Unexpected result when parsing imports about plyara

[utkonos]

@tlansec Thanks for the report. We have had a lengthy discussion about this topic in #53

I am amenable to an additional non-default option that removes imports from rules that don't use it, but the behavior you're reporting is expected and by design.

[tlansec]

It might be the design, but I expect I will not be the last user who is surprised by this behaviour - a common use case for plyara might be:

import plyara 
# whatever the rebuild_rule import is
with open('foo.yar, 'r') as infile:
    data = infile.read()

p = plyara.Plyara()
parsed = p.parse_string(data)
accepted_rules = []
for rule in parsed:
     # do some check, and if it passes.
     accepted_rules.append(rebuild_rule(rule))
# write all the accepted_rules to a new file.

Thus ending up with a large # of unnecessary imports. I appreciate that there isn't an elegant solution to this.

If any future readers come across this thread and the library is still working as described in this issue and #53, I found the best solution is to stop using rebuild_rule if you are not modifying the contents of the rule - instead use the start_line and stop_line to build the rule from the original string again.

Cheers,
Tom