Skip to content

Commit 8868bde

Browse files
committed
docs: update docs and refine existing test
Signed-off-by: Amine <[email protected]>
1 parent 608f6c9 commit 8868bde

File tree

2 files changed

+8
-4
lines changed

2 files changed

+8
-4
lines changed

src/macaron/malware_analyzer/README.md

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,11 @@ When a heuristic fails, with `HeuristicResult.FAIL`, then that is an indicator b
5252
- **Rule**: Return `HeuristicResult.FAIL` if the major or epoch is abnormally high; otherwise, return `HeuristicResult.PASS`.
5353
- **Dependency**: Will be run if the One Release heuristic fails.
5454

55+
10. **Typosquatting Presence**
56+
- **Description**: Checks if the package name is suspiciously similar to any package name in a predefined list of popular packages. The similarity check incorporates the Jaro-Winkler distance and considers keyboard layout proximity to identify potential typosquatting.
57+
- **Rule**: Return `HeuristicResult.FAIL` if the similarity ratio between the package name and any popular package name meets or exceeds a defined threshold; otherwise, return `HeuristicResult.PASS`.
58+
- **Dependency**: None.
59+
5560
### Contributing
5661

5762
When contributing an analyzer, it must meet the following requirements:
@@ -64,7 +69,7 @@ When contributing an analyzer, it must meet the following requirements:
6469
- Ensure it is assigned to the `problog_result_access` string variable, otherwise it will not be queried and evaluated.
6570
- Assign a rule ID to the rule. This will be used to backtrack to determine if it was triggered.
6671
- Make sure to wrap pass/fail statements in `passed()` and `failed()`. Not doing so may result in undesirable behaviour, see the comments in the model for more details.
67-
- If there are commonly used combinations introduced by adding the heuristic, combine and justify them at the top of the static model (see `quickUndetailed` and `forceSetup` as current examples).
72+
- If there are commonly used combinations introduced by adding the heuristic, combine and justify them at the top of the static model (see `quickUndetailed` and `forceSetup` as current examples).
6873

6974
### Confidence Score Motivation
7075

tests/malware_analyzer/pypi/test_typosquatting_presence.py

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,6 @@
22
# Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl/.
33

44
"""Tests for the TyposquattingPresenceAnalyzer heuristic."""
5-
# pylint: disable=redefined-outer-name
65

76

87
import os
@@ -16,8 +15,8 @@
1615
from macaron.malware_analyzer.pypi_heuristics.metadata.typosquatting_presence import TyposquattingPresenceAnalyzer
1716

1817

19-
@pytest.fixture()
20-
def analyzer(tmp_path: Path) -> TyposquattingPresenceAnalyzer:
18+
@pytest.fixture(name="analyzer")
19+
def analyzer_(tmp_path: Path) -> TyposquattingPresenceAnalyzer:
2120
"""Pytest fixture to create a TyposquattingPresenceAnalyzer instance with a dummy popular packages file."""
2221
# Create a dummy popular packages file.
2322
pkg_file = Path(os.path.join(tmp_path, "popular.txt"))

0 commit comments

Comments
 (0)