From 5321737c16094b41006889dd51bb40a6209651d9 Mon Sep 17 00:00:00 2001
From: Bradley <bradleyjkemp96@gmail.com>
Date: Fri, 2 Sep 2022 16:09:10 +0100
Subject: [PATCH] Return error if no placeholder function is defined

---
 evaluator/evaluate_search.go | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/evaluator/evaluate_search.go b/evaluator/evaluate_search.go
index c025230..da82a89 100644
--- a/evaluator/evaluate_search.go
+++ b/evaluator/evaluate_search.go
@@ -129,6 +129,9 @@ func (rule *RuleEvaluator) getMatcherValues(ctx context.Context, matcher sigma.F
 	for _, value := range matcher.Values {
 		if strings.HasPrefix(value, "%") && strings.HasSuffix(value, "%") {
 			// expand placeholder to values
+			if rule.expandPlaceholder == nil {
+				return nil, fmt.Errorf("can't expand %s, no placeholder expander function defined", value)
+			}
 			placeholderValues, err := rule.expandPlaceholder(ctx, value)
 			if err != nil {
 				return nil, fmt.Errorf("failed to expand placeholder: %w", err)