def testSetAttribute(self):
"""Tests the _SetAttribute function."""
parser = expression_parser.EventFilterExpressionParser()
parser._Reset()
next_state = parser._SetAttribute(string='attribute')
self.assertEqual(next_state, 'OPERATOR')
def testStringFinish(self):
"""Tests the _StringFinish function."""
parser = expression_parser.EventFilterExpressionParser()
parser._Reset()
next_state = parser._StringFinish()
self.assertIsNone(next_state)
def testStringStart(self):
"""Tests the _StringStart function."""
parser = expression_parser.EventFilterExpressionParser()
parser._Reset()
next_state = parser._StringStart()
self.assertIsNone(next_state)
self.assertEqual(parser._string, '')
def testAddBinaryOperator(self):
"""Tests the _AddBinaryOperator function."""
parser = expression_parser.EventFilterExpressionParser()
parser._Reset()
next_state = parser._AddBinaryOperator(string='&&')
self.assertIsNone(next_state)
self.assertIsNotNone(parser._stack[0])
def testAddBracketOpen(self):
"""Tests the _AddBracketOpen function."""
parser = expression_parser.EventFilterExpressionParser()
parser._Reset()
next_state = parser._AddBracketOpen()
self.assertIsNone(next_state)
self.assertEqual(parser._stack[0], '(')
def testSetOperator(self):
"""Tests the _SetOperator function."""
parser = expression_parser.EventFilterExpressionParser()
parser._Reset()
self.assertIsNotNone(parser._current_expression)
self.assertIsNone(parser._current_expression.operator)
next_state = parser._SetOperator(string='&&')
self.assertIsNone(next_state)
self.assertEqual(parser._current_expression.operator, '&&')
def testPushBack(self):
"""Tests the _PushBack function."""
parser = expression_parser.EventFilterExpressionParser()
parser._Reset()
parser._buffer = ''
parser._processed_buffer = 'mytest'
next_state = parser._PushBack(string='test')
self.assertIsNone(next_state)
self.assertEqual(parser._buffer, 'test')
self.assertEqual(parser._processed_buffer, 'my')
def testPushState(self):
"""Tests the _PushState function."""
parser = expression_parser.EventFilterExpressionParser()
parser._Reset()
parser._state = 'INITIAL'
self.assertEqual(len(parser._state_stack), 0)
next_state = parser._PushState()
self.assertIsNone(next_state)
self.assertEqual(len(parser._state_stack), 1)
self.assertEqual(parser._state_stack[0], 'INITIAL')
self.assertEqual(parser._state, 'INITIAL')
def testParseWithEscaping(self):
"""Tests the Parse function with escaping."""
parser = expression_parser.EventFilterExpressionParser()
expression = parser.Parse(r'a is "\n"')
self.assertEqual(expression.args[0], '\n')
# Can escape the backslash.
expression = parser.Parse(r'a is "\\"')
self.assertEqual(expression.args[0], '\\')
# Invalid escape sequence.
with self.assertRaises(errors.ParseError):
parser.Parse(r'a is "\z"')
def testPopState(self):
"""Tests the _PopState function."""
parser = expression_parser.EventFilterExpressionParser()
parser._Reset()
parser._state_stack.append('INITIAL')
self.assertEqual(len(parser._state_stack), 1)
next_state = parser._PopState()
self.assertEqual(next_state, 'INITIAL')
self.assertEqual(len(parser._state_stack), 0)
with self.assertRaises(errors.ParseError):
parser._PopState()
def testGetNextToken(self):
"""Tests the _GetNextToken function."""
parser = expression_parser.EventFilterExpressionParser()
parser._Reset()
parser._buffer = ''
token = parser._GetNextToken()
self.assertIsNone(token)
parser._buffer = '('
token = parser._GetNextToken()
self.assertIsNotNone(token)
self.assertEqual(parser._buffer, '')
self.assertEqual(parser._processed_buffer, '(')
def testCombineParenthesis(self):
"""Tests the _CombineParenthesis function."""
parser = expression_parser.EventFilterExpressionParser()
parser._Reset()
parser._CombineParenthesis()
parser._AddBracketOpen()
parser._AddBinaryOperator(string='&&')
parser._AddBracketClose()
self.assertEqual(len(parser._stack), 3)
parser._CombineParenthesis()
self.assertEqual(len(parser._stack), 1)
def testParseWithBraces(self):
"""Tests the Parse function with braces."""
