diff --git a/unit_tests/engine/test_rule_loader.cpp b/unit_tests/engine/test_rule_loader.cpp index 2ef90783..6cf6ad38 100644 --- a/unit_tests/engine/test_rule_loader.cpp +++ b/unit_tests/engine/test_rule_loader.cpp @@ -958,4 +958,29 @@ TEST_F(test_falco_engine, exceptions_override_no_values) ASSERT_TRUE(load_rules(rules_content, "rules.yaml")); ASSERT_TRUE(check_warning_message("Overriding/appending exception with no values")); +} + +TEST_F(test_falco_engine, exceptions_names_not_unique) +{ + std::string rules_content = R"END( +- rule: test_rule + desc: test rule + condition: proc.cmdline contains curl + output: command=%proc.cmdline + priority: INFO + exceptions: + - name: test_exception + fields: [proc.cmdline] + comps: [contains] + values: + - [curl 127.0.0.1] + - name: test_exception + fields: [proc.cmdline] + comps: [endswith] + values: + - [curl 127.0.0.1] +)END"; + + ASSERT_FALSE(load_rules(rules_content, "rules.yaml")); + ASSERT_TRUE(check_error_message("Exceptions names in the same object must be unique")); } \ No newline at end of file