From 25f8c19e3af22c769da059832c5784087d3c08cd Mon Sep 17 00:00:00 2001 From: "google-labs-jules[bot]" <161369871+google-labs-jules[bot]@users.noreply.github.com> Date: Mon, 15 Jun 2026 07:59:20 +0000 Subject: [PATCH 1/2] Test: refactor analyze_strace_output tests - Replace simplistic test input with a realistic, full-format multi-line `strace` log - Add explicit test block for tag deduplication - Switch to using assertCountEqual for comparing kinetic tags to ensure list ordering does not affect assertions Co-authored-by: MnemOnicE <170563909+MnemOnicE@users.noreply.github.com> --- tests/test_main.py | 43 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 43 insertions(+) diff --git a/tests/test_main.py b/tests/test_main.py index e34218f..9cfdbf7 100644 --- a/tests/test_main.py +++ b/tests/test_main.py @@ -99,6 +99,49 @@ def test_sanitize_text_sentinel_fix(self): valid_utf8 = "Привет 世界" self.assertEqual(sanitize_text(valid_utf8), valid_utf8) + def test_analyze_strace_output_realistic(self): + """Test analyze_strace_output with realistic, full-format multi-line strace output.""" + from commando.core.audit import analyze_strace_output + + realistic_strace = ( + "execve(\"/usr/bin/curl\", [\"curl\", \"https://example.com\"], 0x7ffd5e39d7b0 /* 49 vars */) = 0\n" + "brk(NULL) = 0x55df2b6b5000\n" + "arch_prctl(0x3001 /* ARCH_??? */, 0x7ffeeb9a0d80) = -1 EINVAL (Invalid argument)\n" + "access(\"/etc/ld.so.preload\", R_OK) = -1 ENOENT (No such file or directory)\n" + "openat(AT_FDCWD, \"/etc/ld.so.cache\", O_RDONLY|O_CLOEXEC) = 3\n" + "fstat(3, {st_mode=S_IFREG|0644, st_size=104060, ...}) = 0\n" + "mmap(NULL, 104060, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7f2a1b9e2000\n" + "close(3) = 0\n" + "openat(AT_FDCWD, \"/lib/x86_64-linux-gnu/libcurl.so.4\", O_RDONLY|O_CLOEXEC) = 3\n" + "read(3, \"\\177ELF\\2\\1\\1\\0\\0\\0\\0\\0\\0\\0\\0\\0\\3\\0>\\0\\1\\0\\0\\0p\\321\\2\\0\\0\\0\\0\\0\"..., 832) = 832\n" + "fstat(3, {st_mode=S_IFREG|0644, st_size=584608, ...}) = 0\n" + "close(3) = 0\n" + "socket(AF_INET, SOCK_DGRAM|SOCK_CLOEXEC, IPPROTO_IP) = 3\n" + "connect(3, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr(\"8.8.8.8\")}, 16) = 0\n" + "sendto(3, \"\\232\\330\\1\\0\\0\\1\\0\\0\\0\\0\\0\\0\\7example\\3com\\0\\0\\1\\0\\1\", 29, MSG_NOSIGNAL, NULL, 0) = 29\n" + "recvfrom(3, \"\\232\\330\\201\\200\\0\\1\\0\\1\\0\\0\\0\\0\\7example\\3com\\0\\0\\1\\0\\1\\300\\f\"..., 1024, 0, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr(\"8.8.8.8\")}, [28->16]) = 45\n" + "close(3) = 0\n" + "socket(AF_INET, SOCK_STREAM, IPPROTO_TCP) = 3\n" + "connect(3, {sa_family=AF_INET, sin_port=htons(443), sin_addr=inet_addr(\"93.184.216.34\")}, 16) = -1 EINPROGRESS (Operation now in progress)\n" + "write(1, \"\\n\\n

Example Domain\"..., 1256) = 1256\n" + ) + + tags = analyze_strace_output(realistic_strace) + + self.assertCountEqual( + tags, + ["[Process Spawner]", "[File Reader/Writer]", "[Network Mutator]"] + ) + + # Test deduplication - output with many openat but only one tag expected + dedup_strace = ( + "openat(AT_FDCWD, \"/etc/ld.so.cache\", O_RDONLY|O_CLOEXEC) = 3\n" + "openat(AT_FDCWD, \"/lib/x86_64-linux-gnu/libc.so.6\", O_RDONLY|O_CLOEXEC) = 3\n" + "openat(AT_FDCWD, \"/usr/lib/locale/locale-archive\", O_RDONLY|O_CLOEXEC) = 3\n" + ) + tags_dedup = analyze_strace_output(dedup_strace) + self.assertCountEqual(tags_dedup, ["[File Reader/Writer]"]) + @patch("subprocess.run") def test_subprocess_mocking(self, mock_run): """Fortify Test Suite: Mock the subprocess.run calls to deterministically test logic.""" From b4f168c20fc35ffbc083e1d958efda87a21cac1c Mon Sep 17 00:00:00 2001 From: 5Dj3 Date: Mon, 15 Jun 2026 03:01:44 -0500 Subject: [PATCH 2/2] Update tests/test_main.py Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com> --- tests/test_main.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/tests/test_main.py b/tests/test_main.py index 9cfdbf7..898ec36 100644 --- a/tests/test_main.py +++ b/tests/test_main.py @@ -135,9 +135,9 @@ def test_analyze_strace_output_realistic(self): # Test deduplication - output with many openat but only one tag expected dedup_strace = ( - "openat(AT_FDCWD, \"/etc/ld.so.cache\", O_RDONLY|O_CLOEXEC) = 3\n" - "openat(AT_FDCWD, \"/lib/x86_64-linux-gnu/libc.so.6\", O_RDONLY|O_CLOEXEC) = 3\n" - "openat(AT_FDCWD, \"/usr/lib/locale/locale-archive\", O_RDONLY|O_CLOEXEC) = 3\n" + 'openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3\n' + 'openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libc.so.6", O_RDONLY|O_CLOEXEC) = 3\n' + 'openat(AT_FDCWD, "/usr/lib/locale/locale-archive", O_RDONLY|O_CLOEXEC) = 3\n' ) tags_dedup = analyze_strace_output(dedup_strace) self.assertCountEqual(tags_dedup, ["[File Reader/Writer]"])