If you’ve ever wanted to match all rules instead of just one, now you can. Here is a conjured up example:
{
// This is an example of having to match all rules. In this example, the file needs to have a ruby
// shebang *and* end in .ruby. If "match" == "all", DetectSyntax will set the named syntax only if all
// rules match. If "match" is anything other than "all", the syntax will be set if any rule matches
// (the normal behavior)
"name": "Ruby",
"match": "all",
"rules":
{"binary": "ruby"},
{"file_name": ".*\\.ruby$"}
]
},All existing rules should continue to work as they have. If anyone encounters any problems, please file an issue on GitHub [1] with an example file and the rule that broke. I’ll look into as soon as I can.