40 lines
1.2 KiB
Python
40 lines
1.2 KiB
Python
# SPDX-License-Identifier: GPL-3.0-or-later
|
|
"""The `check --json` flag emits a parseable JSON alert array."""
|
|
import io
|
|
import json
|
|
import unittest
|
|
from contextlib import redirect_stdout
|
|
from unittest import mock
|
|
|
|
from enodia_sentinel import cli
|
|
from enodia_sentinel.alert import Alert, Severity
|
|
from enodia_sentinel.config import Config
|
|
|
|
|
|
class _FakeSentinel:
|
|
def __init__(self, cfg):
|
|
self.start_time = 1.0
|
|
self.listener_baseline = {"x"}
|
|
|
|
def load_baselines(self):
|
|
pass
|
|
|
|
def build_baselines(self):
|
|
pass
|
|
|
|
def sweep(self, force_suid=False):
|
|
return [Alert(Severity.HIGH, "rsh", "rsh:1", "reverse shell", sid=1001)]
|
|
|
|
|
|
class TestCheckJson(unittest.TestCase):
|
|
def test_check_json_emits_alert_array(self):
|
|
cfg = Config()
|
|
with mock.patch.object(cli, "Sentinel", _FakeSentinel):
|
|
buf = io.StringIO()
|
|
with redirect_stdout(buf):
|
|
rc = cli._cmd_check(cfg, True)
|
|
self.assertEqual(rc, 0)
|
|
data = json.loads(buf.getvalue())
|
|
self.assertEqual(len(data), 1)
|
|
self.assertEqual(data[0]["signature"], "rsh")
|
|
self.assertEqual(data[0]["sid"], 1001)
|