1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
|
#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""Tests for the browser search analysis plugin."""
from __future__ import unicode_literals
import unittest
from plaso.analysis import browser_search
from plaso.parsers import sqlite
from tests.analysis import test_lib
class BrowserSearchAnalysisTest(test_lib.AnalysisPluginTestCase):
"""Tests for the browser search analysis plugin."""
def testExamineEventAndCompileReport(self):
"""Tests the ExamineEvent and CompileReport functions."""
parser = sqlite.SQLiteParser()
plugin = browser_search.BrowserSearchPlugin()
storage_writer = self._ParseAndAnalyzeFile(['History'], parser, plugin)
self.assertEqual(storage_writer.number_of_events, 71)
self.assertEqual(len(storage_writer.analysis_reports), 1)
analysis_report = storage_writer.analysis_reports[0]
# Due to the behavior of the join one additional empty string at the end
# is needed to create the last empty line.
expected_text = '\n'.join([
' == ENGINE: Google Search ==',
'1 really really funny cats',
'1 java plugin',
'1 funnycats.exe',
'1 funny cats',
'',
''])
self.assertEqual(analysis_report.text, expected_text)
self.assertEqual(analysis_report.plugin_name, 'browser_search')
expected_keys = set(['Google Search'])
self.assertEqual(set(analysis_report.report_dict.keys()), expected_keys)
if __name__ == '__main__':
unittest.main()
|
