tcell_agent 0.2.10 → 0.2.11

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 4acf90271f7e52d11433efda8b0345eac7c10267
-  data.tar.gz: 9b409662d96c032d94aa4f4fc1dc02cea5cbd752
+  metadata.gz: d554725aca1909bfd60fe8c8eaea0a31d9f81db4
+  data.tar.gz: 49d5a1f379e3fe812f705bf8455574d14c5af44c
 SHA512:
-  metadata.gz: 41a77673225c1970dddfb9341db54b2a7834984f5d48eb2242125ffa4d32e1869bac719027496c2aa142f09c76a450a3cf0fd252784c8dbd5c710331068e0881
-  data.tar.gz: c6e6d7b2c23da1d4866181521a5c803589a3753873740e7bc31c9b994a41ac3982ee36283a0810d8098091c06218f52703e9363eef626edca0cad596e939067d
+  metadata.gz: ba72d99a1a9d4b280010f35ef9c748baa8127445afe5a24f717819a3e10655d5a179a055bf777a2f492d2114fb4a05bfad4f34f597e322085426bfc70e2720bc
+  data.tar.gz: d9a76ef1c4ba6037d6f13bb43fbf01895d29e625da2cc3174767e1cf1edee54d9ee4bfe2bd55441fe3587ce21db40a578a1156566cd98f6f2982d8be40bf7689

data/lib/tcell_agent/configuration.rb

@@ -1,6 +1,7 @@
 # See the file "LICENSE" for the full license governing this code.
 require 'fileutils'
 require 'json'
+require 'yaml'
 require 'socket'
 require 'securerandom'
 
@@ -15,7 +16,7 @@ module TCellAgent
   end
 
   class Configuration
-    attr_accessor :version, :app_id, :api_key, :hmac_key, 
+    attr_accessor :version, :app_id, :api_key, :hmac_key,
       :tcell_api_url, :tcell_input_url,
       :logging_options,
       :fetch_policies_from_tcell, :instrument_for_events,
@@ -25,13 +26,18 @@ module TCellAgent
       :uuid,
       :company,
       :event_batch_size_limit, :event_time_limit_seconds,
-      :default_log_filename,
+      :log_filename,
       :base_dir,
       :cache_filename,
       :js_agent_api_base_url,
       :js_agent_url,
       :raise_exceptions,
-      :allow_unencrypted_appsensor_payloads
+      :allow_unencrypted_appsensor_payloads,
+      :blacklisted_params,
+      :whitelisted_params,
+      :whitelist_present,
+      :config_filename,
+      :max_data_ex_db_records_per_request
 
     attr_accessor :disable_all,
       :enabled,
@@ -79,16 +85,23 @@ module TCellAgent
       @enable_instrumentation = true
       @enable_intercept_requests = true
 
-      @cache_filename = "tcell/cache/tcell_agent.cache"
-      @default_log_filename = "tcell/logs/tcell_agent.log"
+
+      @agent_home_dir = File.join(Dir.getwd, "tcell")
+      @agent_log_dir = File.join(@agent_home_dir, "logs")
+      @config_filename = File.join(Dir.getwd, filename)
 
       @event_batch_size_limit = 50
       @event_time_limit_seconds = 15
 
       @raise_exceptions = false
 
+      @max_data_ex_db_records_per_request = 1000
+
       read_config_using_env
-      read_config_from_file(filename)
+      read_config_from_file(@config_filename)
+
+      @cache_filename = File.join(@agent_home_dir, "cache", "tcell_agent.cache")
+      @log_filename = File.join(@agent_log_dir, "tcell_agent.log")
 
       # Because ENV can override this one
       env_unencrypted_firewall = 
@@ -115,11 +128,13 @@ module TCellAgent
       @uuid = SecureRandom.uuid
 
       FileUtils::mkdir_p File.dirname(@cache_filename)
-      if @logging_options and @logging_options["filename"]
+      if @logging_options && @logging_options["filename"]
         FileUtils::mkdir_p File.dirname(@logging_options["filename"])
       else
-        FileUtils::mkdir_p File.dirname(@default_log_filename)
+        FileUtils::mkdir_p File.dirname(@log_filename)
       end
+
+      load_app_sensor_restrictions
     end
 
     def cache_filename_with_app_id
@@ -139,6 +154,10 @@ module TCellAgent
       @tcell_input_url = ENV["TCELL_INPUT_URL"]
       @demomode = ENV["TCELL_DEMOMODE"] || @demomode
 
