From 658d40335a15bc40d2ecb5679198d759858492b5 Mon Sep 17 00:00:00 2001
From: Gustavo Moreira <gmoreira@gmail.com>
Date: Fri, 20 Dec 2024 13:06:14 +1100
Subject: [PATCH] testcases: Add basic volshell testcases for each OS image

---
 .github/workflows/test.yaml |  5 ++++
 test/test_volatility.py     | 51 +++++++++++++++++++++++++++++++++++++
 2 files changed, 56 insertions(+)

diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index dfc42499d..e07673175 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -42,6 +42,11 @@ jobs:
 
     - name: Testing...
       run: |
+        # VolShell
+        pytest ./test/test_volatility.py --volatility=volshell.py --image-dir=./test_images -k test_windows_volshell -v
+        pytest ./test/test_volatility.py --volatility=volshell.py --image-dir=./test_images -k test_linux_volshell -v
+
+        # Volatility
         pytest ./test/test_volatility.py --volatility=vol.py --image-dir=./test_images -k test_windows -v
         pytest ./test/test_volatility.py --volatility=vol.py --image-dir=./test_images -k test_linux -v
 
diff --git a/test/test_volatility.py b/test/test_volatility.py
index 5bce07481..8ef6d8b70 100644
--- a/test/test_volatility.py
+++ b/test/test_volatility.py
@@ -54,13 +54,56 @@ def runvol_plugin(plugin, img, volatility, python, pluginargs=[], globalargs=[])
     return runvol(args, volatility, python)
 
 
+def runvolshell(img, volshell, python, volshellargs=[], globalargs=[]):
+    args = (
+        globalargs
+        + [
+            "--single-location",
+            img,
+            "-q",
+        ]
+        + volshellargs
+    )
+
+    return runvol(args, volshell, python)
+
+
 #
 # TESTS
 #
 
+
+def basic_volshell_test(image, volatility, python):
+    # Basic VolShell test to verify requirements and ensure VolShell runs without crashing
+
+    # FIXME: When the minimum Python version includes 3.12, replace the following with:
+    # with tempfile.NamedTemporaryFile(delete_on_close=False) as fd: ...
+    fd, filename = tempfile.mkstemp(suffix=".txt")
+    try:
+        with os.fdopen(fd, "w") as f:
+            f.write("exit()")
+
+        rc, out, _err = runvolshell(
+            img=image,
+            volshell=volatility,
+            python=python,
+            volshellargs=["--script", filename],
+        )
+    finally:
+        with contextlib.suppress(FileNotFoundError):
+            os.remove(filename)
+
+    assert rc == 0
+    assert out.count(b"\n") >= 4
+
+
 # WINDOWS
 
 
+def test_windows_volshell(image, volatility, python):
+    basic_volshell_test(image, volatility, python)
+
+
 def test_windows_pslist(image, volatility, python):
     rc, out, _err = runvol_plugin("windows.pslist.PsList", image, volatility, python)
     out = out.lower()
@@ -332,6 +375,10 @@ def test_windows_vadyarascan_yara_string(image, volatility, python):
 # LINUX
 
 
+def test_linux_volshell(image, volatility, python):
+    basic_volshell_test(image, volatility, python)
+
+
 def test_linux_pslist(image, volatility, python):
     rc, out, _err = runvol_plugin("linux.pslist.PsList", image, volatility, python)
 
@@ -770,6 +817,10 @@ def test_linux_hidden_modules(image, volatility, python):
 # MAC
 
 
+def test_mac_volshell(image, volatility, python):
+    basic_volshell_test(image, volatility, python)
+
+
 def test_mac_pslist(image, volatility, python):
     rc, out, _err = runvol_plugin("mac.pslist.PsList", image, volatility, python)
     out = out.lower()