]> git.ipfire.org Git - thirdparty/suricata-verify.git/commitdiff
tests: Support list checks
authorJeff Lucovsky <jlucovsky@oisf.net>
Fri, 28 Mar 2025 16:57:20 +0000 (12:57 -0400)
committerVictor Julien <victor@inliniac.net>
Mon, 7 Apr 2025 20:04:21 +0000 (22:04 +0200)
Support string checks for JSON lists with the new __contains operator that
checks whether a string is contained within a list.

Example
    - JSON list: "ftp":{"reply":["Opening BINARY mode data connection for temp.txt (1164 bytes).","Transfer complete."], }
    - Check: ftp.reply.__contains: 'Transfer complete.'

README.md
run.py

index 3e5b0bf76d6a4fbc64122df0b0766e04c6e7ebef..74a5d6e25eaf019c60cf25803e52d205b467ba49 100644 (file)
--- a/README.md
+++ b/README.md
@@ -177,6 +177,10 @@ checks:
         # Check if a string ends with an expected value
         engine.message.__endswith: "the end of a string"
 
+        # Check if a string is contained within a JSON list.
+        # Eg. "ftp":{"reply":["Opening BINARY mode data connection for temp.txt (1164 bytes).","Transfer complete."], }
+        ftp.reply.__contains: 'Transfer complete.'
+
   - shell:
       # A simple shell check. If the command exits with a non-0 exit code the
       # check will fail. The script is run in the output directory of the
diff --git a/run.py b/run.py
index 8cc3484f5ef6caf20b6b33c7ba96bece73900d18..51f9235f22518fe03c2146d98a143d3139ef6715 100755 (executable)
--- a/run.py
+++ b/run.py
@@ -399,7 +399,7 @@ def find_value(name, obj):
                 return len(obj)
             except:
                 return -1
-        if part in ["__find", "__startswith", "__endswith"]:
+        if part in ["__contains", "__find", "__startswith", "__endswith"]:
             # Return full object, caller will handle the special match logic.
             break
         name = None
@@ -573,6 +573,9 @@ class FilterCheck:
                 if key.endswith("__find"):
                     if val.find(expected) < 0:
                         return False
+                elif key.endswith("__contains"):
+                    if not expected in val:
+                        return False
                 elif key.endswith("__startswith"):
                     if not val.startswith(expected):
                         return False