diff --git a/tests/data/rules/falco.go b/tests/data/rules/falco.go index 03ab7f0..23c6241 100644 --- a/tests/data/rules/falco.go +++ b/tests/data/rules/falco.go @@ -346,7 +346,7 @@ var FalcoRulesWarnings = run.NewStringFileAccessor( var InvalidAppendMacro = run.NewStringFileAccessor( "invalid_append_macro.yaml", - `- macro: some macro + `- macro: some_macro condition: foo append: true `, @@ -355,10 +355,10 @@ var InvalidAppendMacro = run.NewStringFileAccessor( var InvalidAppendMacroMultipleDocs = run.NewStringFileAccessor( "invalid_append_macro_multiple_docs.yaml", `--- -- macro: some macro +- macro: some_macro condition: evt.type=execve --- -- macro: some macro +- macro: some_macro condition: foo append: true `, @@ -412,7 +412,7 @@ var InvalidArrayItemNotObject = run.NewStringFileAccessor( var InvalidBaseMacro = run.NewStringFileAccessor( "invalid_base_macro.yaml", - `- macro: some macro + `- macro: some_macro condition: evt.type=execve `, ) @@ -552,7 +552,7 @@ var InvalidNotYaml = run.NewStringFileAccessor( var InvalidOverwriteMacro = run.NewStringFileAccessor( "invalid_overwrite_macro.yaml", - `- macro: some macro + `- macro: some_macro condition: foo append: false `, @@ -561,10 +561,10 @@ var InvalidOverwriteMacro = run.NewStringFileAccessor( var InvalidOverwriteMacroMultipleDocs = run.NewStringFileAccessor( "invalid_overwrite_macro_multiple_docs.yaml", `--- -- macro: some macro +- macro: some_macro condition: evt.type=execve --- -- macro: some macro +- macro: some_macro condition: foo append: false `, diff --git a/tests/falco/legacy_test.go b/tests/falco/legacy_test.go index 3a3bf67..62a7434 100644 --- a/tests/falco/legacy_test.go +++ b/tests/falco/legacy_test.go @@ -355,12 +355,12 @@ func TestFalco_Legacy_InvalidAppendMacro(t *testing.T) { assert.NotNil(t, res.RuleValidation().AllErrors(). OfCode("LOAD_ERR_COMPILE_CONDITION"). OfItemType("macro"). - OfItemName("some macro"). + OfItemName("some_macro"). OfMessage("unexpected token after 'execve', expecting 'or', 'and'")) assert.NotNil(t, res.RuleValidation().AllWarnings(). OfCode("LOAD_UNUSED_MACRO"). OfItemType("macro"). - OfItemName("some macro"). + OfItemName("some_macro"). OfMessage("Macro not referred to by any other rule/macro")) assert.Error(t, res.Err(), "%s", res.Stderr()) assert.Equal(t, 1, res.ExitCode()) @@ -532,7 +532,7 @@ func TestFalco_Legacy_InvalidOverwriteMacroMultipleDocs(t *testing.T) { assert.NotNil(t, res.RuleValidation().AllErrors(). OfCode("LOAD_ERR_VALIDATE"). OfItemType("macro"). - OfItemName("some macro"). + OfItemName("some_macro"). OfMessage("Undefined macro 'foo' used in filter.")) assert.Error(t, res.Err(), "%s", res.Stderr()) assert.Equal(t, 1, res.ExitCode()) @@ -1182,7 +1182,7 @@ func TestFalco_Legacy_InvalidAppendMacroMultipleDocs(t *testing.T) { assert.NotNil(t, res.RuleValidation().AllErrors(). OfCode("LOAD_ERR_COMPILE_CONDITION"). OfItemType("macro"). - OfItemName("some macro"). + OfItemName("some_macro"). OfMessage("unexpected token after 'execve', expecting 'or', 'and'")) assert.Error(t, res.Err(), "%s", res.Stderr()) assert.Equal(t, 1, res.ExitCode()) @@ -1456,12 +1456,12 @@ func TestFalco_Legacy_InvalidOverwriteMacro(t *testing.T) { assert.NotNil(t, res.RuleValidation().AllErrors(). OfCode("LOAD_ERR_VALIDATE"). OfItemType("macro"). - OfItemName("some macro"). + OfItemName("some_macro"). OfMessage("Undefined macro 'foo' used in filter.")) assert.NotNil(t, res.RuleValidation().AllWarnings(). OfCode("LOAD_UNUSED_MACRO"). OfItemType("macro"). - OfItemName("some macro"). + OfItemName("some_macro"). OfMessage("Macro not referred to by any other rule/macro")) assert.Error(t, res.Err(), "%s", res.Stderr()) assert.Equal(t, 1, res.ExitCode())