public void ExpressionMemberAllowListScannerBase_Custom()
{
var cps = new CustomScanner();
foreach (var e in new Expression[] {
(Expression <Func <string, string> >)(s => s.ToLower()),
#pragma warning disable IDE0004 // Remove Unnecessary Cast. (Only unnecessary on C# 10 or later.)
(Expression <Func <Bar> >)(() => new Bar {
Foo = 1
}),
(Expression <Func <List <int> > >)(() => new List <int> {
2
}),
#pragma warning restore IDE0004
})
{
Assert.AreSame(e, cps.Visit(e));
}
foreach (var e in new Expression[] {
(Expression <Func <string, string> >)(s => s.TrimStart()),
#pragma warning disable IDE0004 // Remove Unnecessary Cast. (Only unnecessary on C# 10 or later.)
(Expression <Func <Bar> >)(() => new Bar {
Qux = 1
}),
(Expression <Func <Dictionary <string, int> > >)(() => new Dictionary <string, int> {
{ "bar", 2 }
}),
#pragma warning restore IDE0004
})
{
Assert.ThrowsException <NotSupportedException>(() => cps.Visit(e));
}
}
public void CheckExternalVariableRuleTest()
{
// Initialize yara context
using (YaraContext ctx = new YaraContext())
{
using (var compiler = new Compiler())
{
//must declare this or the compiler will complain it doesn't exist when a rule references it
compiler.DeclareExternalStringVariable("filename");
//declare rule with an external variable available
compiler.AddRuleString("rule foo: bar {strings: $a = \"lmn\" condition: $a and filename matches /\\.txt$/is}");
CompiledRules compiledRules = compiler.Compile();
Assert.True(compiledRules.RuleCount == 1);
Encoding encoding = Encoding.ASCII;
byte[] buffer = encoding.GetBytes("abcdefgjiklmnoprstuvwxyz");
// Initialize a customscanner we can add variables to
var scanner = new CustomScanner(compiledRules);
ExternalVariables externalVariables = new ExternalVariables();
externalVariables.StringVariables.Add("filename", "Alphabet.txt");
List <ScanResult> compiledScanResults = scanner.ScanMemory(ref buffer, externalVariables);
Assert.True(compiledScanResults.Count == 1);
Assert.Equal("foo", compiledScanResults[0].MatchingRule.Identifier);
//release before falling out of the yara context
scanner.Release();
}
}
}
public void ExpressionMemberAllowListScannerBase_Custom()
{
var cps = new CustomScanner();
foreach (var e in new Expression[] {
(Expression <Func <string, string> >)(s => s.ToLower()),
(Expression <Func <Bar> >)(() => new Bar {
Foo = 1
}),
(Expression <Func <List <int> > >)(() => new List <int> {
2
}),
})
{
Assert.AreSame(e, cps.Visit(e));
}
foreach (var e in new Expression[] {
(Expression <Func <string, string> >)(s => s.TrimStart()),
(Expression <Func <Bar> >)(() => new Bar {
Qux = 1
}),
(Expression <Func <Dictionary <string, int> > >)(() => new Dictionary <string, int> {
{ "bar", 2 }
}),
})
{
Assert.ThrowsException <NotSupportedException>(() => cps.Visit(e));
}
}
public void ExpressionTypeAllowListScannerBase_Custom()
{
var cps = new CustomScanner();
foreach (var e in new Expression[]
{
(Expression <Func <DateTime, DateTime> >)(x => x),
(Expression <Func <TimeSpan, TimeSpan> >)(x => x),
})
{
Assert.AreSame(e, cps.Visit(e));
}
foreach (var e in new Expression[]
{
(Expression <Func <Int32, Int32> >)(x => x),
})
{
Assert.ThrowsException <NotSupportedException>(() => cps.Visit(e));
}
}
public void ExpressionTypeAllowListScannerBase_Custom()
{
var cps = new CustomScanner();
foreach (var e in new Expression[]
{
(Expression <Func <DateTime, DateTime> >)(x => x),
(Expression <Func <TimeSpan, TimeSpan> >)(x => x),
})
{
Assert.AreSame(e, cps.Visit(e));
}
foreach (var e in new Expression[]
{
#pragma warning disable IDE0004 // Remove Unnecessary Cast. (Only unnecessary on C# 10 or later.)
(Expression <Func <int, int> >)(x => x),
#pragma warning restore IDE0004
})
{
Assert.ThrowsException <NotSupportedException>(() => cps.Visit(e));
}
}
