mirror of
https://github.com/mandiant/capa.git
synced 2025-12-12 15:49:46 -08:00
tests: rules: demonstrate substring with description
This commit is contained in:
@@ -766,6 +766,23 @@ def test_substring_feature():
|
||||
assert (Substring("abc") in children) == True
|
||||
assert (Substring("def") in children) == True
|
||||
assert (Substring("gh\ni") in children) == True
|
||||
|
||||
|
||||
def test_substring_description():
|
||||
rule = textwrap.dedent(
|
||||
"""
|
||||
rule:
|
||||
meta:
|
||||
name: test rule
|
||||
features:
|
||||
- or:
|
||||
- substring: abc
|
||||
description: the start of the alphabet
|
||||
"""
|
||||
)
|
||||
r = capa.rules.Rule.from_yaml(rule)
|
||||
children = list(r.statement.get_children())
|
||||
assert (Substring("abc") in children) == True
|
||||
|
||||
|
||||
def test_regex_values_always_string():
|
||||
|
||||
Reference in New Issue
Block a user