mirror of
https://github.com/falcosecurity/falco.git
synced 2025-06-26 22:57:24 +00:00
new(tests): add unique exceptions names test
Signed-off-by: Gianmatteo Palmieri <mail@gian.im>
This commit is contained in:
parent
05c434ed89
commit
368463e295
@ -959,3 +959,28 @@ TEST_F(test_falco_engine, exceptions_override_no_values)
|
|||||||
ASSERT_TRUE(load_rules(rules_content, "rules.yaml"));
|
ASSERT_TRUE(load_rules(rules_content, "rules.yaml"));
|
||||||
ASSERT_TRUE(check_warning_message("Overriding/appending exception with no values"));
|
ASSERT_TRUE(check_warning_message("Overriding/appending exception with no values"));
|
||||||
}
|
}
|
||||||
|
|
||||||
|
TEST_F(test_falco_engine, exceptions_names_not_unique)
|
||||||
|
{
|
||||||
|
std::string rules_content = R"END(
|
||||||
|
- rule: test_rule
|
||||||
|
desc: test rule
|
||||||
|
condition: proc.cmdline contains curl
|
||||||
|
output: command=%proc.cmdline
|
||||||
|
priority: INFO
|
||||||
|
exceptions:
|
||||||
|
- name: test_exception
|
||||||
|
fields: [proc.cmdline]
|
||||||
|
comps: [contains]
|
||||||
|
values:
|
||||||
|
- [curl 127.0.0.1]
|
||||||
|
- name: test_exception
|
||||||
|
fields: [proc.cmdline]
|
||||||
|
comps: [endswith]
|
||||||
|
values:
|
||||||
|
- [curl 127.0.0.1]
|
||||||
|
)END";
|
||||||
|
|
||||||
|
ASSERT_FALSE(load_rules(rules_content, "rules.yaml"));
|
||||||
|
ASSERT_TRUE(check_error_message("Exceptions names in the same object must be unique"));
|
||||||
|
}
|
Loading…
Reference in New Issue
Block a user