Missing tests

[Slasq]

Firefox download states (test_firefox_downloads.py)
Firefox's DOWNLOAD_STATE dict has 10 entries (0–9) plus an UNKNOWN fallback. Only FINISHED (1) and CANCELLED (3) were tested. Added tests for all remaining states: DOWNLOADING, FAILED, PAUSED, QUEUED, BLOCKED_PARENTAL, SCANNING, DIRTY, BLOCKED_POLICY, UNKNOWN, and the case where the state key is absent from metadata entirely.

Chrome download states (test_chrome_downloads.py)
IN_PROGRESS (0), INTERRUPTED (3 and 4 alias), and the UNKNOWN fallback were untested.

_fileuri_to_path (test_firefox_downloads.py)

Firefox download states (test_firefox_downloads.py) Firefox's DOWNLOAD_STATE dict has 10 entriesck. Only FINISHED (1) and CANCELLED (3) weretested. Added tests for all remaining states: DOWNLOADING, FAILED, PAUSED, QUEUED, BLOCKED_PARENTAL, SCANNING, DIRTY, BLOCKED_POLICY, UNKNOWN, and the case where the state key is absent from metadata entirely.

Chrome download states (test_chrome_downloads.py)
IN_PROGRESS (0), INTERRUPTED (3 and 4 alias), and the UNKNOWN fallback were untested.
_fileuri_to_path (test_firefox_downloads.py)
The Windows-path branch (/C:/... → C:/...) had no test coverage at all. This is a forensically significant code path — Chrome on Windows stores file:///C:/... URIse would break filename extraction andanomaly detection on Windows artifacts. Added direct unit tests for the POSIX case, Windows drive-letter stripping, and percent-encoded paths.

_extract_query (test_base.py)
The function was only exercised indirectly through Chrome and Firefox search integration tests. Added direct unit tests covering all 9 search engines, empty/whitespace-only query params, malformed URLs, and the multiple-values-for-same-param edge case.

CLI error paths (test_main.py)

• CorruptedDatabaseError (a subclass of ArtifactError) was not tested — only the FileNotFoundError branch was covered. The two except clauses in main() are now both exercised.
• Firefox-only profile happy path was missing from TestMainHappyPath.
• Default values for --output-dir and --ioc-file were not asserted in TestParseArgs.
• test_filter_applied_with_both_bounds only checked that filter_by_time was called once, but never verified the actual start/end values passed — fixed.

Wildcard domain matching (test_anomaly.py)
Added a test confirming that xonion does not match the IOC pattern *.onion (the endswith(".onion") check correctly requires the dot boundary).