mirror of
https://github.com/mandiant/capa.git
synced 2025-12-22 07:10:29 -08:00
tests: rules: demonstrate substring with description
This commit is contained in:
@@ -766,6 +766,23 @@ def test_substring_feature():
|
|||||||
assert (Substring("abc") in children) == True
|
assert (Substring("abc") in children) == True
|
||||||
assert (Substring("def") in children) == True
|
assert (Substring("def") in children) == True
|
||||||
assert (Substring("gh\ni") in children) == True
|
assert (Substring("gh\ni") in children) == True
|
||||||
|
|
||||||
|
|
||||||
|
def test_substring_description():
|
||||||
|
rule = textwrap.dedent(
|
||||||
|
"""
|
||||||
|
rule:
|
||||||
|
meta:
|
||||||
|
name: test rule
|
||||||
|
features:
|
||||||
|
- or:
|
||||||
|
- substring: abc
|
||||||
|
description: the start of the alphabet
|
||||||
|
"""
|
||||||
|
)
|
||||||
|
r = capa.rules.Rule.from_yaml(rule)
|
||||||
|
children = list(r.statement.get_children())
|
||||||
|
assert (Substring("abc") in children) == True
|
||||||
|
|
||||||
|
|
||||||
def test_regex_values_always_string():
|
def test_regex_values_always_string():
|
||||||
|
|||||||
Reference in New Issue
Block a user