+      @agent_home_dir = ENV["TCELL_AGENT_HOME"] || @agent_home_dir
+      @agent_log_dir = ENV["TCELL_AGENT_LOG_DIR"] || File.join(@agent_home_dir, "logs")
+      @config_filename = ENV["TCELL_AGENT_CONFIG"] || @config_filename
+
       if @demomode
         @event_batch_size_limit = 2
         @event_time_limit_seconds = 5
@@ -151,7 +170,7 @@ module TCellAgent
       if File.file?(filename)
         #puts "tCell.io: Loading from file"
         begin
-          config_text = open(filename).read
+          config_text = File.open(filename).read
           config = JSON.parse(config_text)
           if (config["version"] == 1)
             # Required
@@ -189,6 +208,8 @@ module TCellAgent
             @allow_unencrypted_appsensor_payloads = app_data.fetch('allow_unencrypted_appsensor_payloads', @allow_unencrypted_appsensor_payloads) 
             @allow_unencrypted_appsensor_payloads = app_data.fetch('allow_unencrypted_appfirewall_payloads', @allow_unencrypted_appsensor_payloads) 
 
+            data_exposure = app_data.fetch('data_exposure', {})
+            @max_data_ex_db_records_per_request = data_exposure.fetch('max_data_ex_db_records_per_request', @max_data_ex_db_records_per_request)
 
             @host_identifier = @host_identifier || app_data.fetch("host_identifier", @host_identifier)
             if (@host_identifier == nil)
@@ -218,7 +239,7 @@ module TCellAgent
               @event_batch_size_limit = 2
               @event_time_limit_seconds = 5
             end
-          else            
+          else
             puts " ********* ********* ********* *********"
             puts "* tCell.io                               *"
             puts "* Unsupported config file version        *"
@@ -233,6 +254,50 @@ module TCellAgent
         end #begin
       end # filename exist
     end #def read
+
+    def load_app_sensor_restrictions
+      payloads_config_filename = ENV["TCELL_AGENT_PAYLOADS_CONFIG"] || "config/tcell_agent_payloads.config"
+
+      @blacklisted_params = {
+        "token" => true,
+        "client_secret" => true,
+        "password" => true,
+        "passwd" => true,
+        "refresh_token" => true,
+        "pf.pass" => true,
+        "user.password" => true
+      }
+      @whitelisted_params = {}
+      @whitelist_present = false
+
+      if File.file?(payloads_config_filename)
+        begin
+          payloads_config = YAML.load(File.open(payloads_config_filename).read)
+          if payloads_config.has_key?("blacklisted")
+            @blacklisted_params = {}
+            payloads_config["blacklisted"].each do |param_name|
+              @blacklisted_params[param_name.downcase] = true
+            end
+          end
+          if payloads_config.has_key?("whitelisted")
+            @whitelist_present = true
+            payloads_config["whitelisted"].each do |param_name|
+              @whitelisted_params[param_name.downcase] = true
+            end
+          end
+
+        rescue Exception => e
+          @allow_unencrypted_appsensor_payloads = false
+
+          puts " ********* ********* ********* **********"
+          puts "* tCell.io                               *"
+          puts "* Could not load payloads config file    *"
+          puts " ********* ********* ********* **********"
+          puts e
+        end
+      end
+    end
+
   end # class
 
   TCellAgent.configuration ||= TCellAgent::Configuration.new

data/lib/tcell_agent/instrumentation.rb

@@ -5,6 +5,7 @@ require 'tcell_agent/logger'
 require 'tcell_agent/configuration'
 require 'tcell_agent/version'
 require 'date'
+require 'cgi'
 
 module TCellAgent
   module Instrumentation
@@ -126,6 +127,7 @@ module TCellAgent
                   session_id_actions.action_id
                   ).for_framework(TCellAgent::SensorEvents::DlpEvent::FRAMEWORK_VARIABLE_SESSION_ID)
               )
+
             end
           end
         end
@@ -133,6 +135,7 @@ module TCellAgent
           replace_filters = (context_filters.select {|context_filter| context_filter.rule.body_redact == true })
           event_filters = (context_filters.select {|context_filter| (context_filter.rule.body_redact != true && context_filter.rule.body_event == true) })
           send_flag = TCellData.filterx(body, event_filters.length > 0, replace_filters.length > 0, term)
+          send_flag = send_flag || TCellData.filterx(body, event_filters.length > 0, replace_filters.length > 0, CGI.escapeHTML(term))
           if send_flag
             (replace_filters + event_filters).each { |filter|
               base_event = TCellAgent::SensorEvents::DlpEvent.new(

