OPTIONS] -C RULES_FILE TARGET
+
+This is a security measure to prevent users from inadvertenly using compiled
+rules coming from a third-party. Using compiled rules from untrusted sources can
+lead to the execution of malicious code in your computer.
+
+For compiling rules beforhand you can use the ``yarac`` tool. This way can save
+time, because for YARA it is faster to load compiled rules than compiling the
+same rules over and over again.
 
 You can also pass multiple source files to `yara` like in the following example::
 
@@ -50,6 +57,10 @@ Available options are:
 
   Print rules named <identifier> and ignore the rest.
 
+.. option:: -c --count
+
+  RULES_FILE contains rules already compiled with yarac.
+
 .. option:: -c --count
 
   Print only number of matches.

yara.c

@@ -142,6 +142,7 @@ static bool fast_scan = false;
 static bool negate = false;
 static bool print_count_only = false;
 static bool fail_on_warnings = false;
+static bool rules_are_compiled = false;
 static int total_count = 0;
 static int limit = 0;
 static int timeout = 1000000;
@@ -159,6 +160,9 @@ args_option_t options[] =
   OPT_STRING(0, "atom-quality-table", &atom_quality_table,
       "path to a file with the atom quality table", "FILE"),
 
+  OPT_BOOLEAN('C', "compiled-rules", &rules_are_compiled,
+      "load compiled rules"),
+
   OPT_BOOLEAN('c', "count", &print_count_only,
       "print only number of matches"),
 
@@ -530,6 +534,9 @@ static void print_error(
     case ERROR_UNSUPPORTED_FILE_VERSION:
       fprintf(stderr, "rules were compiled with a different version of YARA\n");
       break;
+    case ERROR_INVALID_FILE:
+      fprintf(stderr, "invalid compiled rules file.\n");
+      break;
     case ERROR_CORRUPT_FILE:
       fprintf(stderr, "corrupt compiled rules file.\n");
       break;
@@ -544,7 +551,7 @@ static void print_error(
       fprintf(stderr, "too many matches\n");
       break;
     default:
-      fprintf(stderr, "internal error: %d\n", error);
+      fprintf(stderr, "error: %d\n", error);
       break;
   }
 }
@@ -1132,21 +1139,7 @@ int main(
   // Try to load the rules file as a binary file containing
   // compiled rules first
 
-  result = yr_rules_load(argv[0], &rules);
-
-  // Accepted result are ERROR_SUCCESS or ERROR_INVALID_FILE
-  // if we are passing the rules in source form, if result is
-  // different from those exit with error.
-
-  if (result != ERROR_SUCCESS &&
-      result != ERROR_COULD_NOT_OPEN_FILE &&
-      result != ERROR_INVALID_FILE)
-  {
-    print_error(result);
-    exit_with_code(EXIT_FAILURE);
-  }
-
-  if (result == ERROR_SUCCESS)
+  if (rules_are_compiled)
   {
     // When a binary file containing compiled rules is provided, yara accepts
     // only two arguments, the compiled rules file and the target to be scanned.
@@ -1159,13 +1152,10 @@ int main(
       exit_with_code(EXIT_FAILURE);
     }
 
-    result = define_external_variables(rules, NULL);
+    result = yr_rules_load(argv[0], &rules);
 
-    if (result != ERROR_SUCCESS)
-    {
-      print_error(result);
-      exit_with_code(EXIT_FAILURE);
-    }
+    if (result == ERROR_SUCCESS)
+      result = define_external_variables(rules, NULL);
   }
   else
   {
@@ -1215,12 +1205,12 @@ int main(
     yr_compiler_destroy(compiler);
 
     compiler = NULL;
+  }
 
-    if (result != ERROR_SUCCESS)
-    {
-      fprintf(stderr, "error: %d\n", result);
-      exit_with_code(EXIT_FAILURE);
-    }
+  if (result != ERROR_SUCCESS)
+  {
+    print_error(result);
+    exit_with_code(EXIT_FAILURE);
   }
 
   if (show_stats)

yara.man

@@ -17,6 +17,9 @@ are:
 .B "    --atom-quality-table"
 Path to a file with the atom quality table.
 .TP
+.B \-C " --compiled-rules"
+RULES_FILE contains rules already compiled with yarac.
+.TP
 .B \-c " --count"
 Print number of matches only.
 .TP