def testSetAttribute(self): """Tests the _SetAttribute function.""" parser = expression_parser.EventFilterExpressionParser() parser._Reset() next_state = parser._SetAttribute(string='attribute') self.assertEqual(next_state, 'OPERATOR')
def testStringFinish(self): """Tests the _StringFinish function.""" parser = expression_parser.EventFilterExpressionParser() parser._Reset() next_state = parser._StringFinish() self.assertIsNone(next_state)
def testStringStart(self): """Tests the _StringStart function.""" parser = expression_parser.EventFilterExpressionParser() parser._Reset() next_state = parser._StringStart() self.assertIsNone(next_state) self.assertEqual(parser._string, '')
def testAddBinaryOperator(self): """Tests the _AddBinaryOperator function.""" parser = expression_parser.EventFilterExpressionParser() parser._Reset() next_state = parser._AddBinaryOperator(string='&&') self.assertIsNone(next_state) self.assertIsNotNone(parser._stack[0])
def testAddBracketOpen(self): """Tests the _AddBracketOpen function.""" parser = expression_parser.EventFilterExpressionParser() parser._Reset() next_state = parser._AddBracketOpen() self.assertIsNone(next_state) self.assertEqual(parser._stack[0], '(')
def testSetOperator(self): """Tests the _SetOperator function.""" parser = expression_parser.EventFilterExpressionParser() parser._Reset() self.assertIsNotNone(parser._current_expression) self.assertIsNone(parser._current_expression.operator) next_state = parser._SetOperator(string='&&') self.assertIsNone(next_state) self.assertEqual(parser._current_expression.operator, '&&')
def testPushBack(self): """Tests the _PushBack function.""" parser = expression_parser.EventFilterExpressionParser() parser._Reset() parser._buffer = '' parser._processed_buffer = 'mytest' next_state = parser._PushBack(string='test') self.assertIsNone(next_state) self.assertEqual(parser._buffer, 'test') self.assertEqual(parser._processed_buffer, 'my')
def testPushState(self): """Tests the _PushState function.""" parser = expression_parser.EventFilterExpressionParser() parser._Reset() parser._state = 'INITIAL' self.assertEqual(len(parser._state_stack), 0) next_state = parser._PushState() self.assertIsNone(next_state) self.assertEqual(len(parser._state_stack), 1) self.assertEqual(parser._state_stack[0], 'INITIAL') self.assertEqual(parser._state, 'INITIAL')
def testParseWithEscaping(self): """Tests the Parse function with escaping.""" parser = expression_parser.EventFilterExpressionParser() expression = parser.Parse(r'a is "\n"') self.assertEqual(expression.args[0], '\n') # Can escape the backslash. expression = parser.Parse(r'a is "\\"') self.assertEqual(expression.args[0], '\\') # Invalid escape sequence. with self.assertRaises(errors.ParseError): parser.Parse(r'a is "\z"')
def testPopState(self): """Tests the _PopState function.""" parser = expression_parser.EventFilterExpressionParser() parser._Reset() parser._state_stack.append('INITIAL') self.assertEqual(len(parser._state_stack), 1) next_state = parser._PopState() self.assertEqual(next_state, 'INITIAL') self.assertEqual(len(parser._state_stack), 0) with self.assertRaises(errors.ParseError): parser._PopState()
def testGetNextToken(self): """Tests the _GetNextToken function.""" parser = expression_parser.EventFilterExpressionParser() parser._Reset() parser._buffer = '' token = parser._GetNextToken() self.assertIsNone(token) parser._buffer = '(' token = parser._GetNextToken() self.assertIsNotNone(token) self.assertEqual(parser._buffer, '') self.assertEqual(parser._processed_buffer, '(')
def testCombineParenthesis(self): """Tests the _CombineParenthesis function.""" parser = expression_parser.EventFilterExpressionParser() parser._Reset() parser._CombineParenthesis() parser._AddBracketOpen() parser._AddBinaryOperator(string='&&') parser._AddBracketClose() self.assertEqual(len(parser._stack), 3) parser._CombineParenthesis() self.assertEqual(len(parser._stack), 1)
def testParseWithBraces(self): """Tests the Parse function with braces.""" parser = expression_parser.EventFilterExpressionParser() expression = parser.Parse('(a is 3)') self.assertIsNotNone(expression) # Need to close braces. with self.assertRaises(errors.ParseError): parser.Parse('(a is 3') # Need to open braces to close them. with self.assertRaises(errors.ParseError): parser.Parse('a is 3)')
