def testTimestamp(self):
class BlarghParser(parsers.SingleFileParser):
supported_artifacts = ["Blargh"]
def ParseFile(
self,
knowledge_base: rdf_client.KnowledgeBase,
pathspec: rdf_paths.PathSpec,
filedesc: file_store.BlobStream,
) -> Iterable[rdfvalue.RDFBytes]:
del knowledge_base, pathspec # Unused.
return [rdfvalue.RDFBytes(filedesc.Read())]
with parser_test_lib._ParserContext("Blargh", BlarghParser):
factory = parsers.ArtifactParserFactory("Blargh")
stat_entry = rdf_client_fs.StatEntry()
stat_entry.pathspec.path = "foo/bar/baz"
stat_entry.pathspec.pathtype = rdf_paths.PathSpec.PathType.OS
self._WriteFile(stat_entry.pathspec.path, b"OLD")
time.Step()
timestamp = rdfvalue.RDFDatetime.Now()
self._WriteFile(stat_entry.pathspec.path, b"NEW")
applicator = artifact.ParserApplicator(
factory,
client_id=self.client_id,
knowledge_base=rdf_client.KnowledgeBase(),
timestamp=timestamp)
applicator.Apply([stat_entry])
errors = list(applicator.Errors())
self.assertEmpty(errors)
responses = list(applicator.Responses())
self.assertLen(responses, 1)
self.assertEqual(responses[0], b"OLD")
def testTimePassage(self):
then = rdfvalue.RDFDatetime.Now()
time.Step()
now = rdfvalue.RDFDatetime.Now()
self.assertLess(then, now)