Add support for text string sets. (#63)

This adds support for text string sets (VirusTotal/yara#1787).

ast/ast.go

@@ -209,10 +209,11 @@ type ForOf struct {
 // If "In" is non-nil there is an "in" condition: 3 of them in (0..100)
 // If "At" is non-nil there is an "at" condition: 1 of them at 0
 type Of struct {
-	Quantifier Expression
-	Strings    Node
-	Rules      Node
-	In         *Range
+	Quantifier  Expression
+	Strings     Node
+	Rules       Node
+	TextStrings []string
+	In          *Range
 	At         Expression
 }
 

parser/grammar.y

@@ -172,6 +172,9 @@ type stringModifiers struct {
 %type <node>      rule_set
 %type <exprs>     rule_enumeration
 %type <ident>     rule_enumeration_item
+%type <ss>        text_string_set
+%type <ss>        text_string_enumeration
+%type <s>         text_string_enumeration_item
 
 
 %union {
@@ -953,6 +956,13 @@ expression
           Rules: $3,
         }
       }
+    | for_expression _OF_ text_string_set
+      {
+        $$ = &ast.Of{
+          Quantifier: $1,
+          TextStrings: $3,
+        }
+      }
     | primary_expression '%' _OF_ string_set
       {
         $$ = &ast.Of{
@@ -1214,6 +1224,34 @@ rule_enumeration_item
     ;
 
 
+text_string_set
+    : '(' text_string_enumeration ')'
+      {
+        $$ = $2
+      }
+    ;
+
+
+text_string_enumeration
+    : text_string_enumeration_item
+      {
+        $$ = []string{$1}
+      }
+    | text_string_enumeration ',' text_string_enumeration_item
+      {
+        $$ = append($1, $3)
+      }
+    ;
+
+
+text_string_enumeration_item
+    : _TEXT_STRING_
+      {
+        $$ = $1
+      }
+    ;
+
+
 for_expression
     : primary_expression
       {