13 lines
876 B
JavaScript
13 lines
876 B
JavaScript
|
import test from 'node:test';
|
||
|
|
import assert from 'node:assert/strict';
|
||
|
|
import facts from '../packages/core/transfer-facts.cjs';
|
||
|
|
import {toECS,toCEF} from '../packages/core/siem.mjs';
|
||
|
|
test('security file facts carry exact bytes and detected type without arbitrary content',()=>{
|
||
|
|
const file=facts.transferFacts({bytes:123,detectedType:'pe',sha256:'a'.repeat(64)});
|
||
|
|
const e={id:1,time:new Date().toISOString(),kind:'download.block',metadata:{file}};
|
||
|
|
assert.equal(toECS(e).file.size,123);assert.equal(toECS(e).file.type,'pe');assert.match(toCEF(e),/cs6=pe/);
|
||
|
|
assert.throws(()=>facts.transferFacts({...file,password:'forbidden'}));
|
||
|
|
assert.throws(()=>facts.transferFacts({...file,bytes:-1}));
|
||
|
|
e.metadata.file={bytes:123,detectedType:'password=secret',sha256:'a'.repeat(64)};
|
||
|
|
assert.equal(toECS(e).file,undefined);assert.equal(toCEF(e).includes('password=secret'),false);
|
||
|
|
});
|