mstoeck3/autopsy-flatpak
1
0
Fork 0
mirror of https://github.com/overcuriousity/autopsy-flatpak.git synced 2025-07-06 21:00:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

some more tests

Browse Source
This commit is contained in:
Greg DiCristofaro 2020-10-01 13:19:33 -04:00
parent 9691646eea
commit 670b52b9b4
5 changed files with 249 additions and 58 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

124
Core/test/unit/src/org/sleuthkit/autopsy/datasourcesummary/datamodel/GetArtifactsTest.java → Core/test/unit/src/org/sleuthkit/autopsy/datasourcesummary/datamodel/DataSourceInfoUtilitiesTest.java
View File

@ -21,6 +21,7 @@ package org.sleuthkit.autopsy.datasourcesummary.datamodel;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Collections;
import java.util.Date;
import java.util.List;
import org.junit.Assert;
import org.junit.Rule;
@ -35,6 +36,7 @@ import org.sleuthkit.datamodel.SleuthkitCase;
import org.sleuthkit.datamodel.TskCoreException;
import org.sleuthkit.autopsy.testutils.TskMockUtils;
import static org.mockito.Mockito.*;
import org.sleuthkit.autopsy.testutils.RandomizationUtils;
import org.sleuthkit.datamodel.BlackboardArtifact.ARTIFACT_TYPE;
import org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE;
import org.sleuthkit.datamodel.BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE;
@ -42,7 +44,7 @@ import org.sleuthkit.datamodel.BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALU
/**
* Unit tests for DataSourceInfoUtilities.getArtifacts
*/
public class GetArtifactsTest {
public class DataSourceInfoUtilitiesTest {
@Rule
public ExpectedException thrown = ExpectedException.none();
@ -145,37 +147,14 @@ public class GetArtifactsTest {
List<BlackboardArtifact> toRet = new ArrayList<>();
for (int i = 0; i < values.size(); i++) {
toRet.add(TskMockUtils.mockArtifact(new BlackboardArtifact.Type(artifactType), 1000 + i, dataSource,
toRet.add(TskMockUtils.getArtifact(new BlackboardArtifact.Type(artifactType), 1000 + i, dataSource,
attrMaker.make(attrType, "TEST SOURCE", values.get(i))));
}
return toRet;
}
/**
* Returns list in 0, n-1, 1, n-2 ... order. Deterministic so same results
* each time, but not in original order.
*
* @return Mixed up list.
*/
private <T> List<T> getMixedUp(List<T> list) {
int forward = 0;
int backward = list.size() - 1;
List<T> newList = new ArrayList<>();
while (forward <= backward) {
newList.add(list.get(forward));
if (forward < backward) {
newList.add(list.get(backward));
}
forward++;
backward--;
}
return newList;
}
/**
* Does a basic test passing a list of generated artifacts in mixed up order
@ -194,11 +173,11 @@ public class GetArtifactsTest {
private <T> void testSorted(ARTIFACT_TYPE artifactType, ATTRIBUTE_TYPE attrType, List<T> values,
AttrMaker<T> attrMaker, SortOrder sortOrder, int count) throws TskCoreException {
DataSource dataSource = TskMockUtils.mockDataSource(1);
DataSource dataSource = TskMockUtils.getDataSource(1);
List<BlackboardArtifact> sortedArtifacts = getArtifacts(artifactType, new BlackboardAttribute.Type(attrType),
dataSource, values, attrMaker);
List<BlackboardArtifact> mixedUpArtifacts = getMixedUp(sortedArtifacts);
List<BlackboardArtifact> mixedUpArtifacts = RandomizationUtils.getMixedUp(sortedArtifacts);
List<BlackboardArtifact> expectedArtifacts = count == 0
? sortedArtifacts
@ -281,11 +260,11 @@ public class GetArtifactsTest {
private <T> void testFailOnBadAttrType(BlackboardArtifact.Type artifactType, BlackboardAttribute.Type attributeType, T val,
