rule generator: insert default child statement when specifying basic block subscope

The rule generator recognizes the following as a valid rule (Rule compiled and matched):

  features:
    - and:
      - offset: 0x10
      - offset: 0x14

But it complains that when adding a basic block (failed to match rule):

  features:
    - and:
      - offset: 0x10
      - basic block:
        - offset: 0x14

Adding an extra element to the basic block, it claims that it failed to compile the rule (invalid rule: subscope must have exactly one child statement):

  features:
    - and:
      - basic block:
        - offset: 0x14
        - offset: 0x10

https://user-images.githubusercontent.com/16052290/110840578-2e201000-82a5-11eb-99e5-98c57fea8199.mov

It looks like something is wrong with basic blocks as both should be valid rules and match.

[mr-tz]

Yes, I think checking the type makes sense.

[mike-hunhoff]

Hm I’m guessing the second rule is “valid” in the sense that it contains exactly one child element, but capa won’t be able to find a match for it because the type of the child statement is not as expected. If you nested - offset: 0x14 underneath an and or or statement then the rule is valid and capa should be able to find a match for it.

We should modify the check to verify that a subscope has exactly one child element AND it’s of the expected type. Unless this additional check is performed later?

Thoughts @mr-tz?