Пример #1
0
 def test_copy_required_exclude_list(self):
     """Skip any file matching the exclude list."""
     exclude_list = ['*.yar', 'skip/these/file*']
     self.assertTrue(clone_rules._copy_required('base.yara', [], exclude_list))
     self.assertTrue(clone_rules._copy_required('path/to/file.yara', [], exclude_list))
     self.assertFalse(clone_rules._copy_required('file.yar', [], exclude_list))
     self.assertFalse(clone_rules._copy_required('skip/these/file.yara', [], exclude_list))
Пример #2
0
 def test_copy_required_no_lists(self):
     """If neither an exclude nor an include list is specified, YARA files should be copied."""
     self.assertTrue(
         clone_rules._copy_required('path/to/file.yar', None, None))
     self.assertTrue(clone_rules._copy_required('path/fo/file.YARA', [],
                                                []))
     self.assertFalse(clone_rules._copy_required('.git/HEAD', None, None))
     self.assertFalse(
         clone_rules._copy_required('path/to/file.txt', None, None))
Пример #3
0
    def test_copy_required_include_and_exclude(self):
        """Test copy required with both an include and exclude list specified."""
        include = ['yara/*', '*_malware_*']
        exclude = ['*mobile*', 'yara/?.yara']

        self.assertTrue(clone_rules._copy_required('yara/packed.yara', include, exclude))
        self.assertTrue(clone_rules._copy_required('base_malware_index.yara', include, exclude))
        self.assertTrue(clone_rules._copy_required('yara/mac_malware.yar', include, exclude))

        self.assertFalse(clone_rules._copy_required('not_included.yara', include, exclude))
        self.assertFalse(clone_rules._copy_required('yara/mobile_malware.yara', include, exclude))
        self.assertFalse(clone_rules._copy_required('yara/A.yara', include, exclude))
Пример #4
0
    def test_copy_required_include_list(self):
        """Only files matching the include list should be copied."""
        include_list = ['path/to/*', '[abc]?/*/file*']

        self.assertTrue(clone_rules._copy_required('path/to/rules.yara', include_list, []))
        self.assertTrue(clone_rules._copy_required(
            'a1/some/long/path/file_apt.yara', include_list, []))
        self.assertTrue(clone_rules._copy_required('b2/malware/file ROOTKIT.YAR', include_list, []))

        self.assertFalse(clone_rules._copy_required('base.yara', include_list, []))
        self.assertFalse(clone_rules._copy_required('path/to/file.txt', include_list, []))
        self.assertFalse(clone_rules._copy_required('a1/file.yara', include_list, []))