github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-06-25 22:32:07 +00:00
Code Issues Projects Releases Wiki Activity

new(tests): test override/append exception with no values

Browse Source 
Signed-off-by: Gianmatteo Palmieri <mail@gian.im>
This commit is contained in:
Gianmatteo Palmieri 2024-03-08 11:08:28 +01:00 committed by poiana
parent 7086f35eba
commit a8018a2894
1 changed files with 55 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

55
unit_tests/engine/test_rule_loader.cpp
View File

@ -903,4 +903,59 @@ TEST_F(test_falco_engine, list_name_invalid)
ASSERT_FALSE(load_rules(rules_content, "rules.yaml"));
ASSERT_TRUE(check_error_message("List has an invalid name. List names must match a regular expression"));
}
// The appended exception has a purposely miswritten field (value),
// simulating a typo or an incorrect usage.
TEST_F(test_falco_engine, exceptions_append_no_values)
{
std::string rules_content = R"END(
- rule: test_rule
desc: test rule
condition: proc.cmdline contains curl
output: command=%proc.cmdline
priority: INFO
exceptions:
- name: test_exception
fields: [proc.cmdline]
comps: [contains]
values:
- [curl 127.0.0.1]
- rule: test_rule
exceptions:
- name: test_exception
value: curl 1.1.1.1
append: true
)END";
ASSERT_TRUE(load_rules(rules_content, "rules.yaml"));
ASSERT_TRUE(check_warning_message("Overriding/appending exception with no values"));
}
TEST_F(test_falco_engine, exceptions_override_no_values)
{
std::string rules_content = R"END(
- rule: test_rule
desc: test rule
condition: proc.cmdline contains curl
output: command=%proc.cmdline
priority: INFO
exceptions:
- name: test_exception
fields: [proc.cmdline]
comps: [contains]
values:
- [curl 127.0.0.1]
- rule: test_rule
exceptions:
- name: test_exception
value: curl 1.1.1.1
override:
exceptions: append
)END";
ASSERT_TRUE(load_rules(rules_content, "rules.yaml"));
ASSERT_TRUE(check_warning_message("Overriding/appending exception with no values"));
}