@pytest.mark.parametrize('malicious, rule', [("os.system('cat /etc/passwd')", 'process_spawn_in_setup'), ("os.popen('cat /etc/passwd')", 'process_spawn_in_setup'), ("os.popen3('cat /etc/passwd')", 'process_spawn_in_setup'), ("os.spawn('cat /etc/passwd')", 'process_spawn_in_setup'), ("os.spawnve('cat /etc/passwd')", 'process_spawn_in_setup'), ("os.posix_spawn('cat /etc/passwd')", 'process_spawn_in_setup'), ("os.posix_spawnp('cat /etc/passwd')", 'process_spawn_in_setup'), ("os.exec('malicious_code')", 'process_spawn_in_setup:metaprogramming_in_setup'), ("os.execve('malicious_code')", 'process_spawn_in_setup'), ("\n            from os import *\n            system('cat /etc/passwd')\n            ", 'process_spawn_in_setup'), ("\n            from os import path, system\n            system('cat /etc/passwd')\n            ", 'process_spawn_in_setup'), ("\n            from os import system\n            system('cat /etc/passwd')\n            ", 'process_spawn_in_setup'), ("\n            from os import popen\n            popen('cat /etc/passwd')\n            ", 'process_spawn_in_setup'), ("\n            from os import popen3\n            popen3('cat /etc/passwd')\n            ", 'process_spawn_in_setup'), ("\n            from os import spawn\n            spawn('cat /etc/passwd')\n            ", 'process_spawn_in_setup'), ("\n            from os import spawnve\n            spawnve('cat /etc/passwd')\n            ", 'process_spawn_in_setup'), ("\n            from os import posix_spawn\n            posix_spawn('cat /etc/passwd')\n            ", 'process_spawn_in_setup'), ("\n            from os import posix_spawnp\n            posix_spawnp('cat /etc/passwd')\n            ", 'process_spawn_in_setup'), ("\n            from os import exec\n            exec('cat /etc/passwd')\n            ", 'process_spawn_in_setup:metaprogramming_in_setup'), ("\n            from os import execve\n            execve('cat /etc/passwd')\n            ", 'process_spawn_in_setup'), ("subprocess.run('...')", 'subprocess_in_setup'), ("subprocess.Popen('...')", 'subprocess_in_setup'), ("subprocess.call('...')", 'subprocess_in_setup'), ("subprocess.check_call('...')", 'subprocess_in_setup'), ("subprocess.check_output('...')", 'subprocess_in_setup'), ("\n            from subprocess import run\n            run('...')\n            ", 'subprocess_in_setup'), ("\n            from subprocess import Popen\n            Popen('...')\n            ", 'subprocess_in_setup'), ("\n            from subprocess import call\n            call('...')\n            ", 'subprocess_in_setup'), ("\n            from subprocess import check_call\n            check_call('...')\n            ", 'subprocess_in_setup'), ("\n            from subprocess import check_output\n            check_output('...')\n            ", 'subprocess_in_setup'), ('from socket import something', 'networking_in_setup'), ('from socket.something import something', 'networking_in_setup'), ('import socket', 'networking_in_setup'), ('from socketserver import something', 'networking_in_setup'), ('from socketserver.something import something', 'networking_in_setup'), ('import socketserver', 'networking_in_setup'), ('from ssl import something', 'networking_in_setup'), ('from ssl.something import something', 'networking_in_setup'), ('import ssl', 'networking_in_setup'), ('from ftplib import something', 'networking_in_setup'), ('from http.something import something', 'networking_in_setup'), ('import http', 'networking_in_setup'), ('import http', 'networking_in_setup'), ('from urllib import something', 'networking_in_setup'), ('from urllib.something import something', 'networking_in_setup'), ('import urllib', 'networking_in_setup'), ('from xmlrpc import something', 'networking_in_setup'), ('from xmlrpc.something import something', 'networking_in_setup'), ('import xmlrpc', 'networking_in_setup'), ('from pickle import something', 'deserialization_in_setup'), ('from pickle.something import something', 'deserialization_in_setup'), ('import pickle', 'deserialization_in_setup'), ('from base64 import something', 'deserialization_in_setup'), ('from base64.something import something', 'deserialization_in_setup'), ('import base64', 'deserialization_in_setup'), ('from binhex import something', 'deserialization_in_setup'), ('from binhex.something import something', 'deserialization_in_setup'), ('import binhex', 'deserialization_in_setup'), ('from inspect import something', 'metaprogramming_in_setup'), ('from inspect.something import something', 'metaprogramming_in_setup'), ('import inspect', 'metaprogramming_in_setup'), ('from compileall import something', 'metaprogramming_in_setup'), ('from compileall.something import something', 'metaprogramming_in_setup'), ('import compileall', 'metaprogramming_in_setup'), ('from py_compile import something', 'metaprogramming_in_setup'), ('from py_compile.something import something', 'metaprogramming_in_setup'), ('import py_compile', 'metaprogramming_in_setup'), ('from builtins import something', 'metaprogramming_in_setup'), ('from builtins.something import something', 'metaprogramming_in_setup'), ('import builtins', 'metaprogramming_in_setup'), ('__builtins__.bla', 'metaprogramming_in_setup'), ('from importlib import something', 'metaprogramming_in_setup'), ('from importlib.something import something', 'metaprogramming_in_setup'), ('import importlib', 'metaprogramming_in_setup'), ("__import__('bla')", 'metaprogramming_in_setup'), ('from sys import modules, path', 'metaprogramming_in_setup'), ('from sys import path, modules', 'metaprogramming_in_setup'), ('import sys.modules', 'metaprogramming_in_setup'), ("compile('malicious')", 'metaprogramming_in_setup'), ('dir(someobject)', 'metaprogramming_in_setup'), ('someobject.