AttrMaker<T> attrMaker) throws TskCoreException {
DataSource dataSource = TskMockUtils.mockDataSource(1);
DataSource dataSource = TskMockUtils.getDataSource(1);
List<BlackboardArtifact> artifacts = Arrays.asList(
TskMockUtils.mockArtifact(artifactType, 2, dataSource, attrMaker.make(attributeType, "TEST SOURCE", val)),
TskMockUtils.mockArtifact(artifactType, 3, dataSource, attrMaker.make(attributeType, "TEST SOURCE", val))
TskMockUtils.getArtifact(artifactType, 2, dataSource, attrMaker.make(attributeType, "TEST SOURCE", val)),
TskMockUtils.getArtifact(artifactType, 3, dataSource, attrMaker.make(attributeType, "TEST SOURCE", val))
);
test(artifactType,
dataSource,
@ -319,18 +298,18 @@ public class GetArtifactsTest {
@Test
public void testPurgeAttrNotPresent() throws TskCoreException {
long day = 24 * 60 * 60;
DataSource dataSource = TskMockUtils.mockDataSource(1);
DataSource dataSource = TskMockUtils.getDataSource(1);
BlackboardArtifact.Type ART_TYPE = new BlackboardArtifact.Type(ARTIFACT_TYPE.TSK_PROG_RUN);
BlackboardArtifact mock1 = TskMockUtils.mockArtifact(ART_TYPE, 10, dataSource,
BlackboardArtifact mock1 = TskMockUtils.getArtifact(ART_TYPE, 10, dataSource,
new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_COUNT, "TEST SOURCE", 5),
new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DATETIME, "TEST SOURCE", day));
BlackboardArtifact mock2 = TskMockUtils.mockArtifact(ART_TYPE, 20, dataSource,
BlackboardArtifact mock2 = TskMockUtils.getArtifact(ART_TYPE, 20, dataSource,
new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_COUNT, "TEST SOURCE", 6));
BlackboardArtifact mock3 = TskMockUtils.mockArtifact(ART_TYPE, 30, dataSource,
BlackboardArtifact mock3 = TskMockUtils.getArtifact(ART_TYPE, 30, dataSource,
new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_COUNT, "TEST SOURCE", 7),
new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DATETIME, "TEST SOURCE", 3 * day));
@ -348,18 +327,18 @@ public class GetArtifactsTest {
@Test
public void testMultAttrsPresent() throws TskCoreException {
long day = 24 * 60 * 60;
DataSource dataSource = TskMockUtils.mockDataSource(1);
DataSource dataSource = TskMockUtils.getDataSource(1);
BlackboardArtifact.Type ART_TYPE = new BlackboardArtifact.Type(ARTIFACT_TYPE.TSK_PROG_RUN);
BlackboardArtifact mock1 = TskMockUtils.mockArtifact(ART_TYPE, 10, dataSource,
BlackboardArtifact mock1 = TskMockUtils.getArtifact(ART_TYPE, 10, dataSource,
new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_COUNT, "TEST SOURCE", 7),
new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DATETIME, "TEST SOURCE", day));
BlackboardArtifact mock2 = TskMockUtils.mockArtifact(ART_TYPE, 20, dataSource,
BlackboardArtifact mock2 = TskMockUtils.getArtifact(ART_TYPE, 20, dataSource,
new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_COUNT, "TEST SOURCE", 6));
BlackboardArtifact mock3 = TskMockUtils.mockArtifact(ART_TYPE, 30, dataSource,
BlackboardArtifact mock3 = TskMockUtils.getArtifact(ART_TYPE, 30, dataSource,
new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_COUNT, "TEST SOURCE", 5),
new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DATETIME, "TEST SOURCE", 3 * day));
@ -377,7 +356,7 @@ public class GetArtifactsTest {
@Test
public void testTskCoreExceptionThrown() throws TskCoreException {
test(new BlackboardArtifact.Type(ARTIFACT_TYPE.TSK_ACCOUNT),
TskMockUtils.mockDataSource(1),