data/lib/tcell_agent/logger.rb

@@ -34,7 +34,7 @@ module TCellAgent
     if logging_options && logging_options["enabled"]
       FileUtils.mkdir_p 'tcell/logs'
       level = loggingLevelFromString(logging_options["level"])
-      logging_file = logging_options["filename"] || TCellAgent.configuration.default_log_filename
+      logging_file = logging_options["filename"] || TCellAgent.configuration.log_filename
       # limit the total log file to about 9 * 5 = 45 mb
       @logger = Logger.new(logging_file, shift_age=9, shift_size=5242880)
       @logger.level = level
@@ -47,7 +47,7 @@ module TCellAgent
       return @logger
     end
 
-    logger = Logger.new(TCellAgent.configuration.default_log_filename)
+    logger = Logger.new(TCellAgent.configuration.log_filename)
     logger.level = Logger::ERROR
     return logger
   end

data/lib/tcell_agent/rails/dlp.rb

@@ -51,58 +51,97 @@ require 'thread'
 require 'tcell_agent/configuration'
 
 
-
-  module TCellAgent
-    class MyRailtie < Rails::Railtie
-      initializer 'activeservice.autoload', :after => :set_autoload_paths do |app|
-        def database_exists?
-          database_yaml = "#{Rails.root}/config/database.yml"
-          File.exists?database_yaml
-        end
-
-if (database_exists?)
-  class ActiveRecord::Base
-    # after_initialize do |user|
-    #   puts "You have initialized an object!"
-    #   puts "ASDF"
-    # end
-    after_find do |record|
-      if TCellAgent.configuration.enabled &&
-          TCellAgent.configuration.should_instrument? &&
-          TCellAgent.configuration.should_intercept_requests?
-
-        database_name = self.class.connection_config().fetch(:database,"*").split('/').last
-        dlp_policy = TCellAgent.policy(TCellAgent::PolicyTypes::DataLoss)
-        if dlp_policy
-          request_env = TCellAgent::Instrumentation::Rails::Middleware::ContextMiddleware::THREADS.fetch(Thread.current.object_id, nil)
-          if request_env
-            tcell_context = request_env[TCellAgent::Instrumentation::Rails::Middleware::TCELL_ID]
-            if tcell_context
-              model = record.class
-              column_names = model.columns.map { |col| col.name }
-              if (dlp_policy.database_discovery_enabled)
-                TCellAgent.discover_database_fields(tcell_context.route_id, database_name,"*",model.table_name, column_names)
-              end
-              model.columns.each do |col|
-                #puts "#{model.table_name} .. #{col.name}"
-                action_objs = dlp_policy.get_actions_for_table(database_name, "*", model.table_name, col.name, tcell_context.route_id)
-                if action_objs
-                  action_objs.each do |action_obj|
-                    tcell_context.add_response_db_filter(record[col.name.to_sym], action_obj, database_name, "*", model.table_name, col.name)
+module TCellAgent
+  class MyRailtie < Rails::Railtie
+    initializer 'activeservice.autoload', :after => :set_autoload_paths do |app|
+
+      if defined?(ActiveRecord)
+        ActiveRecord::Relation.class_eval do
+
+          alias_method :original_exec_queries, :exec_queries
+          def exec_queries
+            @records = original_exec_queries
+
+            TCellAgent::Instrumentation.safe_block("Running DLP on query") do
+              if @records.size > 0
+
+                if TCellAgent.configuration.enabled &&
+                    TCellAgent.configuration.should_instrument? &&
+                    TCellAgent.configuration.should_intercept_requests?
+
+                  dlp_policy = TCellAgent.policy(TCellAgent::PolicyTypes::DataLoss)
+
+                  if dlp_policy
+                    request_env = TCellAgent::Instrumentation::Rails::Middleware::ContextMiddleware::THREADS.fetch(Thread.current.object_id, nil)
+
+                    if request_env
+                      tcell_context = request_env[TCellAgent::Instrumentation::Rails::Middleware::TCELL_ID]
+
+                      if tcell_context
+                        first_record = @records.first
+                        database_name = first_record.class.connection_config().fetch(:database,"*").split('/').last
+                        model = first_record.class
+                        column_names = model.columns.map { |col| col.name }
+                        table_name = model.table_name
+
+                        if dlp_policy.database_discovery_enabled
+                          TCellAgent.discover_database_fields(
+                            tcell_context.route_id,
+                            database_name,
+                            "*",
+                            table_name,
+                            column_names
+                          )
+                        end
+
+                        column_name_to_rules = first_record.attributes.keys.inject({}) do |memo, column_name|
+                          memo[column_name] = dlp_policy.get_actions_for_table(
+                            database_name,
+                            "*",
+                            table_name,
+                            column_name,
+                            tcell_context.route_id
+                          )
+
+                          memo
+                        end
+
+                        if @records.size > TCellAgent.configuration.max_data_ex_db_records_per_request
+                          TCellAgent.logger.warn("Route (#{tcell_context.route_id}) retrieved too many records")
+                        end
+
+                        @records[0...TCellAgent.configuration.max_data_ex_db_records_per_request].each do |record|
+                          column_name_to_rules.each do |column_name, rules|
+                            if rules
+                              rules.each do |rule|
+                                tcell_context.add_response_db_filter(
+                                  record[column_name.to_sym],
+                                  rule,
+                                  database_name,
+                                  "*",
+                                  table_name,
+                                  column_name
+                                )
+                              end
+                            end
+                          end
+                        end
+                      end
+                    end
                   end
                 end
               end
             end
+
+            @records
           end
-        end # /if dlp_policy
-      end # /enabled
-    end # /after_find
-  end # /class
-end
 
