1 files changed, 202 insertions, 0 deletions
diff --git a/tests/analysis/scan/grammar.py b/tests/analysis/scan/grammar.py
index 3a8196a..14f67fa 100644
--- a/tests/analysis/scan/grammar.py
+++ b/tests/analysis/scan/grammar.py
@@ -276,6 +276,208 @@ rule test {
         self.check_rule_success(rule, cnt)
 
 
+    def testBackingUpHandlers(self):
+        """Ensure handlers for backing up removals do not limit the grammar."""
+
+        cnt = MemoryContent(b'AB12')
+
+        # Uncompleted token in rule definition: '?? ?? '
+
+        rule = '''
+rule test {
+
+   bytes:
+      $a = { ?? ?? }
+
+   condition:
+      #a == 3
+
+}
+'''
+
+        self.check_rule_success(rule, content=cnt)
+
+        # Uncompleted token in rule definition: '?? '
+
+        rule = '''
+rule test {
+
+   bytes:
+      $a = { ?? 4? }
+
+   condition:
+      #a == 1
+
+}
+'''
+
+        self.check_rule_success(rule, content=cnt)
+
+        # Uncompleted token in rule definition: '?? ?'
+
+        rule = '''
+rule test {
+
+   bytes:
+      $a = { ?? ?2 }
+
+   condition:
+      #a == 2
+
+}
+'''
+
+        self.check_rule_success(rule, content=cnt)
+
+        # Uncompleted token in rule definition: '?? '
+
+        rule = '''
+rule test {
+
+   bytes:
+      $a = { ?? 42 }
+
+   condition:
+      #a == 1
+
+}
+'''
+
+        self.check_rule_success(rule, content=cnt)
+
+
+        # Uncompleted token in rule definition: '?1 ?'
+
+        rule = '''
+rule test {
+
+   bytes:
+      $a = { ?1 ?? }
+
+   condition:
+      #a == 2
+
+}
+'''
+
+        self.check_rule_success(rule, content=cnt)
+
+        # Uncompleted token in rule definition: '?1 4? '
+
+        rule = '''
+rule test {
+
+   bytes:
+      $a = { ?1 4? }
+
+   condition:
+      #a == 1
+
+}
+'''
+
+        self.check_rule_success(rule, content=cnt)
+
+        # Uncompleted token in rule definition: '?1 ?2 '
+
+        rule = '''
+rule test {
+
+   bytes:
+      $a = { ?1 ?2 }
+
+   condition:
+      #a == 2
+
+}
+'''
+
+        self.check_rule_success(rule, content=cnt)
+
+        # Uncompleted token in rule definition: '?1 4'
+
+        rule = '''
+rule test {
+
+   bytes:
+      $a = { ?1 42 }
+
+   condition:
+      #a == 1
+
+}
+'''
+
+        self.check_rule_success(rule, content=cnt)
+
+
+        # Uncompleted token in rule definition: '41 '
+
+        rule = '''
+rule test {
+
+   bytes:
+      $a = { 41 ?? }
+
+   condition:
+      #a == 1
+
+}
+'''
+
+        self.check_rule_success(rule, content=cnt)
+
+        # Uncompleted token in rule definition: '41 4'
+
+        rule = '''
+rule test {
+
+   bytes:
+      $a = { 41 4? }
+
+   condition:
+      #a == 1
+
+}
+'''
+
+        self.check_rule_success(rule, content=cnt)
+
+        # Uncompleted token in rule definition: '41 '
+
+        rule = '''
+rule test {
+
+   bytes:
+      $a = { 41 ?2 }
+
+   condition:
+      #a == 1
+
+}
+'''
+
+        self.check_rule_success(rule, content=cnt)
+
+        # Uncompleted token in rule definition: '41 42 '
+
+        rule = '''
+rule test {
+
+   bytes:
+      $a = { 41 42 }
+
+   condition:
+      #a == 1
+
+}
+'''
+
+        self.check_rule_success(rule, content=cnt)
+
+
+
+
 # TODO : test     <haystack> matches <regex>