chore: reduce FPs in whitespace PR by considering ; statement

Signed-off-by: Carl Flottmann <[email protected]>

Author: art1f1c3R

src/macaron/resources/pypi_malware_rules/obfuscation.yaml

@@ -319,6 +319,8 @@ rules:
   languages:
   - python
   severity: ERROR
-  patterns:
-  - pattern-regex: '[\s]{50,}(\S)+' # The 50 here is the threshold for excessive spacing , more than that is considered obfuscation
-  - pattern-not-regex: '"""[\s\S]*"""'
+  pattern-either: # The 50 here is the threshold for excessive spacing , more than that is considered obfuscation
+    # there is excessive spacing after a ";", marking the end of a statement, then additional code.
+  - pattern-regex: ;[\s]{50,}(\S)+
+    # there is excessive spacing before a ";", and any amount of whitespace before additional code.
+  - pattern-regex: '[\s]{50,};[\s]*(\S)+'

tests/malware_analyzer/pypi/resources/sourcecode_samples/obfuscation/excessive_spacing.py

@@ -20,6 +20,7 @@ def test_function():
     """
     sys.exit()
 
-    # excessive spacing obfuscation
-    def excessive_spacing_flow():
-                                                                                                                                                                                                                                                       print("Hello world!")
+    # excessive spacing obfuscation. The second line here will trigger two detections, which is expected since it matches both patterns.
+    print("hello");                                                                                                                                                         __import__('os')
+    print("hi")                                                                                         ;                                                                   __import__('base64')
+    print("things")                                                                                                                                                         ;__import__('zlib')

tests/malware_analyzer/pypi/resources/sourcecode_samples/obfuscation/expected_results.json

@@ -53,6 +53,21 @@
                     "start": 44,
                     "end": 44
                 },
+                {
+                    "file": "obfuscation/excessive_spacing.py",
+                    "start": 24,
+                    "end": 24
+                },
+                {
+                    "file": "obfuscation/excessive_spacing.py",
+                    "start": 25,
+                    "end": 25
+                },
+                {
+                    "file": "obfuscation/excessive_spacing.py",
+                    "start": 26,
+                    "end": 26
+                },
                 {
                     "file": "obfuscation/inline_imports.py",
                     "start": 23,
@@ -105,6 +120,36 @@
                 }
             ]
         },
+        "src.macaron.resources.pypi_malware_rules.obfuscation_excessive-spacing": {
+            "message": "Hidden code after excessive spacing",
+            "detections": [
+                {
+                    "file": "obfuscation/excessive_spacing.py",
+                    "start": 24,
+                    "end": 24
+                },
+                {
+                    "file": "obfuscation/excessive_spacing.py",
+                    "start": 25,
+                    "end": 25
+                },
+                {
+                    "file": "obfuscation/excessive_spacing.py",
+                    "start": 25,
+                    "end": 25
+                },
+                {
+                    "file": "obfuscation/excessive_spacing.py",
+                    "start": 26,
+                    "end": 26
+                },
+                {
+                    "file": "obfuscation/inline_imports.py",
+                    "start": 27,
+                    "end": 27
+                }
+            ]
+        },
         "src.macaron.resources.pypi_malware_rules.obfuscation_obfuscation-tools": {
             "message": "Found an indicator of the use of a python code obfuscation tool",
             "detections": [
@@ -229,21 +274,6 @@
                     "end": 68
                 }
             ]
-        },
-        "src.macaron.resources.pypi_malware_rules.obfuscation_excessive-spacing": {
-            "message": "Hidden code after excessive spacing",
-            "detections": [
-                {
-                    "file": "obfuscation/excessive_spacing.py",
-                    "start": 24,
-                    "end": 25
-                },
-                {
-                   "file": "obfuscation/inline_imports.py",
-                    "start": 27,
-                    "end": 27
-                }
-            ]
         }
     },
     "disabled_sourcecode_rule_findings": {}