From ff8656c0dfd7a2eb5aa19a167f92e34c75fd6126 Mon Sep 17 00:00:00 2001
From: Joachim Metz <joachim.metz@gmail.com>
Date: Mon, 24 May 2021 10:14:11 +0200
Subject: [PATCH] Added tests for parser preferred time zone handling #3287

---
 test_data/MSHist012013031020130311-index.dat | Bin 0 -> 32768 bytes
 tests/parsers/msiecf.py                      |  43 ++++++++++++++++++-
 2 files changed, 41 insertions(+), 2 deletions(-)
 create mode 100644 test_data/MSHist012013031020130311-index.dat

diff --git a/test_data/MSHist012013031020130311-index.dat b/test_data/MSHist012013031020130311-index.dat
new file mode 100644
index 0000000000000000000000000000000000000000..154f32bbd101a19aa3d11356e4dbf13e0e8d9945
GIT binary patch
literal 32768
zcmeI4Z)n_P9LJwJH-v6deWeT`4m}3rlKa!{X5G=O-CPU3v9`9`?7yYCq|KH~Zb^1M
zoG%V>PDO{zDI($~zM4>cp)Uksbjtc-qO0Hw*<dR=eBsa@DxJQVn&)!Q^)5}jOURx3
z^GiAM@18vQe7?UtN$y2EWJypAs$Y{kIDSH)5{YN10YRf$=m<hNgb-`ZcA1OTlp_l;
z2LnqC{7a^`CA(k)7ytuc01SWuFaQR?02lxRU;qq&0WbgtzyKHk17H9QfB`T72EYIq
z00UqE41fVJ00zJS7ytuc01SWuFaQR?02lxRU;qq&0WbgtzyKHk17H9QfB`T72EYIq
z00UqE46I<Fb6a00RknYXxeOow9ONF|Ig2>|j(59d!wy|ukDjd`U+%`Q-=n1a{?N{u
zC($1F?Y#PCU;lj?3GVx2W1rLLIrr_no~PG#=$&<O#NYns>6PzpZ<iZ<SwTbY^UICi
zcm(bC(C&j@ZlY25?bx34pQ63)+o6LGtw&?-+ubR-vsYHFK|Oab-yM^~k55F9Sic<5
zhv6^LNd5Y&cMj<1&IYv4J>T@ZZ|P{*eY;%axe?Uwz8yPra}o`@Z|BwL^r`nwqF#ii
zzj{qW`|H=Q+w(<h-rS1%%$JDiZ~D=|?R%bXx$c$km%R$Y;yqxXzqgyZ&*TjK^oeog
zv2PnfN3K7toAaaXm%8ovxt<0*^q>jz^ABoj!u#(>6rPo)17^F1(%RxeYa|qohN9t6
zaUO1^g6xE0q+1zgQc{xYq<%P^<P3pMNxY`&s%X%>nyTE#WHvKNLF5k02F>Z|?Bd})
zFD=LKbU@$vTRT<VXr)%*cRCGUw-J6SwQuzcX71GLw?DG-A4=Fes*Zms;WmForc=67
zh`UYYrDR+Z#EfRxyRXUma{Nx6`OaU=f05s**V=9){Ii2kuf_S#{*n3E%Afa`Kkrxm
z0dZ_Jn;aE2ZaiiFkJ8$BApH5v<6+F7e{lGs#edr4`1jHh{&o4O#udlE$w}L&r^rD?
zX3RlRkyS2fj(G+r$$DYTYcsEp2x`Q~^y5SLS?;q9n4kT7ej4*T*{-hsGfVjKu^joy
z_-FEuNy<1L0i61+<u<~9`uv{-{?o&ub5{N*Jm#NC;QOh4a^xrXzcPMC7dVZdXgd^_
z6hqJy!Pq2Z)3T}w+NM}QRJBw*(YLEJ))Gh^G~#BR?CK6^VmxH;uiACOZ?Au+_SNOT
zwEpq29Qn)guej?wbzY-wgnus5y%pF0+=XM8to+Y-%>Q`x^<S2M1wUiE{&`gqB`w7n
zlB$#q0)8kV{7oatZJ57l;nY=&f662O3D^8&oU;vrWHZyuM9shEXf*khuq70Xj77u2
z<}ooE+|t}E2KjJU5O^UHN^&hs*N#|lkM%gYcXu$mWwSYsCTSsS{u1vzEywTl?ds~^
z1%I*r31}t1(;4``jqs;w?uVS2e|qNqOxBzqZKus&8!D&j_~~Bz&13%T)D_3;zpVbp
zRdrkz3U`1j`1|$x5dM7Z%mvJ!zj$o|^H-8vYt`{@sGh%=zjjzr72bUFu^xg^z1VR-
zgrAKjzQg?N*RQBn{u@2!zp>YT|HJ*Pl)sIiDXvGYcf8ux0^zsUzxVuI)PLFi@BglU
zYX9nMIDhId_C+iIn8*BM)z^R7^-rGv7N37)X)L8n0xt%1jgNQj2=*18jM~*K@^O41
z`BPWv>jnPF1Fu^AagY3Q*ZjPi6zIhQVA4#9z2;-Va{S)w-vxiM{%!m<XD%OK2|qeJ
z`y0+54Xk~`%D=;7{_TF|UwQ}B&6>~+<okV*@XyUZkjMOU$F?80__urH-(Dkr>m|5N
z;Zj1pbbSOlIX%GztsfObEwsUD^!W1uo>StHz@hl9eG&eqjxQE4f79iKlNNuMNB%C?
z{3V*=AW*m-@Q<IOBnvqB;y~yOduzt>dbckx$M606cfnu0{!4&1em}=~J2zQ(;)HEr
s01SWuFaQR?02lxRU;qq&0WbgtzyKHk17H9QfB`T72EYIqxRVY12lro{VgLXD

