def testLists(self):
query = "'foo' in ('foo', 'bar') and 1 not in (5, 2, 3,17)"
expected = expression.Intersection(
expression.Membership(expression.Literal("foo"),
expression.Literal(("foo", "bar"))),
expression.Complement(
expression.Membership(expression.Literal(1),
expression.Literal((5, 2, 3, 17)))))
self.assertQueryMatches(query, expected)
def testBigQuery(self):
query = ("(Process/pid is 1 and Process/command in ('init', 'initd')) "
"or any Process/children matches (Process/command not in "
"('launchd', 'foo'))")
expected = expression.Union(
expression.Intersection(
expression.Equivalence(expression.Binding("Process/pid"),
expression.Literal(1)),
expression.Membership(expression.Binding("Process/command"),
expression.Literal(("init", "initd")))),
expression.LetAny(
expression.Binding("Process/children"),
expression.Complement(
expression.Membership(
expression.Binding("Process/command"),
expression.Literal(("launchd", "foo"))))))
self.assertQueryMatches(query, expected)
def ComplementMembership(*args, **kwargs):
return expression.Complement(
expression.Membership(*args, **kwargs), **kwargs)
def ComplementEquivalence(*args, **kwargs):
return expression.Complement(
expression.Equivalence(*args, **kwargs), **kwargs)