From 368463e295b11a958d1e949bb68550ca50b27a2d Mon Sep 17 00:00:00 2001 From: Gianmatteo Palmieri Date: Fri, 8 Mar 2024 09:54:44 +0100 Subject: [PATCH] new(tests): add unique exceptions names test Signed-off-by: Gianmatteo Palmieri --- unit_tests/engine/test_rule_loader.cpp | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/unit_tests/engine/test_rule_loader.cpp b/unit_tests/engine/test_rule_loader.cpp index 2ef90783..6cf6ad38 100644 --- a/unit_tests/engine/test_rule_loader.cpp +++ b/unit_tests/engine/test_rule_loader.cpp @@ -958,4 +958,29 @@ TEST_F(test_falco_engine, exceptions_override_no_values) ASSERT_TRUE(load_rules(rules_content, "rules.yaml")); ASSERT_TRUE(check_warning_message("Overriding/appending exception with no values")); +} + +TEST_F(test_falco_engine, exceptions_names_not_unique) +{ + std::string rules_content = R"END( +- rule: test_rule + desc: test rule + condition: proc.cmdline contains curl + output: command=%proc.cmdline + priority: INFO + exceptions: + - name: test_exception + fields: [proc.cmdline] + comps: [contains] + values: + - [curl 127.0.0.1] + - name: test_exception + fields: [proc.cmdline] + comps: [endswith] + values: + - [curl 127.0.0.1] +)END"; + + ASSERT_FALSE(load_rules(rules_content, "rules.yaml")); + ASSERT_TRUE(check_error_message("Exceptions names in the same object must be unique")); } \ No newline at end of file