literal 0
HcmV?d00001

diff --git a/tests/parsers/msiecf.py b/tests/parsers/msiecf.py
index 0ad1dcbc6c..69b0b6f5c6 100644
--- a/tests/parsers/msiecf.py
+++ b/tests/parsers/msiecf.py
@@ -24,9 +24,10 @@ def testParse(self):
     #   Number of items                 : 7
     #   Number of recovered items       : 11
 
-    self.assertEqual(storage_writer.number_of_warnings, 0)
     # 7 + 11 records, each with 4 records.
     self.assertEqual(storage_writer.number_of_events, (7 + 11) * 4)
+    self.assertEqual(storage_writer.number_of_extraction_warnings, 0)
+    self.assertEqual(storage_writer.number_of_recovery_warnings, 0)
 
     events = list(storage_writer.GetEvents())
 
@@ -79,7 +80,8 @@ def testParseLeakAndRedirect(self):
     """Tests the Parse function with leak and redirected records."""
     parser = msiecf.MSIECFParser()
     storage_writer = self._ParseFile(['nfury_index.dat'], parser)
-    self.assertEqual(storage_writer.number_of_warnings, 0)
+    self.assertEqual(storage_writer.number_of_extraction_warnings, 0)
+    self.assertEqual(storage_writer.number_of_recovery_warnings, 0)
 
     # MSIE Cache File information:
     #   Version                         : 5.2
@@ -136,6 +138,43 @@ def testParseLeakAndRedirect(self):
 
     self.CheckEventValues(storage_writer, events[21], expected_event_values)
 
+  def testParseWithTimeZone(self):
+    """Tests the Parse function with a time zone."""
+    parser = msiecf.MSIECFParser()
+    storage_writer = self._ParseFile(
+        ['MSHist012013031020130311-index.dat'], parser,
+        timezone='Europe/Amsterdam')
+
+    self.assertEqual(storage_writer.number_of_events, 83)
+    self.assertEqual(storage_writer.number_of_extraction_warnings, 0)
+    self.assertEqual(storage_writer.number_of_recovery_warnings, 0)
+
+    events = list(storage_writer.GetEvents())
+
+    # Test primary last visited time, in UTC, event.
+    expected_event_values = {
+        'timestamp': '2013-03-10 10:18:17.281000',
+        'timestamp_desc': definitions.TIME_DESCRIPTION_LAST_VISITED,
+        'url': ':2013031020130311: -@:Host: libmsiecf.googlecode.com'}
+
+    self.CheckEventValues(storage_writer, events[80], expected_event_values)
+
+    # Test secondary last visited time, in local time, event.
+    expected_event_values = {
+        'timestamp': '2013-03-10 10:18:17.281000',
+        'timestamp_desc': definitions.TIME_DESCRIPTION_LAST_VISITED,
+        'url': ':2013031020130311: -@:Host: libmsiecf.googlecode.com'}
+
+    self.CheckEventValues(storage_writer, events[81], expected_event_values)
+
+    # Test last checked time event.
+    expected_event_values = {
+        'timestamp': '2013-03-10 10:18:18.000000',
+        'timestamp_desc': definitions.TIME_DESCRIPTION_LAST_CHECKED,
+        'url': ':2013031020130311: -@:Host: libmsiecf.googlecode.com'}
+
+    self.CheckEventValues(storage_writer, events[82], expected_event_values)
+
 
 if __name__ == '__main__':
   unittest.main()