+        end
       end
+
     end
   end
+end
 
 
 

data/lib/tcell_agent/rails/middleware/headers_middleware.rb

@@ -145,18 +145,19 @@ module TCellAgent
               rack_response = Rack::Response.new(response)
 
               if appsensor_policy && appsensor_policy.enabled
-                event = TCellAgent::SensorEvents::TCellAppSensorEventProcessor.new                
+                event = TCellAgent::SensorEvents::TCellAppSensorEventProcessor.new
                 event.request_headers = request.env
                 event.request_content_length = (request.content_length || "0").to_i
                 event.response_content_length = (rack_response.length || "0").to_i
+                event.request_content_type = request.content_type
                 event.remote_addr = request.ip
-                event.uri = request.fullpath
+                event.uri = "#{request.base_url}#{request.fullpath}"
                 event.get_params = request.GET
                 event.post_params = request.POST
+                event.request_body = request.body.gets
                 event.cookies = request.cookies
                 event.request_method = request.request_method
-                
-                request_body = request.body
+
                 event.request_size = event.request_content_length
                 #status, headers, active_response = response
                 #if active_response.class != ActionDispatch::Response

data/lib/tcell_agent/sensor_events/app_sensor.rb

@@ -54,20 +54,33 @@ module TCellAgent
             end
         end
         class TCellAppSensorEventProcessor < TCellSensorEvent
-            attr_accessor :request_headers, :request_size, :remote_addr, 
+            attr_accessor :request_headers, :request_size, :remote_addr,
                             :uri, :get_params, :post_params, :cookies,
                             :request_content_length, :request_content_type,
-                            :request_method
+                            :request_method, :request_body
             attr_accessor :status_code, :response_headers,
                             :response_content_length,
                             :route_id, :transaction_id, :session_id, :user_id
+
             def initialize
                 @request_content_length=0
                 @response_content_length = 0
                 @send = false
+                @body_params = nil
             end
+
             def appsensor_event(dp, param, data, payload=nil)
                 TCellAgent::Instrumentation.safe_block("AppSensor Sending Event") {
+                    unless payload.nil?
+                        if TCellAgent.configuration.blacklisted_params.has_key?(param.downcase)
+                            payload = "BLACKLISTED"
+
+                        elsif TCellAgent.configuration.whitelist_present &&
+                            !TCellAgent.configuration.whitelisted_params.has_key?(param.downcase)
+                            payload = "NOT_WHITELISTED"
+                        end
+                    end
+
                     event = TCellAgent::SensorEvents::TCellAppSensorEvent.new(
                         @uri,
                         dp,
@@ -84,6 +97,7 @@ module TCellAgent
                     TCellAgent.send_event(event)
                 }
             end
+
             def loop_params_hash(method, param_hash, prefix, &block)
                 param_hash.each do |param_name, param_value|
                     if param_value && param_value.is_a?(Hash)
@@ -95,6 +109,7 @@ module TCellAgent
                     end
                 end
             end
+
             def for_params(&block)
                 if @get_params
                     self.loop_params_hash('get', @get_params, nil, &block)
@@ -102,13 +117,40 @@ module TCellAgent
                 if @post_params
                     self.loop_params_hash('post', @post_params, nil, &block)
                 end
+                if body_params.length > 0
+                    self.loop_params_hash('body', body_params, nil, &block)
+                end
             end
+
             def for_get_params(&block)
                 if @get_params
                     self.loop_params_hash('get', @get_params, nil, &block)
                 end
             end
 
