Skip to content

test: add missing analyzer unit tests and datafinder date validation#3783

Open
SNO7E-G wants to merge 4 commits intogoogle:masterfrom
SNO7E-G:test/analyzer-coverage
Open

test: add missing analyzer unit tests and datafinder date validation#3783
SNO7E-G wants to merge 4 commits intogoogle:masterfrom
SNO7E-G:test/analyzer-coverage

Conversation

@SNO7E-G
Copy link
Copy Markdown

@SNO7E-G SNO7E-G commented Mar 25, 2026

Hi Team 👋
This PR cleans up four TODO comments that have been sitting in the codebase for
a while — all of them asking for test coverage or input validation that was never
implemented. Nothing drastic, just filling in the gaps.
Closes #3782

What's been bothering me (and hopefully you too)

The NTFS timestomp test file had this as its only test:
self.assertEqual(True, True)
The domain test file was 22 lines and only checked that the class could be
instantiated. The feature extraction test file had a TODO comment and nothing
else. And DataFinder was silently accepting any string as a date without
ever checking if it was actually ISO 8601.

What this PR does

ntfs_timestomp_test.py — 5 new behavioral tests for is_suspicious():

  • No std_info_event → returns False
  • Empty file_names → returns False
  • Timestamps within threshold → not flagged, no attributes set
  • Timestamps above threshold → flagged, time_delta / time_deltas set correctly
  • Mixed file names (one within threshold) → detection correctly suppressed
    domain_test.py — 4 new MockDataStore-backed behavioral tests:
  • Empty event stream → graceful early exit with "No domains to analyze."
  • Events with url field (no domain) → correct domain extraction
  • Rare domain threshold → domain counted in result summary
  • Known CDN domain (.cloudfront.net) → reported in CDN network count
    feature_extraction_test.py — 3 new tests for FeatureExtractionSketchPlugin:
  • Getters and setters work for plugin_name, feature_name, feature_config
  • Empty plugin_name → returns "Feature extraction plugin name is empty" cleanly
  • Unregistered plugin name → gracefully returns wrapped ValueError message
    datafinder.py — ISO 8601 date validation:
  • Added _is_valid_iso_date() helper using datetime.fromisoformat()
  • set_start_date() and set_end_date() now log a warning if the input isn't valid
  • Non-breaking: the value is still set regardless, so no existing callers are affected
  • Removes both TODO comments

Checks

@jaegeral
Copy link
Copy Markdown
Collaborator

/gemini review

@SNO7E-G SNO7E-G force-pushed the test/analyzer-coverage branch from 27321bc to 4c92dfd Compare March 26, 2026 14:36
@SNO7E-G
Copy link
Copy Markdown
Author

SNO7E-G commented Mar 26, 2026

@jaegeral
Done! I've fixed all 3 CI failures and pushed the corrected commit

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Resolve inline TODOs: missing analyzer tests and datafinder date validation

2 participants