From 03e477862061be91cf7f10bac53e24eb953647f1 Mon Sep 17 00:00:00 2001 From: mr-tz Date: Thu, 14 Nov 2024 11:33:45 +0000 Subject: [PATCH] allow call as valid subscope for call scoped rules --- CHANGELOG.md | 2 ++ capa/rules/__init__.py | 4 ++-- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 8124e8c6..e1e423b4 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,6 +4,8 @@ ### New Features +- allow call as valid subscope for call scoped rules @mr-tz + ### Breaking Changes - remove support for Python 3.8 and use Python 3.10 as minimum now #1966 @mr-tz diff --git a/capa/rules/__init__.py b/capa/rules/__init__.py index 11c0c0c2..399571fe 100644 --- a/capa/rules/__init__.py +++ b/capa/rules/__init__.py @@ -630,8 +630,8 @@ def build_statements(d, scopes: Scopes): ) elif key == "call": - if all(s not in scopes for s in (Scope.FILE, Scope.PROCESS, Scope.THREAD)): - raise InvalidRule("call subscope supported only for the process and thread scopes") + if all(s not in scopes for s in (Scope.FILE, Scope.PROCESS, Scope.THREAD, Scope.CALL)): + raise InvalidRule("call subscope supported only for the process, thread, and call scopes") if len(d[key]) != 1: raise InvalidRule("subscope must have exactly one child statement")