diff --git a/tests/test_rules.py b/tests/test_rules.py index 18b1746f..7de66a0a 100644 --- a/tests/test_rules.py +++ b/tests/test_rules.py @@ -4,6 +4,7 @@ import pytest import capa.rules from capa.features.insn import Number, Offset +from capa.features import String def test_rule_ctor(): @@ -56,6 +57,22 @@ def test_rule_yaml_complex(): assert r.evaluate({Number(6): {1}, Number(7): {1}, Number(8): {1}}) == False +def test_rule_yaml_descriptions(): + rule = textwrap.dedent(''' + rule: + meta: + name: test rule + features: + - and: + - number: 1 = This is the number 1 + - string: This program cannot be run in DOS mode. + description: MS-DOS stub message + - count(number(2 = AF_INET/SOCK_DGRAM)): 2 + ''') + r = capa.rules.Rule.from_yaml(rule) + assert r.evaluate({Number(1): {1}, Number(2): {2, 3}, String('This program cannot be run in DOS mode.'): {4}}) == True + + def test_rule_yaml_not(): rule = textwrap.dedent(''' rule: