mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 14:48:21 +00:00
e2b65acc6d
Using file_state_remove() or file_sniff() would previously crash with the spicy-zip file analyzer. We don't have spicy-zip here, so it's not a proper reproducer, but still makes sense to test these events.
22 lines
630 B
JavaScript
22 lines
630 B
JavaScript
/*
|
|
* @TEST-REQUIRES: $SCRIPTS/have-javascript
|
|
* @TEST-EXEC: zeek -b -Cr $TRACES/http/get.trace base/protocols/http ./ext.zeek %INPUT > out
|
|
* @TEST-EXEC: zeek-cut -m fuid uid from_js < files.log > files.log.cut
|
|
* @TEST-EXEC: btest-diff out
|
|
* @TEST-EXEC: btest-diff files.log.cut
|
|
*/
|
|
|
|
zeek.on('file_sniff', (f, meta) => {
|
|
console.log(`file_sniff ${f.id} ${JSON.stringify(meta)}`);
|
|
});
|
|
|
|
zeek.on('file_state_remove', (f) => {
|
|
console.log(`file_state_remove ${f.id}`);
|
|
f.info.from_js = "Hello from JavaScript";
|
|
});
|
|
|
|
@TEST-START-FILE ext.zeek
|
|
redef record Files::Info += {
|
|
from_js: string &log &optional;
|
|
};
|
|
@TEST-END-FILE
|