TskMockUtils.getDataSource(1),
new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_ACCOUNT_TYPE),
SortOrder.ASCENDING,
0,
@ -390,7 +369,7 @@ public class GetArtifactsTest {
@Test
public void testThrowOnLessThan0() throws TskCoreException {
test(new BlackboardArtifact.Type(ARTIFACT_TYPE.TSK_ACCOUNT),
TskMockUtils.mockDataSource(1),
TskMockUtils.getDataSource(1),
new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_ACCOUNT_TYPE),
SortOrder.ASCENDING,
-1,
@ -403,7 +382,7 @@ public class GetArtifactsTest {
@Test
public void testEmptyListReturned() throws TskCoreException {
test(new BlackboardArtifact.Type(ARTIFACT_TYPE.TSK_ACCOUNT),
TskMockUtils.mockDataSource(1),
TskMockUtils.getDataSource(1),
new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_ACCOUNT_TYPE),
SortOrder.ASCENDING,
0,
@ -412,4 +391,67 @@ public class GetArtifactsTest {
Collections.emptyList(),
null);
}
private interface GetAttrVal<T> {
public T getOrNull(BlackboardArtifact artifact, BlackboardAttribute.Type type);
}
private <T> void testNullAttrValue(String id, GetAttrVal<T> getter, ARTIFACT_TYPE artifactType,
ATTRIBUTE_TYPE attributeType, T nonNullVal)
throws TskCoreException {
BlackboardAttribute.Type attrType = new BlackboardAttribute.Type(attributeType);
BlackboardArtifact.Type artType = new BlackboardArtifact.Type(artifactType);
BlackboardArtifact noAttribute = TskMockUtils.getArtifact(artType, 1000,
TskMockUtils.getDataSource(1), new ArrayList<>());
T nullValue = getter.getOrNull(noAttribute, attrType);
Assert.assertNull(String.format("Expected function %s to return null when no attribute present", id), nullValue);
BlackboardArtifact hasAttribute = TskMockUtils.getArtifact(artType, 1000,
TskMockUtils.getDataSource(1), TskMockUtils.getAttribute(attributeType, nonNullVal));
T valueReceived = getter.getOrNull(hasAttribute, attrType);
Assert.assertEquals(String.format("%s did not return the same value present in the attribute", id), nonNullVal, valueReceived);
}
@Test
public void testGetStringOrNull() throws TskCoreException {
testNullAttrValue("getStringOrNull", DataSourceInfoUtilities::getStringOrNull,
ARTIFACT_TYPE.TSK_ACCOUNT, ATTRIBUTE_TYPE.TSK_ACCOUNT_TYPE, "Skype");
}
@Test
public void testGetIntOrNull() throws TskCoreException {
testNullAttrValue("getIntOrNull", DataSourceInfoUtilities::getIntOrNull,
ARTIFACT_TYPE.TSK_PROG_RUN, ATTRIBUTE_TYPE.TSK_COUNT, 16);
}
@Test
public void testGetLongOrNull() throws TskCoreException {
testNullAttrValue("getLongOrNull", DataSourceInfoUtilities::getLongOrNull,
ARTIFACT_TYPE.TSK_ASSOCIATED_OBJECT, ATTRIBUTE_TYPE.TSK_ASSOCIATED_ARTIFACT, 1001L);
}
@Test
public void testGetDateOrNull() throws TskCoreException {
BlackboardAttribute.Type attrType = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_DATETIME);
BlackboardArtifact.Type artType = new BlackboardArtifact.Type(ARTIFACT_TYPE.TSK_BLUETOOTH_PAIRING);
long dateTime = 24 * 60 * 60 *42;
BlackboardArtifact noAttribute = TskMockUtils.getArtifact(artType, 1000,
TskMockUtils.getDataSource(1), new ArrayList<>());
Date nullValue = DataSourceInfoUtilities.getDateOrNull(noAttribute, attrType);
Assert.assertNull(nullValue);
BlackboardArtifact hasAttribute = TskMockUtils.getArtifact(artType, 1000,
TskMockUtils.getDataSource(1), TskMockUtils.getAttribute(ATTRIBUTE_TYPE.TSK_DATETIME, dateTime));
Date curVal = DataSourceInfoUtilities.getDateOrNull(hasAttribute, attrType);
Assert.assertEquals(dateTime, curVal.getTime() / 1000);
}
}

71
Core/test/unit/src/org/sleuthkit/autopsy/datasourcesummary/datamodel/UserActivitySummaryTests.java → Core/test/unit/src/org/sleuthkit/autopsy/datasourcesummary/datamodel/UserActivitySummaryTest.java
View File

@ -19,17 +19,18 @@
package org.sleuthkit.autopsy.datasourcesummary.datamodel;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
import java.util.Map.Entry;
import java.util.function.Function;
import java.util.stream.Collectors;
import java.util.stream.IntStream;
import org.apache.commons.lang3.tuple.Pair;
import org.junit.Assert;
import static org.junit.Assert.fail;
import org.junit.Rule;
import org.junit.Test;
import org.junit.rules.ExpectedException;
import static org.mockito.ArgumentMatchers.anyInt;
import static org.mockito.ArgumentMatchers.anyLong;
import static org.mockito.Mockito.mock;
@ -58,7 +59,7 @@ import org.sleuthkit.datamodel.TskCoreException;
/**
* Tests for UserActivitySummary.
*/
public class UserActivitySummaryTests {
public class UserActivitySummaryTest {
private interface DataFunction<T> {
List<T> retrieve(UserActivitySummary userActivitySummary, DataSource datasource, int count) throws
@ -128,7 +129,7 @@ public class UserActivitySummaryTests {
UserActivitySummary summary = getTestClass(tskPair.getLeft(), false, null);
try {
funct.retrieve(summary, TskMockUtils.mockDataSource(1), -1);
funct.retrieve(summary, TskMockUtils.getDataSource(1), -1);
} catch (IllegalArgumentException ignored) {
// this exception is expected so continue if getArtifacts never called
verify(tskPair.getRight(), never().description(
@ -180,7 +181,7 @@ public class UserActivitySummaryTests {
int count = 10;
Pair<SleuthkitCase, Blackboard> tskPair = getArtifactsTSKMock(new ArrayList<>());
UserActivitySummary summary = getTestClass(tskPair.getLeft(), false, null);
List<T> retArr = funct.retrieve(summary, TskMockUtils.mockDataSource(dataSourceId), count);
List<T> retArr = funct.retrieve(summary, TskMockUtils.getDataSource(dataSourceId), count);
Assert.assertTrue(String.format("Expected non null empty list returned from %s", id), retArr != null);
Assert.assertTrue(String.format("Expected non null empty list returned from %s", id), retArr.isEmpty());
@ -195,13 +196,59 @@ public class UserActivitySummaryTests {
}
}
// does not contain excluded
// ROOT HUB
// queries correct data sources (i.e. the 3 messages)
// sorted and limited appropriately
private static List<String> EXCLUDED_DEVICES = Arrays.asList("ROOT_HUB", "ROOT_HUB20");
private static BlackboardArtifact getRecentDeviceArtifact(long artifactId, DataSource dataSource,
String deviceId, String deviceMake, String deviceModel, Long date) throws TskCoreException {
return TskMockUtils.getArtifact(new BlackboardArtifact.Type(ARTIFACT_TYPE.TSK_DEVICE_ATTACHED), artifactId, dataSource,
TskMockUtils.getAttribute(ATTRIBUTE_TYPE.TSK_DEVICE_ID, deviceId),
TskMockUtils.getAttribute(ATTRIBUTE_TYPE.TSK_DATETIME, date),
TskMockUtils.getAttribute(ATTRIBUTE_TYPE.TSK_DEVICE_MAKE, deviceMake),
TskMockUtils.getAttribute(ATTRIBUTE_TYPE.TSK_DEVICE_MODEL, deviceModel)
);
}
// public List<UserActivitySummary.TopDomainsResult> getRecentDomains(DataSource dataSource, int count) throws TskCoreException, SleuthkitCaseProvider.SleuthkitCaseProviderException
// public List<UserActivitySummary.TopWebSearchResult> getMostRecentWebSearches(DataSource dataSource, int count) throws SleuthkitCaseProvider.SleuthkitCaseProviderException, TskCoreException
// public List<TopDeviceAttachedResult> getRecentDevices(DataSource dataSource, int count) throws SleuthkitCaseProviderException, TskCoreException
@Test
public void testRecentDevicesFiltering() throws TskCoreException, NoServiceProviderException,
SleuthkitCaseProviderException, TranslationException {
long dataSourceId = 1;
int count = 10;
long time = 24 * 60 * 60 * 42;
String acceptedDevice = "ACCEPTED DEVICE";
DataSource ds = TskMockUtils.getDataSource(dataSourceId);
List<String> allKeys = new ArrayList<>(EXCLUDED_DEVICES);
allKeys.add(acceptedDevice);
List<BlackboardArtifact> artifacts = IntStream.range(0, allKeys.size())
.mapToObj((idx) -> {
String key = allKeys.get(idx);
try {
return getRecentDeviceArtifact(1000L + idx, ds, "ID " + key, "MAKE " + key, key, time);
} catch (TskCoreException ex) {
fail("Unable to create artifacts correctly");
return null;
}
})
.collect(Collectors.toList());
Pair<SleuthkitCase, Blackboard> tskPair = getArtifactsTSKMock(artifacts);
UserActivitySummary summary = getTestClass(tskPair.getLeft(), false, null);
List<TopDeviceAttachedResult> results = summary.getRecentDevices(ds, count);
Assert.assertEquals(1, results.size());
Assert.assertEquals(acceptedDevice, results.get(0).getDeviceModel());
Assert.assertEquals("MAKE " + acceptedDevice, results.get(0).getDeviceMake());
Assert.assertEquals("ID " + acceptedDevice, results.get(0).getDeviceId());
Assert.assertEquals(time, results.get(0).getDateAccessed().getTime() / 1000);
}
@Test
public void testRecentDevicesLimiting() {
}
}

