SentinelAI/tests/test_parser.py at main · yshivamcodes/SentinelAI · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
from backend.core.models import SecurityEvent


def test_parser_returns_events(parser):

    events = parser.parse_file()

    assert len(events) == 3

    assert all(
        isinstance(event, SecurityEvent)
        for event in events
    )


def test_parser_statistics(parser):

    parser.parse_file()

    stats = parser.statistics()

    assert stats["total_logs"] == 4
    assert stats["parsed_logs"] == 3
    assert stats["invalid_logs"] == 1


def test_parse_real_apache_combined_log(parser):

    real_log = (
        '192.168.56.10 - - [08/Aug/2026:08:36:45 +0000] '
        '"GET /DVWA/vulnerabilities/xss_r/?name=%3cscript%3ealert%281%29%3c%2fscript%3e HTTP/1.1" '
        '302 628 "-" "curl/8.20.0"'
    )

    event = parser.parse_line(real_log)

    assert isinstance(event, SecurityEvent)
    assert event.src_ip == "192.168.56.10"
    assert event.method == "GET"
    assert event.url == "/DVWA/vulnerabilities/xss_r/?name=<script>alert(1)</script>"
    assert event.status == 302
    assert event.size == 628
    assert event.protocol == "HTTP/1.1"


def test_parse_url_encoded_xss_query_string(parser):

    encoded_log = (
        '10.0.0.1 - - [08/Aug/2026:10:00:00 +0000] '
        '"GET /search?q=%3Cscript%3Ealert%281%29%3C%2Fscript%3E HTTP/1.1" '
        '200 450 "-" "Mozilla/5.0"'
    )

    event = parser.parse_line(encoded_log)

    assert isinstance(event, SecurityEvent)
    assert event.url == "/search?q=<script>alert(1)</script>"