Hi team 👋
While exploring the codebase, I noticed a few places where maintainers had left
TODO comments requesting test coverage and input validation that were never
followed up on. I'd like to address all of them in a single focused PR.
What's currently missing
| File |
Issue |
timesketch/lib/analyzers/ntfs_timestomp_test.py |
Test body is self.assertEqual(True, True) — no real assertions |
timesketch/lib/analyzers/domain_test.py |
Only 22 lines, tests class instantiation only |
timesketch/lib/analyzers/feature_extraction_test.py |
Has # TODO: Add tests for the feature extraction with nothing below it |
timesketch/lib/datafinder.py |
Two instances of # TODO: Implement a check if this is a valid ISO formatted date |
Proposed fix
- Replace the NTFS timestomp stub with real behavioral tests covering all branches
of is_suspicious().
- Expand the domain analyzer test file with MockDataStore-based tests (empty stream,
URL extraction, rare domains, CDN detection).
- Add unit tests for
FeatureExtractionSketchPlugin — properties, empty plugin name,
and unregistered plugin error handling.
- Implement ISO 8601 validation in
set_start_date() / set_end_date() using
datetime.fromisoformat(). Validation is non-breaking: invalid dates still get
accepted with a logged warning to preserve backward compatibility.
Happy to discuss any of this before I open the PR. Thanks!
Hi team 👋
While exploring the codebase, I noticed a few places where maintainers had left
TODOcomments requesting test coverage and input validation that were neverfollowed up on. I'd like to address all of them in a single focused PR.
What's currently missing
timesketch/lib/analyzers/ntfs_timestomp_test.pyself.assertEqual(True, True)— no real assertionstimesketch/lib/analyzers/domain_test.pytimesketch/lib/analyzers/feature_extraction_test.py# TODO: Add tests for the feature extractionwith nothing below ittimesketch/lib/datafinder.py# TODO: Implement a check if this is a valid ISO formatted dateProposed fix
of
is_suspicious().URL extraction, rare domains, CDN detection).
FeatureExtractionSketchPlugin— properties, empty plugin name,and unregistered plugin error handling.
set_start_date()/set_end_date()usingdatetime.fromisoformat(). Validation is non-breaking: invalid dates still getaccepted with a logged warning to preserve backward compatibility.
Happy to discuss any of this before I open the PR. Thanks!