2
Core/test/unit/src/org/sleuthkit/autopsy/discovery/search/DomainSearchTestUtils.java
View File

@ -32,7 +32,7 @@ public class DomainSearchTestUtils {
public static ResultDomain mockDomainResult(String domain, long start, long end,
long totalVisits, long visits, long filesDownloaded, long dataSourceId) {
Content dataSource = TskMockUtils.mockDataSource(dataSourceId);
Content dataSource = TskMockUtils.getDataSource(dataSourceId);
return new ResultDomain(domain, start, end, totalVisits,
visits, filesDownloaded, dataSource);
}

53
Core/test/unit/src/org/sleuthkit/autopsy/testutils/RandomizationUtils.java Normal file
View File

@ -0,0 +1,53 @@
/*
* Autopsy Forensic Browser
*
* Copyright 2020 Basis Technology Corp.
* Contact: carrier <at> sleuthkit <dot> org
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.sleuthkit.autopsy.testutils;
import java.util.ArrayList;
import java.util.List;
/**
* Tools for pseudo-randomization.
*/
public class RandomizationUtils {
/**
* Returns list in 0, n-1, 1, n-2 ... order. Deterministic so same results
* each time, but not in original order.
*
* @return Mixed up list.
*/
public static <T> List<T> getMixedUp(List<T> list) {
int forward = 0;
int backward = list.size() - 1;
List<T> newList = new ArrayList<>();
while (forward <= backward) {
newList.add(list.get(forward));
if (forward < backward) {
newList.add(list.get(backward));
}
forward++;
backward--;
}
return newList;
}
}

