Function TestEvalAlertContextRules

pkg/alertcontext/alertcontext_test.go:401–445

(t *testing.T)

}

func TestEvalAlertContextRules(t *testing.T) {
	tests := []struct {
		name           string
		contextToSend  map[string][]string
		event          pipeline.Event
		match          pipeline.MatchedRule
		req            *http.Request
		expectedResult map[string][]string
		expectedErrLen int
	}{
		{
			name: "no appsec match",
			contextToSend: map[string][]string{
				"source_ip": {"evt.Parsed.source_ip"},
				"id":        {"match.id"},
			},
			event: pipeline.Event{
				Parsed: map[string]string{
					"source_ip":      "1.2.3.4",
					"source_machine": "mymachine",
					"uri":            "/test/test/test/../../../../../../../../",
				},
			},
			expectedResult: map[string][]string{
				"source_ip": {"1.2.3.4"},
				"id":        {},
			},
		},
	}

	for _, test := range tests {
		t.Run(test.name, func(t *testing.T) {
			contextDict := make(map[string][]string)

			alertContext.Store(nil)
			if err := NewAlertContext(test.contextToSend, 100); err != nil {
				t.Fatalf("failed to compile %s: %s", test.name, err)
			}

			errs := EvalAlertContextRules(test.event, &test.match, test.req, contextDict)
			assert.Len(t, errs, test.expectedErrLen)
			assert.Equal(t, test.expectedResult, contextDict)
		})
	}
}