diff --git a/src/detections/utils.rs b/src/detections/utils.rs index fa86b628..59f8f2d1 100644 --- a/src/detections/utils.rs +++ b/src/detections/utils.rs @@ -341,9 +341,26 @@ fn _collect_recordinfo<'a>( } } +/** + * 最初の文字を大文字にする関数 + */ +pub fn make_ascii_titlecase(s: &mut str) -> String { + let mut c = s.chars(); + match c.next() { + None => String::new(), + Some(f) => { + if !f.is_ascii() { + s.to_string() + } else { + f.to_uppercase().collect::() + c.as_str() + } + } + } +} + #[cfg(test)] mod tests { - use crate::detections::utils; + use crate::detections::utils::{self, make_ascii_titlecase}; use regex::Regex; use serde_json::Value; @@ -494,4 +511,15 @@ mod tests { assert!(utils::get_serde_number_to_string(&event_record["Event"]["EventData"]).is_none()); } + + #[test] + /// 文字列を与えてascii文字を大文字にするように対応する関数のテスト + fn test_make_ascii_titlecase() { + assert_eq!(make_ascii_titlecase("aaaa".to_string().as_mut()), "Aaaa"); + assert_eq!( + make_ascii_titlecase("i am Test".to_string().as_mut()), + "I am Test" + ); + assert_eq!(make_ascii_titlecase("β".to_string().as_mut()), "β"); + } } diff --git a/src/yaml.rs b/src/yaml.rs index 3d0a19a2..842fb6d2 100644 --- a/src/yaml.rs +++ b/src/yaml.rs @@ -418,7 +418,13 @@ mod tests { let mut yaml = yaml::ParseYaml::new(); let path = Path::new("test_files/rules/yaml"); yaml.read_dir(path, "", &filter::exclude_ids()).unwrap(); - assert_eq!(yaml.exclude_rule_count, 5); + assert_eq!( + yaml.rule_load_status_cnt + .get("excluded") + .unwrap() + .to_owned(), + 5 + ); } #[test] fn test_all_noisy_rules_file() { @@ -427,7 +433,10 @@ mod tests { let mut yaml = yaml::ParseYaml::new(); let path = Path::new("test_files/rules/yaml"); yaml.read_dir(path, "", &filter::exclude_ids()).unwrap(); - assert_eq!(yaml.noisy_rule_count, 5); + assert_eq!( + yaml.rule_load_status_cnt.get("noisy").unwrap().to_owned(), + 5 + ); } #[test] fn test_none_exclude_rules_file() { @@ -437,7 +446,13 @@ mod tests { let path = Path::new("test_files/rules/yaml"); let exclude_ids = RuleExclude::default(); yaml.read_dir(path, "", &exclude_ids).unwrap(); - assert_eq!(yaml.exclude_rule_count, 0); + assert_eq!( + yaml.rule_load_status_cnt + .get("excluded") + .unwrap() + .to_owned(), + 0 + ); } #[test] fn test_exclude_deprecated_rules_file() { @@ -445,6 +460,12 @@ mod tests { let path = Path::new("test_files/rules/deprecated"); let exclude_ids = RuleExclude::default(); yaml.read_dir(path, "", &exclude_ids).unwrap(); - assert_eq!(yaml.deprecate_rule_count, 1); + assert_eq!( + yaml.rule_load_status_cnt + .get("deprecate") + .unwrap() + .to_owned(), + 2 + ); } }