Added condition existence check to post-init method

Author: thomaspatzke

Diff for: sigma/rule/detection.py

@@ -454,6 +454,10 @@ def __post_init__(self):
             raise sigma_exceptions.SigmaDetectionError(
                 "No detections defined in Sigma rule", source=self.source
             )
+        if self.condition == [] or self.condition is None:
+            raise sigma_exceptions.SigmaConditionError(
+                "Sigma rule must contain at least one condition", source=self.source
+            )
         self.parsed_condition = [SigmaCondition(cond, self, self.source) for cond in self.condition]
 
     @classmethod

Diff for: tests/test_conditions.py

@@ -45,7 +45,7 @@ def sigma_simple_detections():
                 ]
             ),
         },
-        list(),
+        condition=["any of them"],
     )
 
 
@@ -142,7 +142,7 @@ def sigma_detections():
                 ]
             ),
         },
-        list(),
+        condition=["any of them"],
     )
 
 
@@ -156,7 +156,7 @@ def sigma_invalid_detections():
                 ]
             ),
         },
-        list(),
+        condition=["any of them"],
     )
 
 
@@ -180,7 +180,7 @@ def sigma_underscore_detections():
                 ]
             ),
         },
-        list(),
+        condition=["any of them"],
     )
 
 

Diff for: tests/test_rule.py

@@ -622,6 +622,32 @@ def test_sigmadetections_fromdict_no_condition():
         )
 
 
+def test_sigmadetections_empty_condition_list():
+    with pytest.raises(
+        sigma_exceptions.SigmaConditionError, match="at least one condition.*test.yml"
+    ):
+        SigmaDetections(
+            detections={
+                "selection": SigmaDetection([SigmaDetectionItem("key", [], [SigmaString("value")])])
+            },
+            condition=[],
+            source=sigma_exceptions.SigmaRuleLocation("test.yml"),
+        )
+
+
+def test_sigmadetections_none_condition():
+    with pytest.raises(
+        sigma_exceptions.SigmaConditionError, match="at least one condition.*test.yml"
+    ):
+        SigmaDetections(
+            detections={
+                "selection": SigmaDetection([SigmaDetectionItem("key", [], [SigmaString("value")])])
+            },
+            condition=None,
+            source=sigma_exceptions.SigmaRuleLocation("test.yml"),
+        )
+
+
 def test_detectionitem_all_modified_key_plain_values_postprocess():
     """
     Test if postprocessed condition result of an all-modified field-bound value list results in an