__dir__()', 'metaprogramming_in_setup'), ("eval('malicious')", 'metaprogramming_in_setup'), ("exec('malicious')", 'metaprogramming_in_setup'), ("getattr(someobject, 'attr')", 'metaprogramming_in_setup'), ('vars(someobject)', 'metaprogramming_in_setup'), ('someobject.__dict__()', 'metaprogramming_in_setup'), ('globals()', 'metaprogramming_in_setup'), ('locals()', 'metaprogramming_in_setup'), ('chr(42)', 'metaprogramming_in_setup'), ("ord('x')", 'metaprogramming_in_setup'), ("\n            import os as evil\n            evil.system('cat /etc/passwd')\n            ", 'process_spawn_in_setup'), ("\n            import os\n            evil = os\n            evil.system('cat /etc/passwd')\n            ", 'process_spawn_in_setup'), ('\n            import os\n            hof = lambda evil, scary : evil(scary)\n            hof(os.system, "cat /etc/passwd")\n            ', 'process_spawn_in_setup'), ("\n            import os as evil\n            evil.popen('cat /etc/passwd')\n            ", 'process_spawn_in_setup'), ("\n            import os\n            evil = os\n            evil.popen('cat /etc/passwd')\n            ", 'process_spawn_in_setup'), ("\n            import os as evil\n            evil.popen3('cat /etc/passwd')\n            ", 'process_spawn_in_setup'), ("\n            import os\n            evil = os\n            evil.popen3('cat /etc/passwd')\n            ", 'process_spawn_in_setup'), ("\n            import os as evil\n            evil.spawn('cat /etc/passwd')\n            ", 'process_spawn_in_setup'), ("\n            import os\n            evil = os\n            evil.spawn('cat /etc/passwd')\n            ", 'process_spawn_in_setup'), ("\n            import os as evil\n            evil.spawnve('cat /etc/passwd')\n            ", 'process_spawn_in_setup'), ("\n            import os\n            evil = os\n            evil.spawnve('cat /etc/passwd')\n            ", 'process_spawn_in_setup'), ("\n            import os as evil\n            evil.posix_spawn('cat /etc/passwd')\n            ", 'process_spawn_in_setup'), ("\n            import os\n            evil = os\n            evil.posix_spawn('cat /etc/passwd')\n            ", 'process_spawn_in_setup'), ("\n            import os as evil\n            evil.posix_spawnp('cat /etc/passwd')\n            ", 'process_spawn_in_setup'), ("\n            import os\n            evil = os\n            evil.posix_spawnp('cat /etc/passwd')\n            ", 'process_spawn_in_setup'), ("\n            import os as evil\n            evil.exec('malicious_code')\n            ", 'process_spawn_in_setup:metaprogramming_in_setup'), ("\n            import os\n            evil = os\n            evil.exec('malicious_code')\n            ", 'process_spawn_in_setup:metaprogramming_in_setup'), ("\n            import os as evil\n            evil.execve('malicious_code')\n            ", 'process_spawn_in_setup'), ("\n            import os\n            evil = os\n            evil.execve('malicious_code')\n            ", 'process_spawn_in_setup'), ("\n            import subprocess as evil\n            evil.run('...')\n            ", 'subprocess_in_setup'), ("\n            import subprocess\n            evil = subprocess\n            evil.run('...')\n            ", 'subprocess_in_setup'), ("\n            import subprocess as evil\n            evil.Popen('...')\n            ", 'subprocess_in_setup'), ("\n            import subprocess\n            evil = subprocess\n            evil.Popen('...')\n            ", 'subprocess_in_setup'), ("\n            import subprocess as evil\n            evil.call('...')\n            ", 'subprocess_in_setup'), ("\n            import subprocess\n            evil = subprocess\n            evil.call('...')\n            ", 'subprocess_in_setup'), ("\n            import subprocess as evil\n            evil.check_call('...')\n            ", 'subprocess_in_setup'), ("\n            import subprocess\n            evil = subprocess\n            evil.check_call('...')\n            ", 'subprocess_in_setup'), ("\n            import subprocess as evil\n            evil.check_output('...')\n            ", 'subprocess_in_setup'), ("\n            import subprocess\n            evil = subprocess\n            evil.check_output('...')\n            ", 'subprocess_in_setup'), ("\n            hof = lambda evil : evil('malicious')\n            hof(compile)\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil, scary : evil(scary)\n            hof(compile, 'malicious')\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil, scary : scary(evil)\n            hof('malicious', compile)\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil, scary : scary(evil)\n            hof('malicious',compile)\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil : evil[0]('malicious')\n            hof([compile])\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil, scary : evil[0](scary)\n            hof([compile], 'malicious')\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil, scary : scary[0](evil)\n            hof('malicious', [compile])\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil : evil['mean']('malicious')\n            hof({'mean' : compile})\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil : evil['mean']('malicious')\n            hof({'mean':compile})\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil : list(evil.keys())[0]('malicious')\n            hof({compile:'bad'})\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil : list(evil.keys())[0]('malicious')\n            hof({compile : 'bad'})\n            ", 'metaprogramming_in_setup'), ('\n            hof = lambda evil : evil(someobject)\n            hof(dir)\n            ', 'metaprogramming_in_setup'), ('\n            hof = lambda evil, scary : evil(scary)\n            hof(dir, someobject)\n            ', 'metaprogramming_in_setup'), ('\n            hof = lambda evil, scary : scary(evil)\n            hof(someobject, dir)\n            ', 'metaprogramming_in_setup'), ('\n            hof = lambda evil, scary : scary(evil)\n            hof(someobject,dir)\n            ', 'metaprogramming_in_setup'), ('\n            hof = lambda evil : evil[0](someobject)\n            hof([dir])\n            ', 'metaprogramming_in_setup'), ('\n            hof = lambda evil, scary : evil[0](scary)\n            hof([dir], someobject)\n            ', 'metaprogramming_in_setup'), ('\n            hof = lambda evil, scary : scary[0](evil)\n            hof(someobject, [dir])\n            ', 'metaprogramming_in_setup'), ("\n            hof = lambda evil : evil['mean'](someobject)\n            hof({'mean' : dir})\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil : evil['mean'](someobject)\n            hof({'mean':dir})\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil : list(evil.keys())[0](someobject)\n            hof({dir:'bad'})\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil : list(evil.keys())[0](someobject)\n            hof({dir : 'bad'})\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil : evil('malicious')\n            hof(eval)\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil, scary : evil(scary)\n            hof(eval, 'malicious')\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil, scary : scary(evil)\n            hof('malicious', eval)\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil, scary : scary(evil)\n            hof('malicious',eval)\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil : evil[0]('malicious')\n            hof([eval])\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil, scary : evil[0](scary)\n            hof([eval], 'malicious')\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil, scary : scary[0](evil)\n            hof('malicious', [eval])\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil : evil['mean']('malicious')\n            hof({'mean' : eval})\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil : evil['mean']('malicious')\n            hof({'mean':eval})\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil : list(evil.keys())[0]('malicious')\n            hof({eval:'bad'})\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil : list(evil.keys())[0]('malicious')\n            hof({eval : 'bad'})\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil : evil('malicious')\n            hof(exec)\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil, scary : evil(scary)\n            hof(exec, 'malicious')\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil, scary : scary(evil)\n            hof('malicious', exec)\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil, scary : scary(evil)\n            hof('malicious',exec)\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil : evil[0]('malicious')\n            hof([exec])\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil, scary : evil[0](scary)\n            hof([exec], 'malicious')\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil, scary : scary[0](evil)\n            hof('malicious', [exec])\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil : evil['mean']('malicious')\n            hof({'mean' : exec})\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil : evil['mean']('malicious')\n            hof({'mean':exec})\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil : list(evil.keys())[0]('malicious')\n            hof({exec:'bad'})\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil : list(evil.keys())[0]('malicious')\n            hof({exec: 'bad'})\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil : evil(someobject, 'attr')\n            hof(getattr)\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil, scary, unkind : evil(scary, unkind)\n            hof(getattr, someobject, 'attr')\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda unkind, evil, scary : scary(evil, unkind)\n            hof('attr', someobject, getattr)\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda unkind, evil, scary : scary(evil, unkind)\n            hof('attr', someobject,getattr)\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil : evil[0](someobject, 'attr')\n            hof([getattr])\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil, scary, unkind : evil[0](scary, unkind)\n            hof([getattr], someobject, 'attr')\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda unkind, evil, scary : scary[0](evil, unkind)\n            hof('attr', someobject, [getattr])\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil : evil['mean'](someobject, 'attr')\n            hof({'mean' : getattr})\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil : evil['mean'](someobject, 'attr')\n            hof({'mean':getattr})\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil : list(evil.keys())[0](someobject, 'attr')\n            hof({getattr:'bad'})\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil : list(evil.keys())[0](someobject, 'attr')\n            hof({getattr : 'bad'})\n            ", 'metaprogramming_in_setup'), ('\n            hof = lambda evil : evil(someobject)\n            hof(vars)\n            ', 'metaprogramming_in_setup'), ('\n            hof = lambda evil, scary : evil(scary)\n            hof(vars, someobject)\n            ', 'metaprogramming_in_setup'), ('\n            hof = lambda evil, scary : scary(evil)\n            hof(someobject, vars)\n            ', 'metaprogramming_in_setup'), ('\n            hof = lambda evil, scary : scary(evil)\n            hof(someobject,vars)\n            ', 'metaprogramming_in_setup'), ('\n            hof = lambda evil : evil[0](someobject)\n            hof([vars])\n            ', 'metaprogramming_in_setup'), ('\n            hof = lambda evil, scary : evil[0](scary)\n            hof([vars], someobject)\n            ', 'metaprogramming_in_setup'), ('\n            hof = lambda evil, scary : scary[0](evil)\n            hof(someobject, [vars])\n            ', 'metaprogramming_in_setup'), ("\n            hof = lambda evil : evil['mean'](someobject)\n            hof({'mean' : vars})\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil : evil['mean'](someobject)\n            hof({'mean':vars})\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil : list(evil.keys())[0](someobject)\n            hof({vars:'bad'})\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil : list(evil.keys())[0](someobject)\n            hof({vars : 'bad'})\n            ", 'metaprogramming_in_setup'), ('\n            hof = lambda evil : evil()\n            hof(globals)\n            ', 'metaprogramming_in_setup'), ('\n            hof = lambda evil, _scary : evil()\n            hof(globals, None)\n            ', 'metaprogramming_in_setup'), ('\n            hof = lambda _evil, scary : scary()\n            hof(None, globals)\n            ', 'metaprogramming_in_setup'), ('\n            hof = lambda _evil, scary : scary()\n            hof(None,globals)\n            ', 'metaprogramming_in_setup'), ('\n            hof = lambda evil : evil[0]()\n            hof([globals])\n            ', 'metaprogramming_in_setup'), ("\n            hof = lambda evil : evil['mean']()\n            hof({'mean' : globals})\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil : evil['mean']()\n            hof({'mean':globals})\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil : list(evil.keys())[0]()\n            hof({globals:'bad'})\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil : list(evil.keys())[0]()\n            hof({globals : 'bad'})\n            ", 'metaprogramming_in_setup'), ('\n            hof = lambda evil : evil()\n            hof(locals)\n            ', 'metaprogramming_in_setup'), ('\n            hof = lambda evil, _scary : evil()\n            hof(locals, None)\n            ', 'metaprogramming_in_setup'), ('\n            hof = lambda _evil, scary : scary()\n            hof(None, locals)\n            ', 'metaprogramming_in_setup'), ('\n            hof = lambda _evil, scary : scary()\n            hof(None,locals)\n            ', 'metaprogramming_in_setup'), ('\n            hof = lambda evil : evil[0]()\n            hof([locals])\n            ', 'metaprogramming_in_setup'), ("\n            hof = lambda evil : evil['mean']()\n            hof({'mean' : locals})\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil : evil['mean']()\n            hof({'mean':locals})\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil : list(evil.keys())[0]()\n            hof({locals:'bad'})\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil : list(evil.keys())[0]()\n            hof({locals : 'bad'})\n            ", 'metaprogramming_in_setup')])
def test_scan_matched_content(db_session, monkeypatch, malicious, rule):
    monkeypatch.setattr(c, 'fetch_url_content', pretend.call_recorder((lambda *a: pretend.stub())))
    monkeypatch.setattr(c, 'extract_file_content', pretend.call_recorder((lambda *a: (b'this looks suspicious:\n' + malicious.encode('utf-8')))))
    MalwareCheckFactory.create(name='SetupPatternCheck', state=MalwareCheckState.Enabled)
    check = c.SetupPatternCheck(db_session)
    file = FileFactory.create(packagetype='sdist')
    check.scan(obj=file, file_url=pretend.stub())
    assert (len(check._verdicts) == 1)
    assert (check._verdicts[0].check_id == check.id)
    assert (check._verdicts[0].file_id == file.id)
    threat_rules = {'process_spawn_in_setup', 'subprocess_in_setup'}
    if (set(rule.split(':')) & threat_rules):
        assert (check._verdicts[0].classification == VerdictClassification.Threat)
    else:
        assert (check._verdicts[0].classification == VerdictClassification.Indeterminate)
    assert (check._verdicts[0].confidence == VerdictConfidence.High)
    assert (check._verdicts[0].message == rule)
