Function test_is_suspicious_file

tests/test_archive.py:23–38

(file_path, is_suspicious, fuzzy_rule_match)

    )
)
def test_is_suspicious_file(file_path, is_suspicious, fuzzy_rule_match):
    ret = archive.is_suspicious(pth=file_path, location='something')

    if is_suspicious:
        assert ret is not None
        assert isinstance(ret, Detection)
        match = {
            "type": "SuspiciousArchiveEntry",
            "location": "something",
            "extra": {
                "entry_path": file_path
            }
        }
        assert fuzzy_rule_match(ret, match)
    else:
        assert ret is None


def test_zip_extractor(fixtures):