57
Core/test/unit/src/org/sleuthkit/autopsy/testutils/TskMockUtils.java
View File

@ -18,9 +18,8 @@
*/
package org.sleuthkit.autopsy.testutils;
import java.lang.reflect.Constructor;
import java.lang.reflect.InvocationTargetException;
import java.util.ArrayList;
import java.util.List;
import java.util.Map;
import java.util.function.Function;
import java.util.logging.ConsoleHandler;
@ -37,6 +36,7 @@ import org.sleuthkit.autopsy.texttranslation.TextTranslationService;
import org.sleuthkit.autopsy.texttranslation.TranslationException;
import org.sleuthkit.datamodel.BlackboardArtifact;
import org.sleuthkit.datamodel.BlackboardAttribute;
import org.sleuthkit.datamodel.BlackboardAttribute.ATTRIBUTE_TYPE;
import org.sleuthkit.datamodel.DataSource;
import org.sleuthkit.datamodel.TskCoreException;
@ -53,7 +53,7 @@ public class TskMockUtils {
*
* @return The mocked datasource.
*/
public static DataSource mockDataSource(long dataSourceId) {
public static DataSource getDataSource(long dataSourceId) {
DataSource dataSource = mock(DataSource.class);
when(dataSource.getName()).thenReturn("");
when(dataSource.getId()).thenReturn(dataSourceId);
@ -74,7 +74,7 @@ public class TskMockUtils {
*
* @throws TskCoreException
*/
public static BlackboardArtifact mockArtifact(BlackboardArtifact.Type artifactType, long artifactId,
public static BlackboardArtifact getArtifact(BlackboardArtifact.Type artifactType, long artifactId,
DataSource dataSource, BlackboardAttribute... attributes) throws TskCoreException {
BlackboardArtifact artifact = mock(BlackboardArtifact.class);
@ -97,6 +97,55 @@ public class TskMockUtils {
when(artifact.getDataSource()).thenReturn(dataSource);
return artifact;
}
public static BlackboardArtifact getArtifact(BlackboardArtifact.Type artifactType, long artifactId,
DataSource dataSource, List<BlackboardAttribute> attributes) throws TskCoreException {
return getArtifact(artifactType, artifactId, dataSource, attributes.toArray(new BlackboardAttribute[attributes.size()]));
}
private static final String DEFAULT_ATTR_SOURCE = "TEST SOURCE";
public static BlackboardAttribute getAttribute(ATTRIBUTE_TYPE attrType, Object value) {
return getAttribute(new BlackboardAttribute.Type(attrType), DEFAULT_ATTR_SOURCE, value);
}
public static BlackboardAttribute getAttribute(BlackboardAttribute.Type attrType, String source, Object value) {
switch (attrType.getValueType()) {
case STRING:
case JSON:
if (value instanceof String) {
return new BlackboardAttribute(attrType, source, (String) value);
}
break;
case DATETIME:
case LONG:
if (value instanceof Long) {
return new BlackboardAttribute(attrType, source, (Long) value);
}
break;
case INTEGER:
if (value instanceof Integer) {
return new BlackboardAttribute(attrType, source, (Integer) value);
}
break;
case DOUBLE:
if (value instanceof Double) {
return new BlackboardAttribute(attrType, source, (Double) value);
}
break;
case BYTE:
if (value instanceof byte[]) {
return new BlackboardAttribute(attrType, source, (byte[]) value);
}
break;
default: throw new IllegalArgumentException(String.format("Unknown attribute value type: %s", attrType.getValueType()));
}
throw new IllegalArgumentException(String.format("Attribute type expected type of %s but received argument of %s", attrType.getValueType(), value));
}
/**
* Returns a mock TextTranslationService.