diff --git a/CHANGELOG.md b/CHANGELOG.md index 8124e8c66..e1e423b42 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,6 +4,8 @@ ### New Features +- allow call as valid subscope for call scoped rules @mr-tz + ### Breaking Changes - remove support for Python 3.8 and use Python 3.10 as minimum now #1966 @mr-tz diff --git a/capa/rules/__init__.py b/capa/rules/__init__.py index 11c0c0c2a..399571fe2 100644 --- a/capa/rules/__init__.py +++ b/capa/rules/__init__.py @@ -630,8 +630,8 @@ def build_statements(d, scopes: Scopes): ) elif key == "call": - if all(s not in scopes for s in (Scope.FILE, Scope.PROCESS, Scope.THREAD)): - raise InvalidRule("call subscope supported only for the process and thread scopes") + if all(s not in scopes for s in (Scope.FILE, Scope.PROCESS, Scope.THREAD, Scope.CALL)): + raise InvalidRule("call subscope supported only for the process, thread, and call scopes") if len(d[key]) != 1: raise InvalidRule("subscope must have exactly one child statement")