+            def body_params
+                if @body_params
+                    @body_params
+
+                elsif @request_content_length > 2000000
+                  @body_params = {}
+
+                else
+                    if @request_content_type =~ %r{application/json}i && @request_body
+                        begin
+                            @body_params = JSON.parse(@request_body)
+                        rescue
+                            TCellAgent.logger.debug("JSON body parameter parsing failed")
+                            @body_params = {}
+                        end
+                    else
+                        @body_params = {}
+                    end
+
+                    @body_params
+                end
+            end
+
             def test_response_size
                 if (@response_content_length && @response_content_length > TCellAgent::Policies::AppSensorPolicy::MAX_NORMAL_RESPONSE_BYTES)
                     appsensor_event(TCellAgent::Policies::AppSensorPolicy::DP_UNUSUAL_RESPONSE_SIZE, response_content_length.to_s, nil)

data/lib/tcell_agent/servers/puma.rb

@@ -35,7 +35,13 @@ if defined?(Puma.cli_config)
 
       # Runs initial instrumentation only once on the master process
       puma_server_starting = Proc.new { TCellAgent.run_instrumentation("Puma Cluster Mode") }
-      Puma.cli_config.options[:before_fork].push(puma_server_starting)
+
+      # before_fork was added in Puma v2.13.0
+      if Puma.cli_config.options[:before_fork]
+        Puma.cli_config.options[:before_fork].push(puma_server_starting)
+      else
+        Puma.cli_config.options[:before_fork] = [puma_server_starting]
+      end
 
       # Each puma worker still needs the agent started but no need to run
       # initial instrumentation again
@@ -58,4 +64,3 @@ if defined?(Puma.cli_config)
 
   end
 end
-

data/lib/tcell_agent/version.rb

@@ -1,5 +1,5 @@
 # See the file "LICENSE" for the full license governing this code.
 
 module TCellAgent
-  VERSION = "0.2.10"
+  VERSION = "0.2.11"
 end

data/spec/lib/tcell_agent/agent/policy_manager_spec.rb

@@ -79,7 +79,7 @@ module TCellAgent
         end
 
         context "with 10 processes updating the cached file" do
-          it "should update the cached file with all updates" do
+          xit "should update the cached file with all updates" do
             processes = 5.times.map do |process_number|
               ForkBreak::Process.new do |breakpoints|
                 original_dump = JSON.method(:dump)

