test_scripts: avoid unsupported logic combinations

mandiant · Jun 7, 2024 · 76a4a58 · 76a4a58
1 parent 4d81b7a
commit 76a4a58
Showing 1 changed file with 4 additions and 18 deletions.
diff --git a/tests/test_scripts.py b/tests/test_scripts.py
@@ -130,8 +130,8 @@ def test_detect_duplicate_features(tmpdir):
                           - or:
                             - arch: i386
                             - number: 4
-                            - not:
-                              - count(mnemonic(xor)): 5
+                          - not:
+                            - count(mnemonic(xor)): 5
                           - not:
                             - os: linux
             """
@@ -162,7 +162,7 @@ def test_detect_duplicate_features(tmpdir):
                             static: function
                             dynamic: process
                     features:
-                      - or:
+                      - and:
                         - not:
                           - number: 4
                         - basic block:
@@ -171,19 +171,6 @@ def test_detect_duplicate_features(tmpdir):
                             - number: 2
             """
         ),
-        "rule_4": textwrap.dedent(
-            """
-                rule:
-                    meta:
-                        name: Test Rule 4
-                        scopes:
-                            static: function
-                            dynamic: process
-                    features:
-                      - not:
-                        - string: "expa"
-            """
-        ),
     }
 
     """
@@ -193,11 +180,10 @@ def test_detect_duplicate_features(tmpdir):
         The overlaps are like:
         - Rule 0 has zero overlaps in RULESET
         - Rule 1 overlaps with 3 other rules in RULESET
-        - Rule 4 overlaps with itself in RULESET
         These overlap values indicate the number of rules with which
         each rule in RULESET has overlapping features.
     """
-    rule_overlaps = [0, 4, 3, 3, 1]
+    rule_overlaps = [0, 4, 3, 3]
 
     rule_dir = tmpdir.mkdir("capa_rule_overlap_test")
     rule_paths = []