diff options
author | Felix Bauer <jack@ai4me.de> | 2019-10-01 17:05:54 +0200 |
---|---|---|
committer | GitHub <noreply@github.com> | 2019-10-01 17:05:54 +0200 |
commit | 778ff1931b793292c8fcdcc921dda76d92626524 (patch) | |
tree | 5b8ed8816563d4d2790f8cdf369da87a6caafd95 | |
parent | 8091e18aadf17f7332151500498a915be509454a (diff) |
Add None type to expressions (#101)
Expressions can now contain None values.
e.g. variable is None
-rw-r--r-- | peekaboo/ruleset/expressions.py | 11 | ||||
-rwxr-xr-x | tests/test.py | 37 |
2 files changed, 47 insertions, 1 deletions
diff --git a/peekaboo/ruleset/expressions.py b/peekaboo/ruleset/expressions.py index e4fe0ad..c08bb58 100644 --- a/peekaboo/ruleset/expressions.py +++ b/peekaboo/ruleset/expressions.py @@ -101,6 +101,13 @@ class EvalBoolean(EvalBase): self.value = self.token == "True" +class EvalNone(EvalBase): + """ Class to evaluate a parsed none constant """ + def convert(self): + logger.debug("None: %s", self.value) + self.value = None + + class EvalInteger(EvalBase): """ Class to evaluate a parsed integer constant """ def convert(self): @@ -447,6 +454,7 @@ class ExpressionParser(object): ParserElement.enablePackrat() boolean = Keyword('True') | Keyword('False') + none = Keyword('None') integer = Word(nums) real = Combine(Word(nums) + "." + Word(nums)) string = (QuotedString('"', escChar='\\') @@ -458,7 +466,7 @@ class ExpressionParser(object): ]) result = (Keyword('bad') | Keyword('fail') | Keyword('good') | Keyword('ignore') | Keyword('unknown')) - rval = boolean | real | integer | string | regex | result | dereference + rval = boolean | none | real | integer | string | regex | result | dereference rvallist = Group(Suppress('[') + delimitedList(rval) + Suppress(']')) rvalset = Group(Suppress('{') + delimitedList(rval) + Suppress('}')) operand = rval | rvallist | rvalset @@ -466,6 +474,7 @@ class ExpressionParser(object): # parse actions replace the parsed tokens with an instantiated object # which we can later call into for evaluation of its content boolean.setParseAction(EvalBoolean) + none.setParseAction(EvalNone) integer.setParseAction(EvalInteger) real.setParseAction(EvalReal) string.setParseAction(EvalString) diff --git a/tests/test.py b/tests/test.py index 151bc19..bec3d97 100755 --- a/tests/test.py +++ b/tests/test.py @@ -822,6 +822,43 @@ unknown : baz''' result = rule.evaluate(sample) self.assertEqual(result.result, Result.unknown) + def test_rule_ignore_no_name_declared(self): + """ Test rule to ignore file with no name_declared. """ + config = '''[expressions] + expression.3 : not sample.name_declared -> ignore + ''' + + factory = CreatingSampleFactory( + cuckoo=None, base_dir="", + job_hash_regex="", keep_mail_data=False, + processing_info_dir=None) + + part = {"full_name": "file1.gif", + "name_declared": "file1.gif", + "type_declared": "image/gif" + } + + sample = factory.create_sample('file1.gif', 'GIF87...', metainfo=part) + rule = ExpressionRule(CreatingConfigParser(config)) + result = rule.evaluate(sample) + self.assertEqual(result.result, Result.unknown) + + sample = factory.create_sample('file2.gif', 'GIF87...') + sample.meta_info_name_declared = None + rule = ExpressionRule(CreatingConfigParser(config)) + result = rule.evaluate(sample) + self.assertEqual(result.result, Result.ignored) + + config = '''[expressions] + expression.3 : sample.name_declared is None -> ignore + ''' + + sample = factory.create_sample('file2.gif', 'GIF87...') + sample.meta_info_name_declared = None + rule = ExpressionRule(CreatingConfigParser(config)) + result = rule.evaluate(sample) + self.assertEqual(result.result, Result.ignored) + def test_rule_ignore_mail_signatures(self): """ Test rule to ignore cryptographic mail signatures. """ config = '''[expressions] |