Bash test files (Tree-Sitter)

[saniyafatima07]

Context: PR-3121

• Adds bash test samples for tree-sitter feature.

[mr-tz]

please also update .github/check_sample_filenames.py as part of this PR

[saniyafatima07]

@mr-tz I have made the requested changes. Could you please take another look when u get a chance?
Thank you!

[mr-tz]

CI is complaining - I don't know what you discussed but we should maybe consider storing these in a defanged version? Are these actual malware samples? Would be bad to run them by error (like for all files here of course).

[saniyafatima07]

CI is complaining - I don't know what you discussed but we should maybe consider storing these in a defanged version? Are these actual malware samples? Would be bad to run them by error (like for all files here of course).

Sorry about that. The CI failure was due to the filename on my side. I had made a few changes to the sample but forgot to rename it back to its SHA-256 hash, so the checks failed. I have fixed it and the CI should pass now.

Also, yes, these are actual malware samples that I collected from MalwareBazaar for the test suite. I will defang both the scripts. Thank you for the review!

[mr-tz]

Please add documentation on how to add such files / how they are zipped (eg with a password?), then should be good to go.

[saniyafatima07]

Please add documentation on how to add such files / how they are zipped (eg with a password?), then should be good to go.

I’ve added a small section of documentation on how to add the bash script samples. I haven’t password-protected the ZIP files currently. Should I do that as well?

[mr-tz]

this works for me, thanks

@mandiant/capa-dev any other thoughts or concerns?

[saniyafatima07]

@mike-hunhoff Moved it back to the .sh_ approach. Could you please review it?

[mike-hunhoff]

Thank you @saniyafatima07 . See my comments about adding a guard to the bash scripts just to be extra safe.

[saniyafatima07]

@mike-hunhoff Done.