-
Notifications
You must be signed in to change notification settings - Fork 24.7k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
EQL: Remove "wildcard" function #76099
Changes from 1 commit
783a1d2
97fde83
5a22ca6
b8a65f5
917a835
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -31,7 +31,7 @@ | |
|
||
/** | ||
* EQL wildcard function. Matches the form: | ||
* wildcard(field, "*wildcard*pattern*", ...) | ||
* field like ("*wildcard*pattern*", ...) | ||
*/ | ||
public class Wildcard extends BaseSurrogateFunction { | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. No need to keep this class around. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Thanks. Class removed. |
||
|
||
|
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -205,35 +205,4 @@ public void testStringContainsWrongParams() { | |
assertEquals("1:15: second argument of [stringContains(process_name, 1)] must be [string], found value [1] type [integer]", | ||
error("process where stringContains(process_name, 1)")); | ||
} | ||
|
||
public void testWildcardNotEnoughArguments() { | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Please convert these to There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. These tests become now syntactic failures. One case could however be indeed converted (ex There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. As long as we have equivalent semantical tests, I'm 👍 . Note that wildcard tests that rely on the syntax can be changed to |
||
ParsingException e = expectThrows(ParsingException.class, | ||
() -> plan("process where wildcard(process_name)")); | ||
String msg = e.getMessage(); | ||
assertEquals("line 1:16: error building [wildcard]: expects at least two arguments", msg); | ||
} | ||
|
||
public void testWildcardAgainstVariable() { | ||
VerificationException e = expectThrows(VerificationException.class, | ||
() -> plan("process where wildcard(process_name, parent_process_name)")); | ||
String msg = e.getMessage(); | ||
assertEquals("Found 1 problem\nline 1:15: second argument of [wildcard(process_name, parent_process_name)] " + | ||
"must be a constant, received [parent_process_name]", msg); | ||
} | ||
|
||
public void testWildcardWithNumericPattern() { | ||
VerificationException e = expectThrows(VerificationException.class, | ||
() -> plan("process where wildcard(process_name, 1)")); | ||
String msg = e.getMessage(); | ||
assertEquals("Found 1 problem\n" + | ||
"line 1:15: second argument of [wildcard(process_name, 1)] must be [string], found value [1] type [integer]", msg); | ||
} | ||
|
||
public void testWildcardWithNumericField() { | ||
VerificationException e = expectThrows(VerificationException.class, | ||
() -> plan("process where wildcard(pid, \"*.exe\")")); | ||
String msg = e.getMessage(); | ||
assertEquals("Found 1 problem\n" + | ||
"line 1:15: first argument of [wildcard(pid, \"*.exe\")] must be [string], found value [pid] type [long]", msg); | ||
} | ||
} |
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -411,73 +411,3 @@ description = "Test the `substring` function when the case already matches" | |
[[substring.fold.tests]] | ||
expression = '''substring("hello world", -5, -1)''' | ||
expected = "worl" | ||
|
||
[wildcard] | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. should this one be replaced with There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Yes, file still in use. |
||
description = "Test that `wildcard` folds with correct case matches." | ||
|
||
[[wildcard.fold.tests]] | ||
expression = 'wildcard(null, "f*o*o*")' | ||
# expected = null | ||
|
||
[[wildcard.fold.tests]] | ||
expression = 'wildcard("Foo", "F*o*o*")' | ||
expected = true | ||
|
||
[[wildcard.fold.tests]] | ||
expression = 'wildcard("Foo", "*Foo")' | ||
expected = true | ||
|
||
[[wildcard.fold.tests]] | ||
expression = 'wildcard("Foo", "*Foo*")' | ||
expected = true | ||
|
||
[[wildcard.fold.tests]] | ||
expression = 'wildcard("Foo", "*")' | ||
expected = true | ||
|
||
[[wildcard.fold.tests]] | ||
expression = 'wildcard("Foo", "Bar*")' | ||
expected = false | ||
|
||
[[wildcard.fold.tests]] | ||
expression = 'wildcard("Foo", "*Bar*")' | ||
expected = false | ||
|
||
[[wildcard.fold.tests]] | ||
expression = 'wildcard("Foo", "*Bar*", "Baz*")' | ||
expected = false | ||
|
||
[[wildcard.fold.tests]] | ||
expression = 'wildcard("Foo", "Foo*", "*Bar*", "Baz*")' | ||
expected = true | ||
|
||
[[wildcard.fold.tests]] | ||
expression = 'wildcard("Bar", "Foo*", "*Bar*", "Baz*")' | ||
expected = true | ||
|
||
[[wildcard.fold.tests]] | ||
expression = 'wildcard("Baz", "Foo*", "*Bar*", "Baz*")' | ||
expected = true | ||
|
||
[wildcard_case_insensitive] | ||
description = "Test that `wildcard` function folds case insensitive as expected." | ||
|
||
[[wildcard_case_insensitive.fold.tests]] | ||
expression = 'wildcard("FOO", "f*o*o*")' | ||
expected = false | ||
|
||
[[wildcard_case_insensitive.fold.tests]] | ||
expression = 'wildcard("bar", "f*o*o*")' | ||
expected = false | ||
|
||
|
||
[wildcard_case_sensitive] | ||
description = "Test that `wildcard` folds case-sensitive matches." | ||
|
||
[[wildcard_case_sensitive.fold.tests]] | ||
expression = 'wildcard("Foo", "F*o*o*")' | ||
expected = true | ||
|
||
[[wildcard_case_sensitive.fold.tests]] | ||
expression = 'wildcard("foo", "F*o*o*")' | ||
expected = false |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
should this be replaced with
like
?There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
There's already a
like
test for this (likeMultipleArgWithPattern
).