def testStringEscape(self): """Tests the _StringEscape function.""" parser = expression_parser.EventFilterExpressionParser() parser._Reset() parser._StringStart() self.assertEqual(parser._string, '') match = re.compile(r'\\(.)').match('\\n') next_state = parser._StringEscape(string='\\n', match=match) self.assertIsNone(next_state) self.assertEqual(parser._string, '\n') with self.assertRaises(errors.ParseError): match = re.compile(r'\\(.)').match('\\q') parser._StringEscape(string='\\q', match=match)
def CompileFilter(self, filter_expression): """Compiles the filter expression. The filter expression contains an object filter expression. Args: filter_expression (str): filter expression. Raises: ParseError: if the filter expression cannot be parsed. """ parser = expression_parser.EventFilterExpressionParser() expression = parser.Parse(filter_expression) self._event_filter = expression.Compile() self._filter_expression = filter_expression
def _CheckIfExpressionMatches( self, expression, event, event_data, event_tag, expected_result): """Checks if the event filter expression matches the event values. Args: expression (str): event filter expression. event (EventObject): event. event_data (EventData): event data. event_tag (EventTag): event tag. expected_result (bool): expected result. """ parser = expression_parser.EventFilterExpressionParser() expression = parser.Parse(expression) event_filter = expression.Compile() result = event_filter.Matches(event, event_data, event_tag) self.assertEqual(expected_result, result)
def testParse(self): """Tests the Parse function.""" parser = expression_parser.EventFilterExpressionParser() # Arguments are either int, float or quoted string. expression = parser.Parse('attribute == 1') self.assertIsNotNone(expression) expression = parser.Parse('attribute == 0x10') self.assertIsNotNone(expression) with self.assertRaises(errors.ParseError): parser.Parse('attribute == 1a') expression = parser.Parse('attribute == 1.2') self.assertIsNotNone(expression) expression = parser.Parse('attribute == \'bla\'') self.assertIsNotNone(expression) expression = parser.Parse('attribute == "bla"') self.assertIsNotNone(expression) with self.assertRaises(errors.ParseError): parser.Parse('something == red') # Test expression starting with AND. with self.assertRaises(errors.ParseError): parser.Parse('and something is \'Blue\'') # Test incorrect usage of NOT. with self.assertRaises(errors.ParseError): parser.Parse('attribute not == \'dancer\'') with self.assertRaises(errors.ParseError): parser.Parse('attribute == not \'dancer\'') with self.assertRaises(errors.ParseError): parser.Parse('attribute not not equals \'dancer\'') with self.assertRaises(errors.ParseError): parser.Parse('attribute not > 23') # Test double negative matching. with self.assertRaises(errors.ParseError): parser.Parse('filename not not contains \'GoodFella\'')
def testParseWithHexadecimalEscaping(self): """Tests the Parse function with hexadecimal escaping.""" parser = expression_parser.EventFilterExpressionParser() # Instead, this is what one should write. expression = parser.Parse(r'a is "\\xJZ"') self.assertEqual(expression.args[0], r'\xJZ') # Standard hex-escape. expression = parser.Parse('a is "\x41\x41\x41"') self.assertEqual(expression.args[0], 'AAA') # Hex-escape + a character. expression = parser.Parse('a is "\x414"') self.assertEqual(expression.args[0], 'A4') # How to include r'\x41'. expression = parser.Parse('a is "\\x41"') self.assertEqual(expression.args[0], '\x41') # This fails as it's not really a hex escaped string. with self.assertRaises(errors.ParseError): parser.Parse(r'a is "\xJZ"')
def testNoOperation(self): """Tests the _NoOperation function.""" parser = expression_parser.EventFilterExpressionParser() parser._NoOperation()
def testReset(self): """Tests the _Reset function.""" parser = expression_parser.EventFilterExpressionParser() parser._Reset()
def testDefault(self): """Tests the Default function.""" parser = expression_parser.EventFilterExpressionParser() parser.Default()