Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft: feat: show match context #396 #436

Draft
wants to merge 3 commits into
base: master
Choose a base branch
from

Conversation

mickol34
Copy link
Collaborator

@mickol34 mickol34 commented Nov 4, 2024

Your checklist for this pull request

  • I've read the contributing guideline.
  • I've tested my changes by building and running mquery, and testing changed functionality (if applicable)
  • I've added automated tests for my change (if applicable, optional)
  • I've updated documentation to reflect my change (if applicable)

What is the current behaviour?
Currently there's no feature to show match context in search results.

What is the new behaviour?
This PR introduces "Show match context" action to search results using newly introduced backend Match field.

Test plan
Query some YARA, look at results, toggle modal with match context and check styling in various cases.

Closing issues

fixes #396

@michalkrzem
Copy link
Collaborator

Screencast.from.14.11.2024.12.18.49.webm

@mickol34
Copy link
Collaborator Author

mickol34 commented Dec 4, 2024

New modals are draggable and index themselves properly in front of everything else. New data structure allows to present data like in attached photo:
image

@msm-cert
Copy link
Member

msm-cert commented Dec 5, 2024

Looks good! (just looking at screenshots, didn't review the code yet)

Can you align the byte and text views? (such that text and byte lines contain the same data, just encoded differently).

Can you separate bytes with spaces? I mean 70 79 74 68 6f 6e 0a instead of 707974686f6e0a. Unless it looks bad for some reason.

Nitpick: it's customary to show bytes first, so could you reorder the "bytes" and "text" columns?

Finally, a question just in case - did you test this with non-printable bytes? When displaying, you can probably replace every character < 32 and >= 127 with a dot ..

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Show the information about matches in the frontend.
3 participants