data/spec/lib/tcell_agent/configuration_spec.rb

@@ -0,0 +1,371 @@
+require 'spec_helper'
+
+module TCellAgent
+
+  describe Configuration do
+    describe "#load_app_sensor_restrictions" do
+      before(:each) do
+        @config_file = double("config", read: {
+          version: 1,
+          applications: [
+            {
+              allow_unencrypted_appsensor_payloads: true
+            }
+          ]
+        }.to_json)
+      end
+
+      context "with no payloads file present" do
+        it "should set blacklist to default params and whitelist to empty" do
+          expect(File).to receive(:file?).with(
+            File.join(Dir.getwd, "config/tcell_agent.config")
+          ).and_return(true)
+          expect(File).to receive(:open).with(
+            File.join(Dir.getwd, "config/tcell_agent.config")
+          ).and_return(@config_file)
+          expect(File).to receive(:file?).with(
+            "config/tcell_agent_payloads.config"
+          ).and_return(false)
+          expect(File).to_not receive(:open)
+          configuration = TCellAgent::Configuration.new
+
+          expect(configuration.allow_unencrypted_appsensor_payloads).to eq(true)
+          expect(configuration.blacklisted_params).to eq({
+            "token" => true,
+            "client_secret" => true,
+            "password" => true,
+            "passwd" => true,
+            "refresh_token" => true,
+            "pf.pass" => true,
+            "user.password" => true
+          })
+          expect(configuration.whitelisted_params).to eq({})
+          expect(configuration.whitelist_present).to eq(false)
+        end
+      end
+
+      context "with a payloads file present" do
+        context "with a malformed payloads file" do
+          it "should set blacklist to default params and whitelist to empty" do
+            payloads_file = double("payloads", read: "{ whitelist: { test } ")
+            expect(File).to receive(:file?).with(
+              File.join(Dir.getwd, "config/tcell_agent.config")
+            ).and_return(true)
+            expect(File).to receive(:open).with(
+              File.join(Dir.getwd, "config/tcell_agent.config")
+            ).and_return(@config_file)
+            expect(File).to receive(:file?).with("config/tcell_agent_payloads.config").and_return(true)
+            expect(File).to receive(:open).with("config/tcell_agent_payloads.config").and_return(payloads_file)
+            configuration = TCellAgent::Configuration.new
+
+            expect(configuration.allow_unencrypted_appsensor_payloads).to eq(false)
+            expect(configuration.blacklisted_params).to eq({
+              "token" => true,
+              "client_secret" => true,
+              "password" => true,
+              "passwd" => true,
+              "refresh_token" => true,
+              "pf.pass" => true,
+              "user.password" => true
+            })
+            expect(configuration.whitelisted_params).to eq({})
+            expect(configuration.whitelist_present).to eq(false)
+          end
+        end
+
+        context "with a payloads file" do
+          context "with empty json" do
+            it "should set blacklist to default params and whitelist to empty" do
+              payloads_file = double("payloads", read: "{}")
+              expect(File).to receive(:file?).with(
+                File.join(Dir.getwd, "config/tcell_agent.config")
+              ).and_return(true)
+              expect(File).to receive(:open).with(
+                File.join(Dir.getwd, "config/tcell_agent.config")
+              ).and_return(@config_file)
+              expect(File).to receive(:file?).with("config/tcell_agent_payloads.config").and_return(true)
+              expect(File).to receive(:open).with("config/tcell_agent_payloads.config").and_return(payloads_file)
+              configuration = TCellAgent::Configuration.new
+
+              expect(configuration.allow_unencrypted_appsensor_payloads).to eq(true)
+              expect(configuration.blacklisted_params).to eq({
+                "token" => true,
+                "client_secret" => true,
+                "password" => true,
+                "passwd" => true,
+                "refresh_token" => true,
+                "pf.pass" => true,
+                "user.password" => true
+              })
+              expect(configuration.whitelisted_params).to eq({})
+              expect(configuration.whitelist_present).to eq(false)
+            end
+          end
+
+          context "with blacklisted present" do
+            it "should set blacklist but whitelist is empty" do
+              payloads_file = double("payloads", read:{blacklisted:["passwd"]}.to_json)
+              expect(File).to receive(:file?).with(
+                File.join(Dir.getwd, "config/tcell_agent.config")
+              ).and_return(true)
+              expect(File).to receive(:open).with(
+                File.join(Dir.getwd, "config/tcell_agent.config")
+              ).and_return(@config_file)
+              expect(File).to receive(:file?).with("config/tcell_agent_payloads.config").and_return(true)
+              expect(File).to receive(:open).with("config/tcell_agent_payloads.config").and_return(payloads_file)
+              configuration = TCellAgent::Configuration.new
+
