Skip to content

Resolve inline TODOs: missing analyzer tests and datafinder date validation #3782

@SNO7E-G

Description

@SNO7E-G

Hi team 👋
While exploring the codebase, I noticed a few places where maintainers had left
TODO comments requesting test coverage and input validation that were never
followed up on. I'd like to address all of them in a single focused PR.

What's currently missing

File Issue
timesketch/lib/analyzers/ntfs_timestomp_test.py Test body is self.assertEqual(True, True) — no real assertions
timesketch/lib/analyzers/domain_test.py Only 22 lines, tests class instantiation only
timesketch/lib/analyzers/feature_extraction_test.py Has # TODO: Add tests for the feature extraction with nothing below it
timesketch/lib/datafinder.py Two instances of # TODO: Implement a check if this is a valid ISO formatted date

Proposed fix

  • Replace the NTFS timestomp stub with real behavioral tests covering all branches
    of is_suspicious().
  • Expand the domain analyzer test file with MockDataStore-based tests (empty stream,
    URL extraction, rare domains, CDN detection).
  • Add unit tests for FeatureExtractionSketchPlugin — properties, empty plugin name,
    and unregistered plugin error handling.
  • Implement ISO 8601 validation in set_start_date() / set_end_date() using
    datetime.fromisoformat(). Validation is non-breaking: invalid dates still get
    accepted with a logged warning to preserve backward compatibility.

Happy to discuss any of this before I open the PR. Thanks!

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions