summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorFelix Bauer <jack@ai4me.de>2019-10-01 17:05:54 +0200
committerGitHub <noreply@github.com>2019-10-01 17:05:54 +0200
commit778ff1931b793292c8fcdcc921dda76d92626524 (patch)
tree5b8ed8816563d4d2790f8cdf369da87a6caafd95
parent8091e18aadf17f7332151500498a915be509454a (diff)
Add None type to expressions (#101)
Expressions can now contain None values. e.g. variable is None
-rw-r--r--peekaboo/ruleset/expressions.py11
-rwxr-xr-xtests/test.py37
2 files changed, 47 insertions, 1 deletions
diff --git a/peekaboo/ruleset/expressions.py b/peekaboo/ruleset/expressions.py
index e4fe0ad..c08bb58 100644
--- a/peekaboo/ruleset/expressions.py
+++ b/peekaboo/ruleset/expressions.py
@@ -101,6 +101,13 @@ class EvalBoolean(EvalBase):
self.value = self.token == "True"
+class EvalNone(EvalBase):
+ """ Class to evaluate a parsed none constant """
+ def convert(self):
+ logger.debug("None: %s", self.value)
+ self.value = None
+
+
class EvalInteger(EvalBase):
""" Class to evaluate a parsed integer constant """
def convert(self):
@@ -447,6 +454,7 @@ class ExpressionParser(object):
ParserElement.enablePackrat()
boolean = Keyword('True') | Keyword('False')
+ none = Keyword('None')
integer = Word(nums)
real = Combine(Word(nums) + "." + Word(nums))
string = (QuotedString('"', escChar='\\')
@@ -458,7 +466,7 @@ class ExpressionParser(object):
])
result = (Keyword('bad') | Keyword('fail') | Keyword('good')
| Keyword('ignore') | Keyword('unknown'))
- rval = boolean | real | integer | string | regex | result | dereference
+ rval = boolean | none | real | integer | string | regex | result | dereference
rvallist = Group(Suppress('[') + delimitedList(rval) + Suppress(']'))
rvalset = Group(Suppress('{') + delimitedList(rval) + Suppress('}'))
operand = rval | rvallist | rvalset
@@ -466,6 +474,7 @@ class ExpressionParser(object):
# parse actions replace the parsed tokens with an instantiated object
# which we can later call into for evaluation of its content
boolean.setParseAction(EvalBoolean)
+ none.setParseAction(EvalNone)
integer.setParseAction(EvalInteger)
real.setParseAction(EvalReal)
string.setParseAction(EvalString)
diff --git a/tests/test.py b/tests/test.py
index 151bc19..bec3d97 100755
--- a/tests/test.py
+++ b/tests/test.py
@@ -822,6 +822,43 @@ unknown : baz'''
result = rule.evaluate(sample)
self.assertEqual(result.result, Result.unknown)
+ def test_rule_ignore_no_name_declared(self):
+ """ Test rule to ignore file with no name_declared. """
+ config = '''[expressions]
+ expression.3 : not sample.name_declared -> ignore
+ '''
+
+ factory = CreatingSampleFactory(
+ cuckoo=None, base_dir="",
+ job_hash_regex="", keep_mail_data=False,
+ processing_info_dir=None)
+
+ part = {"full_name": "file1.gif",
+ "name_declared": "file1.gif",
+ "type_declared": "image/gif"
+ }
+
+ sample = factory.create_sample('file1.gif', 'GIF87...', metainfo=part)
+ rule = ExpressionRule(CreatingConfigParser(config))
+ result = rule.evaluate(sample)
+ self.assertEqual(result.result, Result.unknown)
+
+ sample = factory.create_sample('file2.gif', 'GIF87...')
+ sample.meta_info_name_declared = None
+ rule = ExpressionRule(CreatingConfigParser(config))
+ result = rule.evaluate(sample)
+ self.assertEqual(result.result, Result.ignored)
+
+ config = '''[expressions]
+ expression.3 : sample.name_declared is None -> ignore
+ '''
+
+ sample = factory.create_sample('file2.gif', 'GIF87...')
+ sample.meta_info_name_declared = None
+ rule = ExpressionRule(CreatingConfigParser(config))
+ result = rule.evaluate(sample)
+ self.assertEqual(result.result, Result.ignored)
+
def test_rule_ignore_mail_signatures(self):
""" Test rule to ignore cryptographic mail signatures. """
config = '''[expressions]