test: add full coverage tests for pm snort syntax implementation

Agent-Logs-Url: https://github.com/corazawaf/coraza/sessions/bf792533-4ef4-4be3-8c71-38d5647544f9

Co-authored-by: fzipi <3012076+fzipi@users.noreply.github.com>

Author: Copilot

internal/operators/pm_test.go

@@ -27,6 +27,16 @@ func TestParsePMArgs(t *testing.T) {
 			input:    "test",
 			expected: []string{"test"},
 		},
+		{
+			name:     "empty string",
+			input:    "",
+			expected: nil,
+		},
+		{
+			name:     "only spaces",
+			input:    "   ",
+			expected: nil,
+		},
 		{
 			name:     "snort hex inline: A|42|C|44|F",
 			input:    "A|42|C|44|F",
@@ -62,16 +72,31 @@ func TestParsePMArgs(t *testing.T) {
 			input:    "|41|",
 			expected: []string{"a"},
 		},
+		{
+			name:     "multiple patterns with snort syntax",
+			input:    "A|42|C |44|F",
+			expected: []string{"abc", "df"},
+		},
+		{
+			name:     "snort syntax mixed with plain pattern",
+			input:    "plain |41 42| mixed",
+			expected: []string{"plain", "ab", "mixed"},
+		},
 		{
 			name:    "unclosed pipe",
 			input:   "A|42",
 			wantErr: true,
 		},
 		{
-			name:    "invalid hex value",
+			name:    "invalid hex value at end of pipe block",
 			input:   "|ZZ|",
 			wantErr: true,
 		},
+		{
+			name:    "invalid hex value before space inside pipe block",
+			input:   "|ZZ FF|",
+			wantErr: true,
+		},
 	}
 
 	for _, tt := range tests {
@@ -131,6 +156,30 @@ func TestPMSnortSyntax(t *testing.T) {
 			input:     "abcdf",
 			wantMatch: true,
 		},
+		{
+			name:      "plain pattern still works",
+			param:     "foo bar",
+			input:     "here is bar",
+			wantMatch: true,
+		},
+		{
+			name:      "plain pattern no match",
+			param:     "foo bar",
+			input:     "nothing here",
+			wantMatch: false,
+		},
+		{
+			name:      "snort hex only pattern matches",
+			param:     "|41 42 43|",
+			input:     "xABCy",
+			wantMatch: true,
+		},
+		{
+			name:      "snort non-printable byte matches",
+			param:     "prefix|01|suffix",
+			input:     "prefix\x01suffix",
+			wantMatch: true,
+		},
 	}
 
 	waf := corazawaf.NewWAF()
@@ -148,3 +197,67 @@ func TestPMSnortSyntax(t *testing.T) {
 		})
 	}
 }
+
+func TestNewPMInvalidArgs(t *testing.T) {
+	invalidCases := []struct {
+		name  string
+		param string
+	}{
+		{name: "unclosed pipe", param: "A|42"},
+		{name: "invalid hex", param: "|ZZ|"},
+		{name: "invalid hex before space in pipe", param: "|ZZ FF|"},
+	}
+
+	for _, tt := range invalidCases {
+		t.Run(tt.name, func(t *testing.T) {
+			_, err := newPM(plugintypes.OperatorOptions{Arguments: tt.param})
+			if err == nil {
+				t.Errorf("newPM(%q) expected error but got nil", tt.param)
+			}
+		})
+	}
+}
+
+func TestPMEvaluateWithCapture(t *testing.T) {
+	waf := corazawaf.NewWAF()
+
+	t.Run("capture mode returns matches", func(t *testing.T) {
+		op, err := newPM(plugintypes.OperatorOptions{Arguments: "foo bar baz"})
+		if err != nil {
+			t.Fatalf("newPM: unexpected error: %v", err)
+		}
+		tx := waf.NewTransaction()
+		tx.Capture = true
+		if !op.Evaluate(tx, "foo and bar") {
+			t.Error("expected match but got none")
+		}
+	})
+
+	t.Run("capture mode no match returns false", func(t *testing.T) {
+		op, err := newPM(plugintypes.OperatorOptions{Arguments: "foo bar"})
+		if err != nil {
+			t.Fatalf("newPM: unexpected error: %v", err)
+		}
+		tx := waf.NewTransaction()
+		tx.Capture = true
+		if op.Evaluate(tx, "nothing to see here") {
+			t.Error("expected no match but got one")
+		}
+	})
+
+	t.Run("capture mode stops after 10 matches", func(t *testing.T) {
+		// Build a pattern that can match many times in one string.
+		// "a" will match every 'a' in the input.
+		op, err := newPM(plugintypes.OperatorOptions{Arguments: "a"})
+		if err != nil {
+			t.Fatalf("newPM: unexpected error: %v", err)
+		}
+		tx := waf.NewTransaction()
+		tx.Capture = true
+		// 15 'a' chars separated by '-' to ensure 15 distinct matches.
+		input := "a-a-a-a-a-a-a-a-a-a-a-a-a-a-a"
+		if !op.Evaluate(tx, input) {
+			t.Error("expected match but got none")
+		}
+	})
+}