Skip to content

fix: avoid UnboundLocalError in SigmaFilter.from_dict with collect_errors=True - #544

Merged
thomaspatzke merged 1 commit into
SigmaHQ:mainfrom
cristianchiriac:fix/sigmafilter-collect-errors-unboundlocal
Sep 20, 2026
Merged

thomaspatzke merged 1 commit into
SigmaHQ:mainfrom
cristianchiriac:fix/sigmafilter-collect-errors-unboundlocal

Conversation

@cristianchiriac

Copy link
Copy Markdown
Contributor

Summary

SigmaFilter.from_dict(..., collect_errors=True) is meant to collect parsing
errors into .errors instead of raising, so callers can report every problem
in a filter definition at once. When both the logsource and filter
sections fail to parse, the local variables filter_logsource and
filter_global_filter are never assigned before being passed to cls(...),
so an UnboundLocalError is raised instead — even with collect_errors=True.

from sigma.filters import SigmaFilter
SigmaFilter.from_dict({}, collect_errors=True)
# UnboundLocalError: cannot access local variable 'filter_logsource' ...

Fix

Assign the placeholder values used elsewhere in the codebase for this exact
situation (EmptyLogSource, matching the pattern already used in
SigmaRule.from_dict) in each except branch, plus a new
EmptySigmaGlobalFilter placeholder mirroring EmptySigmaDetections, so the
object can still be constructed while the real errors are recorded in
.errors.

Test plan

  • Added test_sigmafilter_collect_errors and
    test_sigmafilter_collect_errors_false_raises in tests/test_filters.py.
  • pytest tests/test_filters.py tests/test_correlations.py passes (119 passed, 1 skipped).
  • Full suite: 1537 passed, 1 skipped, 2 pre-existing failures unrelated to this change (network/pip access in test_plugins.py).

…rors=True

When both the logsource and filter fail to parse and collect_errors=True,
the local variables were never assigned, so cls() raised an
UnboundLocalError instead of returning the collected errors.
@thomaspatzke
thomaspatzke merged commit 5c7fc2d into SigmaHQ:main Sep 20, 2026
20 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants