[GEMINI] Write tests for forensics and stage baseline implementation

tests/test_forensics.py

@@ -461,7 +461,149 @@ def test_adobe_xmp_cli():
     assert "cc:license" in result.output
     assert "cGljb0NURnt0ZXN0X3htcF9mbGFnfQ==" in result.output
 
+def test_jpeg_physical_parsing():
+    """
+    Verifies that get_metadata successfully parses JPEG physical parameters (JFIF & SOF).
+    """
+    import struct
+    app0_payload = b"JFIF\x00\x01\x02\x01\x00\x48\x00\x48\x00\x00"
+    app0_block = b"\xff\xe0" + struct.pack(">H", len(app0_payload) + 2) + app0_payload
+    
+    sof_payload = b"\x08\x03\xe8\x05\xdc\x03\x01\x11\x00\x02\x11\x01\x03\x11\x01"
+    sof_block = b"\xff\xc0" + struct.pack(">H", len(sof_payload) + 2) + sof_payload
+    
+    mock_jpeg = b"\xff\xd8" + app0_block + sof_block + b"\xff\xd9"
+    
+    test_file = TEST_ENV / "mock_physical.jpg"
+    with open(test_file, "wb") as f:
+        f.write(mock_jpeg)
+        
+    meta = get_metadata(test_file)
+    assert meta.physical_data.get("JFIF Version") == "1.02"
+    assert meta.physical_data.get("Image Size") == "1500x1000"
+    assert meta.physical_data.get("Megapixels") == "1.5"
+    assert meta.physical_data.get("Encoding Process") == "Baseline DCT, Huffman coding"
 
+def test_jpeg_iptc_parsing():
+    """
+    Verifies that get_metadata successfully parses JPEG IPTC metadata from APP13.
+    """
+    import struct
+    iptc_ds = b"\x1c\x02\x74\x00\x0ePicoCTF Rights"
+    
+    irb_id = b"\x04\x04"
+    irb_name = b"\x00\x00"
+    irb_size = struct.pack(">I", len(iptc_ds))
+    irb_block = b"8BIM" + irb_id + irb_name + irb_size + iptc_ds
+    
+    app13_payload = b"Photoshop 3.0\x00" + irb_block
+    app13_block = b"\xff\xed" + struct.pack(">H", len(app13_payload) + 2) + app13_payload
+    
+    mock_jpeg = b"\xff\xd8" + app13_block + b"\xff\xd9"
+    
+    test_file = TEST_ENV / "mock_iptc.jpg"
+    with open(test_file, "wb") as f:
+        f.write(mock_jpeg)
+        
+    meta = get_metadata(test_file)
+    assert meta.exif_data.get("CopyrightNotice") == "PicoCTF Rights"
 
+def test_cli_physical_option():
+    """
+    Verifies the ctf inspect CLI supports -p/--physical and mutual exclusion rules.
+    """
+    from ctf.main import cli
+    runner = CliRunner()
+    test_file = TEST_ENV / "mock_physical.jpg"
+    
+    # Mutual exclusion check
+    result_err = runner.invoke(cli, ["inspect", "-p", "-e", str(test_file)])
+    assert result_err.exit_code != 0
+    assert "Cannot specify more than one" in result_err.output
+    
+    # Physical view check
+    result_phys = runner.invoke(cli, ["inspect", "-p", str(test_file)])
+    assert result_phys.exit_code == 0
+    assert "Physical Metadata" in result_phys.output
+    assert "Image Size" in result_phys.output
+    assert "1500x1000" in result_phys.output
+    assert "Metadata: mock_physical.jpg" not in result_phys.output
+    assert "EXIF Metadata" not in result_phys.output
+def test_png_text_chunks_decompression():
+    """
+    Verifies that get_metadata successfully parses tEXt and compressed zTXt chunks.
+    """
+    import zlib
+    import struct
+    
+    # 1. tEXt chunk: Keyword (Copyright) + NUL + Text (PicoCTF)
+    text_data = b"Copyright\x00PicoCTF"
+    text_chunk = struct.pack(">I", len(text_data)) + b"tEXt" + text_data + b"\x00\x00\x00\x00"
+    
+    # 2. zTXt chunk: Keyword (Author) + NUL + CompMethod(0) + Deflated Text (John Doe)
+    deflated = zlib.compress(b"John Doe")
+    ztxt_data = b"Author\x00\x00" + deflated
+    ztxt_chunk = struct.pack(">I", len(ztxt_data)) + b"zTXt" + ztxt_data + b"\x00\x00\x00\x00"
+    
+    png_data = b"\x89PNG\r\n\x1a\n" + text_chunk + ztxt_chunk + b"\x00\x00\x00\x00IEND\xaeB`\x82"
+    
+    test_file = TEST_ENV / "mock_text_chunks.png"
+    with open(test_file, "wb") as f:
+        f.write(png_data)
+        
+    meta = get_metadata(test_file)
+    assert meta.exif_data.get("Copyright") == "PicoCTF"
+    assert meta.exif_data.get("Author") == "John Doe"
 
+def test_gif_comment_parsing():
+    """
+    Verifies that get_metadata successfully parses GIF comment blocks.
+    """
+    gif_data = (
+        b"GIF89a"
+        b"\x01\x00\x01\x00\x00\x00\x00"
+        b"\x21\xfe\x0aGIFComment\x00"
+        b"\x3b"
+    )
+    test_file = TEST_ENV / "mock_comment.gif"
+    with open(test_file, "wb") as f:
+        f.write(gif_data)
+        
+    meta = get_metadata(test_file)
+    assert meta.comment == "GIFComment"
+
+def test_adobe_xmp_formatting():
+    """
+    Verifies that get_metadata parses rdf:Description attributes and formats other
+    attributes with ' | ' instead of '='.
+    """
+    import struct
+    xmp_xml = (
+        b"<x:xmpmeta xmlns:x='adobe:ns:meta/'>\n"
+        b"<rdf:RDF xmlns:rdf='http://www.w3.org/1999/02/22-rdf-syntax-ns#'>\n"
+        b"  <rdf:Description rdf:about='' xmlns:xmp='http://ns.adobe.com/xap/1.0/' xmlns:exif='http://ns.adobe.com/exif/1.0/'>\n"
+        b"    <xmp:CreatorTool>Photoshop</xmp:CreatorTool>\n"
+        b"    <exif:Flash exif:Fired='True' exif:Mode='1'/>\n"
+        b"  </rdf:Description>\n"
+        b"</rdf:RDF>\n"
+        b"</x:xmpmeta>"
+    )
+    xmp_prefix = b"http://ns.adobe.com/xap/1.0/\x00"
+    app1_payload = xmp_prefix + xmp_xml
+    app1_len = len(app1_payload) + 2
+    mock_jpeg = (
+        b"\xff\xd8"
+        b"\xff\xe1"
+        + struct.pack(">H", app1_len)
+        + app1_payload
+        + b"\xff\xd9"
+    )
+    
+    test_file = TEST_ENV / "mock_xmp_formatting.jpg"
+    with open(test_file, "wb") as f:
+        f.write(mock_jpeg)
+        
+    meta = get_metadata(test_file)
+    assert meta.exif_data.get("xmp:CreatorTool") == "Photoshop"
+    assert meta.exif_data.get("exif:Flash") == "exif:Fired | True, exif:Mode | 1"