Strict detection item checks

Author: thomaspatzke

sigma/rule/detection.py

@@ -68,6 +68,12 @@ class SigmaDetectionItem(ProcessingItemTrackingMixin, ParentChainMixin):
     auto_modifiers: bool = dataclasses.field(default=True, compare=False, repr=False)
 
     def __post_init__(self) -> None:
+        if not isinstance(self.value, list) or not all(
+            isinstance(val, SigmaType) for val in self.value
+        ):
+            raise sigma_exceptions.SigmaTypeError(
+                "Value must be a list of SigmaType instances", source=self.source
+            )
         self.original_value = self.value.copy()  # Create a copy of original values
         if self.auto_modifiers:
             self.apply_modifiers()

tests/test_modifiers.py

@@ -56,7 +56,7 @@
 
 @pytest.fixture
 def dummy_detection_item():
-    return SigmaDetectionItem(None, [], ["foobar"])
+    return SigmaDetectionItem(None, [], [SigmaString("foobar")])
 
 
 @pytest.fixture

tests/test_rule.py

@@ -238,13 +238,6 @@ def test_sigmadetectionitem_keyword_single():
     )
 
 
-def test_sigmadetectionitem_value_cleanup_multi():
-    """Multiple value cleanup."""
-    assert SigmaDetectionItem(None, [], ["value", 123]) == SigmaDetectionItem(
-        None, [], [SigmaString("value"), SigmaNumber(123)]
-    )
-
-
 def test_sigmadetectionitem_keyword_single_to_plain():
     """Single keyword detection."""
     assert SigmaDetectionItem(None, [], [SigmaString("value*")]).to_plain() == "value*"
@@ -446,6 +439,22 @@ def test_sigmadetectionitem_processing_item_tracking(processing_item):
     assert detection_item.was_processed_by("test")
 
 
+def test_sigmadetectionitem_invalid_value_type():
+    """Test that SigmaDetectionItem raises an error if value is not a list."""
+    with pytest.raises(
+        sigma_exceptions.SigmaTypeError, match="Value must be a list of SigmaType instances"
+    ):
+        SigmaDetectionItem(field="key", modifiers=[], value="invalid_value")
+
+
+def test_sigmadetectionitem_invalid_value_elements():
+    """Test that SigmaDetectionItem raises an error if value contains non-SigmaType elements."""
+    with pytest.raises(
+        sigma_exceptions.SigmaTypeError, match="Value must be a list of SigmaType instances"
+    ):
+        SigmaDetectionItem(field="key", modifiers=[], value=["valid", 123, object()])
+
+
 ### SigmaDetection tests ###