Add two new functions to ROST grammar: modpath and maxcommon.

1 files changed, 26 insertions, 0 deletions

diff --git a/tests/analysis/scan/functions.py b/tests/analysis/scan/functions.py
index e936263..983b8da 100644
--- a/tests/analysis/scan/functions.py
+++ b/tests/analysis/scan/functions.py
@@ -33,6 +33,32 @@ rule test {
             self.check_rule_success(rule, cnt)
 
 
+    def testMaxCommon(self):
+        """Count the largest quantity of same items in a set."""
+
+        cnt = MemoryContent(b'')
+
+        cases = [
+            [ '1', 1 ],
+            [ '1, 2, 3', 1 ],
+            [ '1, 2, 1, 3, 1', 3 ],
+            [ '1, "a", 2, 3, "a"', 2 ],
+        ]
+
+        for c, q in cases:
+
+            rule = '''
+rule test {
+
+   condition:
+      maxcommon(%s) == %u
+
+}
+''' % (c, q)
+
+            self.check_rule_success(rule, cnt)
+
+
     # Modules
     # =======