capafmt breaks `description` field if namespace contains `features`

[Still34]

Description

The rule formatter, capafmt.py, currently used for ensuring linting of mandiant/capa-rules has a bug that incorrectly indents description field from 4 spaces to 6 spaces. This "formatted" YAML is not a valid YAML and is not accepted across any YAML parsers. In other words, the formatter corrupts the "violating" rule.

This appears to be caused by

capa/capa/rules/__init__.py

Line 1377 in f04931d

features_offset = doc.find("features")

, where somehow when looking for the features field, it mistakenly matched the namespace field with the word features, and incorrectly applied the description bump fix that was originally made to address #263.

This issue was never discovered until now as only 5 rules used impact/features under nursery, and none of them contained a description field. When creating the PR mandiant/capa-rules#1173, the rule was created with impacts/features in mind, as that was also the case for other Defender-related rules under nursery. I was later asked to add a description field, and these two combinations just so happen to surface this 6-year-old bug.

A proposed fix would be add a newline check so instead of,

features_offset = doc.find("features")

Add other anchors to pin the search down, or rewrite the entire fix altogether:

features_offset = doc.find("\n  features:")

Steps to Reproduce

1. Create a new rule that uses the namespace [...]/features alongside a description field for the rule meta.
2. Run capafmt in-place on the newly created rule
3. See the incorrectly placed description field

Expected behavior:

description field gets formatted properly with correct indentation.

    description: Looks for CLSID/IIDs associated with making COM calls to the Windows Security Center component; may be used to impair Windows Defender by registering itself as a security solution.

Actual behavior:

description field gets formatted improperly with additional indentation.

      description: Looks for CLSID/IIDs associated with making COM calls to the Windows Security Center component; may be used to impair Windows Defender by registering itself as a security solution.

Versions

Additional Information