@pytest.mark.parametrize('malicious, rule', [("os.system('cat /etc/passwd')", 'process_spawn_in_setup'), ("os.popen('cat /etc/passwd')", 'process_spawn_in_setup'), ("os.popen3('cat /etc/passwd')", 'process_spawn_in_setup'), ("os.spawn('cat /etc/passwd')", 'process_spawn_in_setup'), ("os.spawnve('cat /etc/passwd')", 'process_spawn_in_setup'), ("os.posix_spawn('cat /etc/passwd')", 'process_spawn_in_setup'), ("os.posix_spawnp('cat /etc/passwd')", 'process_spawn_in_setup'), ("os.exec('malicious_code')", 'process_spawn_in_setup:metaprogramming_in_setup'), ("os.execve('malicious_code')", 'process_spawn_in_setup'), ("\n            from os import *\n            system('cat /etc/passwd')\n            ", 'process_spawn_in_setup'), ("\n            from os import path, system\n            system('cat /etc/passwd')\n            ", 'process_spawn_in_setup'), ("\n            from os import system\n            system('cat /etc/passwd')\n            ", 'process_spawn_in_setup'), ("\n            from os import popen\n            popen('cat /etc/passwd')\n            ", 'process_spawn_in_setup'), ("\n            from os import popen3\n            popen3('cat /etc/passwd')\n            ", 'process_spawn_in_setup'), ("\n            from os import spawn\n            spawn('cat /etc/passwd')\n            ", 'process_spawn_in_setup'), ("\n            from os import spawnve\n            spawnve('cat /etc/passwd')\n            ", 'process_spawn_in_setup'), ("\n            from os import posix_spawn\n            posix_spawn('cat /etc/passwd')\n            ", 'process_spawn_in_setup'), ("\n            from os import posix_spawnp\n            posix_spawnp('cat /etc/passwd')\n            ", 'process_spawn_in_setup'), ("\n            from os import exec\n            exec('cat /etc/passwd')\n            ", 'process_spawn_in_setup:metaprogramming_in_setup'), ("\n            from os import execve\n            execve('cat /etc/passwd')\n            ", 'process_spawn_in_setup'), ("subprocess.run('...')", 'subprocess_in_setup'), ("subprocess.Popen('...')", 'subprocess_in_setup'), ("subprocess.call('...')", 'subprocess_in_setup'), ("subprocess.check_call('...')", 'subprocess_in_setup'), ("subprocess.check_output('...')", 'subprocess_in_setup'), ("\n            from subprocess import run\n            run('...')\n            ", 'subprocess_in_setup'), ("\n            from subprocess import Popen\n            Popen('...')\n            ", 'subprocess_in_setup'), ("\n            from subprocess import call\n            call('...')\n            ", 'subprocess_in_setup'), ("\n            from subprocess import check_call\n            check_call('...')\n            ", 'subprocess_in_setup'), ("\n            from subprocess import check_output\n            check_output('...')\n            ", 'subprocess_in_setup'), ('from socket import something', 'networking_in_setup'), ('from socket.something import something', 'networking_in_setup'), ('import socket', 'networking_in_setup'), ('from socketserver import something', 'networking_in_setup'), ('from socketserver.something import something', 'networking_in_setup'), ('import socketserver', 'networking_in_setup'), ('from ssl import something', 'networking_in_setup'), ('from ssl.something import something', 'networking_in_setup'), ('import ssl', 'networking_in_setup'), ('from ftplib import something', 'networking_in_setup'), ('from http.something import something', 'networking_in_setup'), ('import http', 'networking_in_setup'), ('import http', 'networking_in_setup'), ('from urllib import something', 'networking_in_setup'), ('from urllib.something import something', 'networking_in_setup'), ('import urllib', 'networking_in_setup'), ('from xmlrpc import something', 'networking_in_setup'), ('from xmlrpc.something import something', 'networking_in_setup'), ('import xmlrpc', 'networking_in_setup'), ('from pickle import something', 'deserialization_in_setup'), ('from pickle.something import something', 'deserialization_in_setup'), ('import pickle', 'deserialization_in_setup'), ('from base64 import something', 'deserialization_in_setup'), ('from base64.something import something', 'deserialization_in_setup'), ('import base64', 'deserialization_in_setup'), ('from binhex import something', 'deserialization_in_setup'), ('from binhex.something import something', 'deserialization_in_setup'), ('import binhex', 'deserialization_in_setup'), ('from inspect import something', 'metaprogramming_in_setup'), ('from inspect.something import something', 'metaprogramming_in_setup'), ('import inspect', 'metaprogramming_in_setup'), ('from compileall import something', 'metaprogramming_in_setup'), ('from compileall.something import something', 'metaprogramming_in_setup'), ('import compileall', 'metaprogramming_in_setup'), ('from py_compile import something', 'metaprogramming_in_setup'), ('from py_compile.something import something', 'metaprogramming_in_setup'), ('import py_compile', 'metaprogramming_in_setup'), ('from builtins import something', 'metaprogramming_in_setup'), ('from builtins.something import something', 'metaprogramming_in_setup'), ('import builtins', 'metaprogramming_in_setup'), ('__builtins__.bla', 'metaprogramming_in_setup'), ('from importlib import something', 'metaprogramming_in_setup'), ('from importlib.something import something', 'metaprogramming_in_setup'), ('import importlib', 'metaprogramming_in_setup'), ("__import__('bla')", 'metaprogramming_in_setup'), ('from sys import modules, path', 'metaprogramming_in_setup'), ('from sys import path, modules', 'metaprogramming_in_setup'), ('import sys.modules', 'metaprogramming_in_setup'), ("compile('malicious')", 'metaprogramming_in_setup'), ('dir(someobject)', 'metaprogramming_in_setup'), ('someobject.