Fix yara preprocessing from overwriting

app.py

@@ -74,36 +74,60 @@ def preprocess_yara_rules(repo_path: Path) -> Path:
         shutil.rmtree(processed_dir)
     processed_dir.mkdir()
 
-    rule_pattern = re.compile(r"rule\s+(\w+)")  # Match YARA rule names
-    seen_rules = {}  # Track rule names to prevent duplicates
-    rule_counter = 0  # Counter for renaming duplicate rules
+    rule_pattern = re.compile(r"rule\s+([^\s{]+)")
+    seen_rules = {}
+    rule_counter = 0
 
     for yara_file in repo_path.glob("**/*.yara"):
         if yara_file.name == "misc.yara":
             logger.info(f"Skipping {yara_file} as it does not belong to any malware family")
             continue
+
+        # Preserve directory structure
+        try:
+            relative_path = yara_file.relative_to(repo_path)
+        except ValueError:
+            continue  # Skip files not in repo path
+
+        processed_file = processed_dir / relative_path
+        processed_file.parent.mkdir(parents=True, exist_ok=True)
+
         new_content = []
-        with open(yara_file, "r", encoding="utf-8") as f:
+        with open(yara_file, "r", encoding="utf-8", errors='replace') as f:
             for line in f:
-                match = rule_pattern.match(line)
+                line = line.rstrip('\n')
+                match = rule_pattern.match(line.strip())
+                
                 if match:
                     original_name = match.group(1)
-                    if original_name in seen_rules:
-                        logger.info(f"{original_name} is unseen")
-                        rule_counter += 1
-                        seen_rules[original_name] += 1
-                        new_name = f"{original_name}_{seen_rules[original_name]}"
+                    # Sanitize rule name
+                    clean_name = re.sub(r'[^a-zA-Z0-9_]', '_', original_name)
+                    
+                    # Ensure valid starting character
+                    if not clean_name:
+                        clean_name = "invalid_rule"
+                    elif not clean_name[0].isalpha() and clean_name[0] != '_':
+                        clean_name = f"_{clean_name}"
+
+                    # Handle duplicates
+                    if clean_name in seen_rules:
+                        seen_rules[clean_name] += 1
+                        new_name = f"{clean_name}_{seen_rules[clean_name]}"
                         line = line.replace(original_name, new_name, 1)
+                        rule_counter += 1
+                        logger.debug(f"Renamed duplicate rule: {original_name} -> {new_name}")
                     else:
-                        logger.warn(f"{original_name} is SEEN")
-                        seen_rules[original_name] = 0  # First occurrence
-                new_content.append(line)
-        
-        # Save the modified file
-        processed_file = processed_dir / yara_file.name
+                        seen_rules[clean_name] = 0  # Initialize count
+                        if clean_name != original_name:
+                            line = line.replace(original_name, clean_name, 1)
+                            logger.debug(f"Sanitized rule name: {original_name} -> {clean_name}")
+
+                new_content.append(line + '\n')
+
         with open(processed_file, "w", encoding="utf-8") as f:
             f.writelines(new_content)
-    logger.info(f"Total of {rule_counter} rule(s) are duplicates. They have been renamed.")
+
+    logger.info(f"Processed {rule_counter} duplicate rules")
     return processed_dir
 
 def compile_yara_rules(repo_path: Path) -> Optional[yara.Rules]: