Repository: mandiant/capa
File: tests/test_rules.py (Python)

Code before:
            )
        )
        is True
    )


def test_translate_com_features():
    r = capa.rules.Rule.from_yaml(
        textwrap.dedent(
            """
            rule:
                meta:
                    name: test rule
                features:
                    - com/class: WICPngDecoder
                    # 389ea17b-5078-4cde-b6ef-25c15175c751 WICPngDecoder
                    # e018945b-aa86-4008-9bd4-6777a1e40c11 WICPngDecoder
            """
        )
    )
    com_name = "WICPngDecoder"
    com_features = [
        capa.features.common.Bytes(b"{\xa1\x9e8xP\xdeL\xb6\xef%\xc1Qu\xc7Q", f"CLSID_{com_name} as bytes"),
        capa.features.common.StringFactory("389ea17b-5078-4cde-b6ef-25c15175c751", f"CLSID_{com_name} as guid string"),
        capa.features.common.Bytes(b"[\x94\x18\xe0\x86\xaa\x08@\x9b\xd4gw\xa1\xe4\x0c\x11", f"IID_{com_name} as bytes"),
        capa.features.common.StringFactory("e018945b-aa86-4008-9bd4-6777a1e40c11", f"IID_{com_name} as guid string"),
    ]
    for child in r.statement.get_children():
        assert child in com_features


def test_invalid_com_features():
    # test for unknown COM class
    with pytest.raises(capa.rules.InvalidRule):
        _ = capa.rules.Rule.from_yaml(
            textwrap.dedent(
                """
                rule:
                    meta:
                        name: test rule
                    features:
                        - com/class: invalid_com
                """
            )
        )

    # test for unknown COM interface
    with pytest.raises(capa.rules.InvalidRule):
        _ = capa.rules.Rule.from_yaml(
            textwrap.dedent(
                """

Review comment (suggestion):
```suggestion
        capa.features.common.Bytes(b"{\xa1\x9e8xP\xdeL\xb6\xef%\xc1Qu\xc7Q", f"CLSID_{com_name} as bytes"),
        capa.features.common.StringFactory("389ea17b-5078-4cde-b6ef-25c15175c751", f"CLSID_{com_name} as GUID string"),
        capa.features.common.Bytes(b"[\x94\x18\xe0\x86\xaa\x08@\x9b\xd4gw\xa1\xe4\x0c\x11", f"IID_{com_name} as bytes"),
        capa.features.common.StringFactory("e018945b-aa86-4008-9bd4-6777a1e40c11", f"IID_{com_name} as GUID string"),
```

Code after:
            )
        )
        is True
    )


def test_translate_com_features():
    r = capa.rules.Rule.from_yaml(
        textwrap.dedent(
            """
            rule:
                meta:
                    name: test rule
                features:
                    - com/class: WICPngDecoder
                    # 389ea17b-5078-4cde-b6ef-25c15175c751 WICPngDecoder
                    # e018945b-aa86-4008-9bd4-6777a1e40c11 WICPngDecoder
            """
        )
    )
    com_name = "WICPngDecoder"
    com_features = [
        capa.features.common.Bytes(b"{\xa1\x9e8xP\xdeL\xb6\xef%\xc1Qu\xc7Q", f"CLSID_{com_name} as bytes"),
        capa.features.common.StringFactory("389ea17b-5078-4cde-b6ef-25c15175c751", f"CLSID_{com_name} as GUID string"),
        capa.features.common.Bytes(b"[\x94\x18\xe0\x86\xaa\x08@\x9b\xd4gw\xa1\xe4\x0c\x11", f"IID_{com_name} as bytes"),
        capa.features.common.StringFactory("e018945b-aa86-4008-9bd4-6777a1e40c11", f"IID_{com_name} as GUID string"),
    ]
    assert set(com_features) == set(r.statement.get_children())


def test_invalid_com_features():
    # test for unknown COM class
    with pytest.raises(capa.rules.InvalidRule):
        _ = capa.rules.Rule.from_yaml(
            textwrap.dedent(
                """
                rule:
                    meta:
                        name: test rule
                    features:
                        - com/class: invalid_com
                """
            )
        )

    # test for unknown COM interface
    with pytest.raises(capa.rules.InvalidRule):
        _ = capa.rules.Rule.from_yaml(
            textwrap.dedent(
                """
                rule: