Function TestGetFileInfo

pkg/filter/util_test.go:32–77

(t *testing.T)

)

func TestGetFileInfo(t *testing.T) {
	path, err := os.Executable()
	require.NoError(t, err)

	var tests = []struct {
		e   *event.Event
		f   func(*testing.T, *event.Event)
		fld fields.Field
	}{
		{
			e: &event.Event{
				Name: "CreateFile",
				Params: map[string]*event.Param{
					params.FilePath: {Name: params.FilePath, Type: params.UnicodeString, Value: path},
				},
			},
			f: func(t *testing.T, e *event.Event) {
				require.True(t, e.Params.MustGetBool(params.FileIsExecutable))
			},
			fld: fields.FileIsExecutable,
		},
		{
			e: &event.Event{
				Name: "CreateFile",
				Params: map[string]*event.Param{
					params.FilePath: {Name: params.FilePath, Type: params.UnicodeString, Value: filepath.Join(os.Getenv("SystemRoot"), "System32", "kernel32.dll")},
				},
			},
			f: func(t *testing.T, e *event.Event) {
				require.True(t, e.Params.MustGetBool(params.FileIsDLL))
			},
			fld: fields.ModuleIsDLL,
		},
	}

	for _, tt := range tests {
		t.Run(tt.e.GetParamAsString(params.FilePath), func(t *testing.T) {
			v, err := getFileInfo(tt.fld, tt.e)
			require.NotNil(t, v)
			require.NoError(t, err)
			if tt.f != nil {
				tt.f(t, tt.e)
			}
		})
	}
}