From 2f932faa6bd5ff4bf7b73422006fc943d697c079 Mon Sep 17 00:00:00 2001 From: Ruben Sanosh Date: Fri, 31 Jul 2026 15:46:14 -0600 Subject: [PATCH 1/2] Add malformed event-stream fixtures for parser regression --- docs/FIXTURES.md | 16 ++++++++++++++++ fixtures/invalid/invalid_pid.jsonl | 1 + fixtures/invalid/malformed_json.jsonl | 0 fixtures/invalid/missing_required_field.jsonl | 0 tests/test_simulator.py | 16 ++++++++++++++++ 5 files changed, 33 insertions(+) create mode 100644 fixtures/invalid/invalid_pid.jsonl create mode 100644 fixtures/invalid/malformed_json.jsonl create mode 100644 fixtures/invalid/missing_required_field.jsonl diff --git a/docs/FIXTURES.md b/docs/FIXTURES.md index 08d0f67..ebf85be 100644 --- a/docs/FIXTURES.md +++ b/docs/FIXTURES.md @@ -39,6 +39,22 @@ Include at least four cases: For each intentionally altered sample, document the expected rule ID. Always validate a generated JSON report against `schemas/report.schema.json`. +## Invalid event-stream fixtures + +`fixtures/invalid/` contains small JSONL files that are expected to fail +validation in `load_event_stream`. They exist so contributors have reusable, +public examples of the validation boundary instead of only inline test data. + +| File | What's wrong | +|---|---| +| `malformed_json.jsonl` | Not valid JSON (an unquoted object key) | +| `missing_required_field.jsonl` | A required string field (`module`) is empty | +| `invalid_pid.jsonl` | A PID field (`actor_pid`) is negative | + +Each file is used in a parametrized test asserting the specific `InputError` +message it should raise. If you add a new invalid fixture, add a row here and +a corresponding test case. + ## Interpreting findings A cross-view discrepancy is ambiguous by design. Collection timing, permissions, diff --git a/fixtures/invalid/invalid_pid.jsonl b/fixtures/invalid/invalid_pid.jsonl new file mode 100644 index 0000000..9b37aa0 --- /dev/null +++ b/fixtures/invalid/invalid_pid.jsonl @@ -0,0 +1 @@ +{"schema_version": "1.0.0", "scenario": "classic", "flow_id": "invalid-pid-001", "tick": 1, "actor_pid": -1, "target_pid": 4200, "action": "cross_process_handle_open", "module": "synthetic://lab/telemetry-demo.dll", "description": "Synthetic event with a negative actor_pid.", "synthetic": true} \ No newline at end of file diff --git a/fixtures/invalid/malformed_json.jsonl b/fixtures/invalid/malformed_json.jsonl new file mode 100644 index 0000000..e69de29 diff --git a/fixtures/invalid/missing_required_field.jsonl b/fixtures/invalid/missing_required_field.jsonl new file mode 100644 index 0000000..e69de29 diff --git a/tests/test_simulator.py b/tests/test_simulator.py index 7ae44f2..d91cdd8 100644 --- a/tests/test_simulator.py +++ b/tests/test_simulator.py @@ -106,3 +106,19 @@ def test_public_event_fixtures_match_the_built_in_scenarios(scenario, fixture_na fixture = Path(__file__).resolve().parents[1] / "fixtures" / fixture_name assert load_event_stream(fixture) == simulate_scenario(scenario) + + +@pytest.mark.parametrize( + ("fixture_name", "expected_message"), + [ + ("malformed_json.jsonl", "invalid JSONL"), + ("missing_required_field.jsonl", "must be a non-empty string"), + ("invalid_pid.jsonl", "must be a non-negative integer"), + ], +) +def test_invalid_event_fixtures_raise_input_error(fixture_name, expected_message): + """Public invalid fixtures document the validation boundary in load_event_stream.""" + fixture = Path(__file__).resolve().parents[1] / "fixtures" / "invalid" / fixture_name + + with pytest.raises(InputError, match=expected_message): + load_event_stream(fixture) \ No newline at end of file From c0951bcbabb71caa1a439b06f85e61f9aec13722 Mon Sep 17 00:00:00 2001 From: Ruben Sanosh Date: Fri, 31 Jul 2026 15:49:33 -0600 Subject: [PATCH 2/2] Closes #4 Adds fixtures/invalid/ with 3 minimal JSONL fixtures covering: - malformed JSON - a missing/empty required string field - a negative PID field Added a parametrized test asserting the specific InputError message for each fixture, and documented the invalid fixture pack in docs/FIXTURES.md. pytest and ruff check both pass locally. forgot to save --- fixtures/invalid/malformed_json.jsonl | 1 + fixtures/invalid/missing_required_field.jsonl | 1 + 2 files changed, 2 insertions(+) diff --git a/fixtures/invalid/malformed_json.jsonl b/fixtures/invalid/malformed_json.jsonl index e69de29..dad6bd7 100644 --- a/fixtures/invalid/malformed_json.jsonl +++ b/fixtures/invalid/malformed_json.jsonl @@ -0,0 +1 @@ +{"schema_version": "1.0.0", "scenario": "classic", flow_id: "malformed-001", "tick": 1, "actor_pid": 4100, "target_pid": 4200, "action": "cross_process_handle_open", "module": "synthetic://lab/telemetry-demo.dll", "description": "Malformed JSON missing quotes around a key.", "synthetic": true} \ No newline at end of file diff --git a/fixtures/invalid/missing_required_field.jsonl b/fixtures/invalid/missing_required_field.jsonl index e69de29..050c7c8 100644 --- a/fixtures/invalid/missing_required_field.jsonl +++ b/fixtures/invalid/missing_required_field.jsonl @@ -0,0 +1 @@ +{"schema_version": "1.0.0", "scenario": "classic", "flow_id": "missing-field-001", "tick": 1, "actor_pid": 4100, "target_pid": 4200, "action": "cross_process_handle_open", "module": "", "description": "Synthetic event with an empty module field.", "synthetic": true} \ No newline at end of file