parser = expression_parser.EventFilterExpressionParser()
expression = parser.Parse('(a is 3)')
self.assertIsNotNone(expression)
# Need to close braces.
with self.assertRaises(errors.ParseError):
parser.Parse('(a is 3')
# Need to open braces to close them.
with self.assertRaises(errors.ParseError):
parser.Parse('a is 3)')
def testStringEscape(self):
"""Tests the _StringEscape function."""
parser = expression_parser.EventFilterExpressionParser()
parser._Reset()
parser._StringStart()
self.assertEqual(parser._string, '')
match = re.compile(r'\\(.)').match('\\n')
next_state = parser._StringEscape(string='\\n', match=match)
self.assertIsNone(next_state)
self.assertEqual(parser._string, '\n')
with self.assertRaises(errors.ParseError):
match = re.compile(r'\\(.)').match('\\q')
parser._StringEscape(string='\\q', match=match)
def CompileFilter(self, filter_expression):
"""Compiles the filter expression.
The filter expression contains an object filter expression.
Args:
filter_expression (str): filter expression.
Raises:
ParseError: if the filter expression cannot be parsed.
"""
parser = expression_parser.EventFilterExpressionParser()
expression = parser.Parse(filter_expression)
self._event_filter = expression.Compile()
self._filter_expression = filter_expression
def _CheckIfExpressionMatches(
self, expression, event, event_data, event_tag, expected_result):
"""Checks if the event filter expression matches the event values.
Args:
expression (str): event filter expression.
event (EventObject): event.
event_data (EventData): event data.
event_tag (EventTag): event tag.
expected_result (bool): expected result.
"""
parser = expression_parser.EventFilterExpressionParser()
expression = parser.Parse(expression)
event_filter = expression.Compile()
result = event_filter.Matches(event, event_data, event_tag)
self.assertEqual(expected_result, result)
def testParse(self):
"""Tests the Parse function."""
parser = expression_parser.EventFilterExpressionParser()
# Arguments are either int, float or quoted string.
expression = parser.Parse('attribute == 1')
self.assertIsNotNone(expression)
expression = parser.Parse('attribute == 0x10')
self.assertIsNotNone(expression)
with self.assertRaises(errors.ParseError):
parser.Parse('attribute == 1a')
expression = parser.Parse('attribute == 1.2')
self.assertIsNotNone(expression)
expression = parser.Parse('attribute == \'bla\'')
self.assertIsNotNone(expression)
expression = parser.Parse('attribute == "bla"')
self.assertIsNotNone(expression)
with self.assertRaises(errors.ParseError):
parser.Parse('something == red')
# Test expression starting with AND.
with self.assertRaises(errors.ParseError):
parser.Parse('and something is \'Blue\'')
# Test incorrect usage of NOT.
with self.assertRaises(errors.ParseError):
parser.Parse('attribute not == \'dancer\'')
with self.assertRaises(errors.ParseError):
parser.Parse('attribute == not \'dancer\'')
with self.assertRaises(errors.ParseError):
parser.Parse('attribute not not equals \'dancer\'')
with self.assertRaises(errors.ParseError):
parser.Parse('attribute not > 23')
# Test double negative matching.
with self.assertRaises(errors.ParseError):
parser.Parse('filename not not contains \'GoodFella\'')
def testParseWithHexadecimalEscaping(self):
"""Tests the Parse function with hexadecimal escaping."""
parser = expression_parser.EventFilterExpressionParser()
# Instead, this is what one should write.
expression = parser.Parse(r'a is "\\xJZ"')
self.assertEqual(expression.args[0], r'\xJZ')
# Standard hex-escape.
expression = parser.Parse('a is "\x41\x41\x41"')
self.assertEqual(expression.args[0], 'AAA')
# Hex-escape + a character.
expression = parser.Parse('a is "\x414"')
self.assertEqual(expression.args[0], 'A4')
# How to include r'\x41'.
expression = parser.Parse('a is "\\x41"')
self.assertEqual(expression.args[0], '\x41')
# This fails as it's not really a hex escaped string.
with self.assertRaises(errors.ParseError):
parser.Parse(r'a is "\xJZ"')
def testNoOperation(self):
"""Tests the _NoOperation function."""
parser = expression_parser.EventFilterExpressionParser()
parser._NoOperation()
def testReset(self): """Tests the _Reset function.""" parser = expression_parser.EventFilterExpressionParser() parser._Reset()
def testDefault(self):
"""Tests the Default function."""
parser = expression_parser.EventFilterExpressionParser()
parser.Default()