__dir__()', 'metaprogramming_in_setup'), ("eval('malicious')", 'metaprogramming_in_setup'), ("exec('malicious')", 'metaprogramming_in_setup'), ("getattr(someobject, 'attr')", 'metaprogramming_in_setup'), ('vars(someobject)', 'metaprogramming_in_setup'), ('someobject.__dict__()', 'metaprogramming_in_setup'), ('globals()', 'metaprogramming_in_setup'), ('locals()', 'metaprogramming_in_setup'), ('chr(42)', 'metaprogramming_in_setup'), ("ord('x')", 'metaprogramming_in_setup'), ("\n            import os as evil\n            evil.system('cat /etc/passwd')\n            ", 'process_spawn_in_setup'), ("\n            import os\n            evil = os\n            evil.system('cat /etc/passwd')\n            ", 'process_spawn_in_setup'), ('\n            import os\n            hof = lambda evil, scary : evil(scary)\n            hof(os.system, "cat /etc/passwd")\n            ', 'process_spawn_in_setup'), ("\n            import os as evil\n            evil.popen('cat /etc/passwd')\n            ", 'process_spawn_in_setup'), ("\n            import os\n            evil = os\n            evil.popen('cat /etc/passwd')\n            ", 'process_spawn_in_setup'), ("\n            import os as evil\n            evil.popen3('cat /etc/passwd')\n            ", 'process_spawn_in_setup'), ("\n            import os\n            evil = os\n            evil.popen3('cat /etc/passwd')\n            ", 'process_spawn_in_setup'), ("\n            import os as evil\n            evil.spawn('cat /etc/passwd')\n            ", 'process_spawn_in_setup'), ("\n            import os\n            evil = os\n            evil.spawn('cat /etc/passwd')\n            ", 'process_spawn_in_setup'), ("\n            import os as evil\n            evil.spawnve('cat /etc/passwd')\n            ", 'process_spawn_in_setup'), ("\n            import os\n            evil = os\n            evil.spawnve('cat /etc/passwd')\n            ", 'process_spawn_in_setup'), ("\n            import os as evil\n            evil.posix_spawn('cat /etc/passwd')\n            ", 'process_spawn_in_setup'), ("\n            import os\n            evil = os\n            evil.posix_spawn('cat /etc/passwd')\n            ", 'process_spawn_in_setup'), ("\n            import os as evil\n            evil.posix_spawnp('cat /etc/passwd')\n            ", 'process_spawn_in_setup'), ("\n            import os\n            evil = os\n            evil.posix_spawnp('cat /etc/passwd')\n            ", 'process_spawn_in_setup'), ("\n            import os as evil\n            evil.exec('malicious_code')\n            ", 'process_spawn_in_setup:metaprogramming_in_setup'), ("\n            import os\n            evil = os\n            evil.exec('malicious_code')\n            ", 'process_spawn_in_setup:metaprogramming_in_setup'), ("\n            import os as evil\n            evil.execve('malicious_code')\n            ", 'process_spawn_in_setup'), ("\n            import os\n            evil = os\n            evil.execve('malicious_code')\n            ", 'process_spawn_in_setup'), ("\n            import subprocess as evil\n            evil.run('...')\n            ", 'subprocess_in_setup'), ("\n            import subprocess\n            evil = subprocess\n            evil.run('...')\n            ", 'subprocess_in_setup'), ("\n            import subprocess as evil\n            evil.Popen('...')\n            ", 'subprocess_in_setup'), ("\n            import subprocess\n            evil = subprocess\n            evil.Popen('...')\n            ", 'subprocess_in_setup'), ("\n            import subprocess as evil\n            evil.call('...')\n            ", 'subprocess_in_setup'), ("\n            import subprocess\n            evil = subprocess\n            evil.call('...')\n            ", 'subprocess_in_setup'), ("\n            import subprocess as evil\n            evil.check_call('...')\n            ", 'subprocess_in_setup'), ("\n            import subprocess\n            evil = subprocess\n            evil.check_call('...')\n            ", 'subprocess_in_setup'), ("\n            import subprocess as evil\n            evil.check_output('...')\n            ", 'subprocess_in_setup'), ("\n            import subprocess\n            evil = subprocess\n            evil.check_output('...')\n            ", 'subprocess_in_setup'), ("\n            hof = lambda evil : evil('malicious')\n            hof(compile)\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil, scary : evil(scary)\n            hof(compile, 'malicious')\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil, scary : scary(evil)\n            hof('malicious', compile)\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil, scary : scary(evil)\n            hof('malicious',compile)\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil : evil[0]('malicious')\n            hof([compile])\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil, scary : evil[0](scary)\n            hof([compile], 'malicious')\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil, scary : scary[0](evil)\n            hof('malicious', [compile])\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil : evil['mean']('malicious')\n            hof({'mean' : compile})\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil : evil['mean']('malicious')\n            hof({'mean':compile})\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil : list(evil.keys())[0]('malicious')\n            hof({compile:'bad'})\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil : list(evil.keys())[0]('malicious')\n            hof({compile : 'bad'})\n            ", 'metaprogramming_in_setup'), ('\n            hof = lambda evil : evil(someobject)\n            hof(dir)\n            ', 'metaprogramming_in_setup'), ('\n            hof = lambda evil, scary : evil(scary)\n            hof(dir, someobject)\n            ', 'metaprogramming_in_setup'), ('\n            hof = lambda evil, scary : scary(evil)\n            hof(someobject, dir)\n            ', 'metaprogramming_in_setup'), ('\n            hof = lambda evil, scary : scary(evil)\n            hof(someobject,dir)\n            ', 'metaprogramming_in_setup'), ('\n            hof = lambda evil : evil[0](someobject)\n            hof([dir])\n            ', 'metaprogramming_in_setup'), ('\n            hof = lambda evil, scary : evil[0](scary)\n            hof([dir], someobject)\n            ', 'metaprogramming_in_setup'), ('\n            hof = lambda evil, scary : scary[0](evil)\n            hof(someobject, [dir])\n            ', 'metaprogramming_in_setup'), ("\n            hof = lambda evil : evil['mean'](someobject)\n            hof({'mean' : dir})\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil : evil['mean'](someobject)\n            hof({'mean':dir})\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil : list(evil.keys())[0](someobject)\n            hof({dir:'bad'})\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil : list(evil.keys())[0](someobject)\n            hof({dir : 'bad'})\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil : evil('malicious')\n            hof(eval)\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil, scary : evil(scary)\n            hof(eval, 'malicious')\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil, scary : scary(evil)\n            hof('malicious', eval)\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil, scary : scary(evil)\n            hof('malicious',eval)\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil : evil[0]('malicious')\n            hof([eval])\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil, scary : evil[0](scary)\n            hof([eval], 'malicious')\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil, scary : scary[0](evil)\n            hof('malicious', [eval])\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil : evil['mean']('malicious')\n            hof({'mean' : eval})\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil : evil['mean']('malicious')\n            hof({'mean':eval})\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil : list(evil.keys())[0]('malicious')\n            hof({eval:'bad'})\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil : list(evil.keys())[0]('malicious')\n            hof({eval : 'bad'})\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil : evil('malicious')\n            hof(exec)\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil, scary : evil(scary)\n            hof(exec, 'malicious')\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil, scary : scary(evil)\n            hof('malicious', exec)\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil, scary : scary(evil)\n            hof('malicious',exec)\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil : evil[0]('malicious')\n            hof([exec])\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil, scary : evil[0](scary)\n            hof([exec], 'malicious')\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil, scary : scary[0](evil)\n            hof('malicious', [exec])\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil : evil['mean']('malicious')\n            hof({'mean' : exec})\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil : evil['mean']('malicious')\n            hof({'mean':exec})\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil : list(evil.keys())[0]('malicious')\n            hof({exec:'bad'})\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil : list(evil.keys())[0]('malicious')\n            hof({exec: 'bad'})\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil : evil(someobject, 'attr')\n            hof(getattr)\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil, scary, unkind : evil(scary, unkind)\n            hof(getattr, someobject, 'attr')\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda unkind, evil, scary : scary(evil, unkind)\n            hof('attr', someobject, getattr)\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda unkind, evil, scary : scary(evil, unkind)\n            hof('attr', someobject,getattr)\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil : evil[0](someobject, 'attr')\n            hof([getattr])\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil, scary, unkind : evil[0](scary, unkind)\n            hof([getattr], someobject, 'attr')\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda unkind, evil, scary : scary[0](evil, unkind)\n            hof('attr', someobject, [getattr])\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil : evil['mean'](someobject, 'attr')\n            hof({'mean' : getattr})\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil : evil['mean'](someobject, 'attr')\n            hof({'mean':getattr})\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil : list(evil.keys())[0](someobject, 'attr')\n            hof({getattr:'bad'})\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil : list(evil.keys())[0](someobject, 'attr')\n            hof({getattr : 'bad'})\n            ", 'metaprogramming_in_setup'), ('\n            hof = lambda evil : evil(someobject)\n            hof(vars)\n            ', 'metaprogramming_in_setup'), ('\n            hof = lambda evil, scary : evil(scary)\n            hof(vars, someobject)\n            ', 'metaprogramming_in_setup'), ('\n            hof = lambda evil, scary : scary(evil)\n            hof(someobject, vars)\n            ', 'metaprogramming_in_setup'), ('\n            hof = lambda evil, scary : scary(evil)\n            hof(someobject,vars)\n            ', 'metaprogramming_in_setup'), ('\n            hof = lambda evil : evil[0](someobject)\n            hof([vars])\n            ', 'metaprogramming_in_setup'), ('\n            hof = lambda evil, scary : evil[0](scary)\n            hof([vars], someobject)\n            ', 'metaprogramming_in_setup'), ('\n            hof = lambda evil, scary : scary[0](evil)\n            hof(someobject, [vars])\n            ', 'metaprogramming_in_setup'), ("\n            hof = lambda evil : evil['mean'](someobject)\n            hof({'mean' : vars})\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil : evil['mean'](someobject)\n            hof({'mean':vars})\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil : list(evil.keys())[0](someobject)\n            hof({vars:'bad'})\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil : list(evil.keys())[0](someobject)\n            hof({vars : 'bad'})\n            ", 'metaprogramming_in_setup'), ('\n            hof = lambda evil : evil()\n            hof(globals)\n            ', 'metaprogramming_in_setup'), ('\n            hof = lambda evil, _scary : evil()\n            hof(globals, None)\n            ', 'metaprogramming_in_setup'), ('\n            hof = lambda _evil, scary : scary()\n            hof(None, globals)\n            ', 'metaprogramming_in_setup'), ('\n            hof = lambda _evil, scary : scary()\n            hof(None,globals)\n            ', 'metaprogramming_in_setup'), ('\n            hof = lambda evil : evil[0]()\n            hof([globals])\n            ', 'metaprogramming_in_setup'), ("\n            hof = lambda evil : evil['mean']()\n            hof({'mean' : globals})\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil : evil['mean']()\n            hof({'mean':globals})\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil : list(evil.keys())[0]()\n            hof({globals:'bad'})\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil : list(evil.keys())[0]()\n            hof({globals : 'bad'})\n            ", 'metaprogramming_in_setup'), ('\n            hof = lambda evil : evil()\n            hof(locals)\n            ', 'metaprogramming_in_setup'), ('\n            hof = lambda evil, _scary : evil()\n            hof(locals, None)\n            ', 'metaprogramming_in_setup'), ('\n            hof = lambda _evil, scary : scary()\n            hof(None, locals)\n            ', 'metaprogramming_in_setup'), ('\n            hof = lambda _evil, scary : scary()\n            hof(None,locals)\n            ', 'metaprogramming_in_setup'), ('\n            hof = lambda evil : evil[0]()\n            hof([locals])\n            ', 'metaprogramming_in_setup'), ("\n            hof = lambda evil : evil['mean']()\n            hof({'mean' : locals})\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil : evil['mean']()\n            hof({'mean':locals})\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil : list(evil.keys())[0]()\n            hof({locals:'bad'})\n            ", 'metaprogramming_in_setup'), ("\n            hof = lambda evil : list(evil.keys())[0]()\n            hof({locals : 'bad'})\n            ", 'metaprogramming_in_setup')])
def test_scan_matched_content(db_session, monkeypatch, malicious, rule):
    monkeypatch.setattr(c, 'fetch_url_content', pretend.call_recorder((lambda *a: pretend.stub())))
    monkeypatch.setattr(c, 'extract_file_content', pretend.call_recorder((lambda *a: (b'this looks suspicious:\n' + malicious.encode('utf-8')))))
    MalwareCheckFactory.create(name='SetupPatternCheck', state=MalwareCheckState.Enabled)
    check = c.SetupPatternCheck(db_session)
    file = FileFactory.create(packagetype='sdist')
    check.scan(obj=file, file_url=pretend.stub())
    assert (len(check._verdicts) == 1)
    assert (check._verdicts[0].check_id == check.id)
    assert (check._verdicts[0].file_id == file.id)
    threat_rules = {'process_spawn_in_setup', 'subprocess_in_setup'}
    if (set(rule.split(':')) & threat_rules):
        assert (check._verdicts[0].classification == VerdictClassification.Threat)
    else:
        assert (check._verdicts[0].classification == VerdictClassification.Indeterminate)
    assert (check._verdicts[0].confidence == VerdictConfidence.High)
    assert (check._verdicts[0].message == rule)