features: fix Regex.get_value_str() corrupting capa2yara output

[EclipseAditya]

closes #1909

Regex inherits from String, which overrides get_value_str() to call escape_string() (via repr()). This doubles all backslashes in the regex pattern before capa2yara.py ever sees it, producing corrupted YARA rules.

Fix: override get_value_str() on Regex to return self.value directly (same as the base Feature class), since regex backslashes are syntax, not escape sequences. String and Substring escaping is intentional and unchanged.

Introduced by 58e94a3.

Checklist

• No CHANGELOG update needed
• No new tests needed
• No documentation update needed
• This submission includes AI-generated code and I have provided details in the description.

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request resolves a critical bug that caused incorrect YARA rule generation due to improper handling of regular expression patterns. By ensuring that the Regex feature returns its raw pattern instead of an inadvertently escaped version, the change prevents pattern corruption and improves the accuracy and reliability of generated YARA rules.

Highlights

• Regex Pattern Handling Fix: Fixed an issue where the Regex.get_value_str() method was incorrectly returning an escaped pattern, which led to double backslash escaping and corrupted YARA rules when processed by capa2yara.py.
• Method Override for Raw Pattern: Overrode the get_value_str() method within the Regex class to ensure it directly returns the raw regex pattern (self.value), bypassing the unintended escaping inherited from the String class.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Changelog

• CHANGELOG.md
  • features: fix Regex.get_value_str() returning escaped pattern instead of raw regex @EclipseAditya Change to get_value_str() to escape regexes broke capa2yara.py #1909

Activity

• No specific review comments or activity have been recorded for this pull request yet.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request correctly fixes a bug where Regex.get_value_str() was returning an escaped string, which caused issues with YARA rule generation. The fix is to override the method in the Regex class to return the raw value. The change is correct and well-implemented. I've added one suggestion to include a regression test to prevent this issue from happening again in the future.

[mr-tz]

Thank you. How does this change the current behavior of capa main or other receivers of this data?

[EclipseAditya]

capa main and the render modules don't call get_value_str() anywhere, so no change there.

The only callers in the codebase are capa2yara.py (the reported bug, now fixed) and the IDA plugin view.py. In the IDA plugin, Regex passes the isinstance(k, String) check, so the result of get_value_str() already gets wrapped in escape_string(). Before the fix that was a double escape (once inside get_value_str, once outside). Now it escapes once, which is consistent with how plain String features are handled.

Rule evaluation uses self.re.search() directly and Regex.str() uses self.value directly, neither goes through get_value_str().

[mr-tz]

thanks!