yara-python <-> yara inconsistent handling of metadata

[Tom Lancaster]

If I have the following rule foo.yar:

rule my_metadata_rule
{
	meta:
		foo = "bar"
		foo = "rae"
	
	condition:
		true
}

And I use yara:

yara -m foo.yar foo.yar

my_metadata_rule [foo="bar",foo="rae"] foo.yar

I get the expected output where both metadata values are printed, but if using yara-python and inspecting a matches metadata, only the last value of "foo" is returned. I know in some older version of YARA duplicate metadata fields were not allowed and I suspect that this was never considered for YARA-python.

I am unsure what the best fix (or even if one is required) is, as potentially changing the match.meta object from a dictionary would likely break any existing integrations.

Cheers,
Tom

[Wesley Shields]

There are a couple of open PRs for this:

#74

#201

But yes, you are right that this is a known issue. The problem is fixing it without breaking existing scripts that expect scalar values and not lists.

[cccs-rs]

Should now be resolved in: d29ca08