forked from Velocidex/velociraptor
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathvql.go
64 lines (61 loc) · 1.86 KB
/
vql.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
//+build !codeanalysis
package reporting
import (
. "github.com/alecthomas/chroma" // nolint
"github.com/alecthomas/chroma/lexers"
)
// VQL lexer for syntax highlighting.
var VQL = lexers.Register(MustNewLexer(
&Config{
Name: "VQL",
Aliases: []string{"vql"},
Filenames: []string{"*.vql"},
MimeTypes: []string{"text/x-vql"},
NotMultiline: true,
CaseInsensitive: true,
},
Rules{
"root": {
{`\s+`, Text, nil},
{`--.*\n?`, CommentSingle, nil},
{`//(\n|[\w\W]*?[^\\]\n)`, CommentSingle, nil},
{`/\*`, CommentMultiline, Push("multiline-comments")},
{`'`, LiteralStringSingle, Push("string")},
{`"`, LiteralStringDouble, Push("double-string")},
{`(AS)(\b\s+)([a-z0-9_]+)`, ByGroups(
Keyword, Text, NameDecorator), nil},
{Words(``, `\b`, `LET`), Keyword, Push("let")},
{Words(``, `\b`, `SELECT`, `FROM`, `WHERE`,
`GROUP`, `BY`, `ORDER`, `LIMIT`), Keyword, nil},
{"[+*/<>=~!@#%^&|`?-]", Operator, nil},
{`([a-z_][\w$]*)(=)`, ByGroups(NameTag, Operator), nil},
{`([a-z_][.\w$]*)(\()`, ByGroups(NameFunction, Operator), nil},
{`[a-z_][\w$]*`, NameVariable, nil},
{`[;:()\[\],.]`, Operator, nil},
{`[0-9.]+`, LiteralNumber, nil},
{`[{}]`, Operator, nil},
{`(true|false|NULL)\b`, NameBuiltin, nil},
},
"let": {
{`\s+`, Text, nil},
{`[a-zA-Z_0-9]`, NameVariable, nil},
{`(=|<=)`, Operator, Pop(1)},
},
"multiline-comments": {
{`/\*`, CommentMultiline, Push("multiline-comments")},
{`\*/`, CommentMultiline, Pop(1)},
{`[^/*]+`, CommentMultiline, nil},
{`[/*]`, CommentMultiline, nil},
},
"string": {
{`[^']+`, LiteralStringSingle, nil},
{`''`, LiteralStringSingle, nil},
{`'`, LiteralStringSingle, Pop(1)},
},
"double-string": {
{`[^"]+`, LiteralStringDouble, nil},
{`""`, LiteralStringDouble, nil},
{`"`, LiteralStringDouble, Pop(1)},
},
},
))