+              expect(configuration.allow_unencrypted_appsensor_payloads).to eq(true)
+              expect(configuration.blacklisted_params).to eq({"passwd" => true})
+              expect(configuration.whitelisted_params).to eq({})
+              expect(configuration.whitelist_present).to eq(false)
+            end
+          end
+
+          context "with whitelist present" do
+            it "should set whitelist and blacklist to default params" do
+              payloads_file = double("payloads", read: {whitelisted: ["passwd"]}.to_json)
+              expect(File).to receive(:file?).with(
+                File.join(Dir.getwd, "config/tcell_agent.config")
+              ).and_return(true)
+              expect(File).to receive(:open).with(
+                File.join(Dir.getwd, "config/tcell_agent.config")
+              ).and_return(@config_file)
+              expect(File).to receive(:file?).with("config/tcell_agent_payloads.config").and_return(true)
+              expect(File).to receive(:open).with("config/tcell_agent_payloads.config").and_return(payloads_file)
+              configuration = TCellAgent::Configuration.new
+
+              expect(configuration.allow_unencrypted_appsensor_payloads).to eq(true)
+              expect(configuration.blacklisted_params).to eq({
+                "token" => true,
+                "client_secret" => true,
+                "password" => true,
+                "passwd" => true,
+                "refresh_token" => true,
+                "pf.pass" => true,
+                "user.password" => true
+              })
+              expect(configuration.whitelisted_params).to eq({"passwd" => true})
+              expect(configuration.whitelist_present).to eq(true)
+            end
+          end
+
+          context "with blacklist and whitelist present" do
+            it "should set whitelist and blacklist" do
+              payloads_file = double("payloads", read: {blacklisted: ["ssn"], whitelisted: ["passwd"]}.to_json)
+              expect(File).to receive(:file?).with(
+                File.join(Dir.getwd, "config/tcell_agent.config")
+              ).and_return(true)
+              expect(File).to receive(:open).with(
+                File.join(Dir.getwd, "config/tcell_agent.config")
+              ).and_return(@config_file)
+              expect(File).to receive(:file?).with("config/tcell_agent_payloads.config").and_return(true)
+              expect(File).to receive(:open).with("config/tcell_agent_payloads.config").and_return(payloads_file)
+              configuration = TCellAgent::Configuration.new
+
+              expect(configuration.allow_unencrypted_appsensor_payloads).to eq(true)
+              expect(configuration.blacklisted_params).to eq({"ssn" => true})
+              expect(configuration.whitelisted_params).to eq({"passwd" => true})
+              expect(configuration.whitelist_present).to eq(true)
+            end
+          end
+        end
+      end
+
+    end
+
+    describe "#agent_home_dir" do
+      context "no TCELL_AGENT_HOME defined" do
+        it "should set cache file, config, and log file to defaults" do
+          configuration = Configuration.new
+
+          expect(configuration.cache_filename).to eq(
+            File.join(Dir.getwd, "tcell/cache/tcell_agent.cache")
+          )
+          expect(configuration.log_filename).to eq(
+            File.join(Dir.getwd, "tcell/logs/tcell_agent.log")
+          )
+          expect(configuration.config_filename).to eq(
+            File.join(Dir.getwd, "config/tcell_agent.config")
+          )
+        end
+      end
+
+      context "TCELL_AGENT_HOME defined" do
+        it "should set config filename to default, cache file and log file are updated" do
+          old_tcell_agent_home = ENV["TCELL_AGENT_HOME"]
+
+          ENV["TCELL_AGENT_HOME"] = "spec_tcell_home"
+
+          expect(FileUtils).to receive(:mkdir_p).with("spec_tcell_home/cache")
+          expect(FileUtils).to receive(:mkdir_p).with("spec_tcell_home/logs")
+
+          configuration = Configuration.new
+
+          expect(configuration.cache_filename).to eq(
+            "spec_tcell_home/cache/tcell_agent.cache"
+          )
+          expect(configuration.log_filename).to eq(
+            "spec_tcell_home/logs/tcell_agent.log"
+          )
+          expect(configuration.config_filename).to eq(
+            File.join(Dir.getwd, "config/tcell_agent.config")
+          )
+
+          ENV["TCELL_AGENT_HOME"] = old_tcell_agent_home
+        end
+      end
+
+      context "TCELL_AGENT_HOME and TCELL_AGENT_LOG_DIR defined" do
+        it "should set config filename to default, cache file and log file are updated" do
+          old_tcell_agent_home = ENV["TCELL_AGENT_HOME"]
+          old_tcell_agent_log_dir = ENV["TCELL_AGENT_LOG_DIR"]
+
+          ENV["TCELL_AGENT_HOME"] = "spec_tcell_home"
+          ENV["TCELL_AGENT_LOG_DIR"] = "spec_tcell_log_dir"
+
+          expect(FileUtils).to receive(:mkdir_p).with("spec_tcell_home/cache")
+          expect(FileUtils).to receive(:mkdir_p).with("spec_tcell_log_dir")
+
+          configuration = Configuration.new
+
+          expect(configuration.cache_filename).to eq(
+            "spec_tcell_home/cache/tcell_agent.cache"
+          )
+          expect(configuration.log_filename).to eq(
+            "spec_tcell_log_dir/tcell_agent.log"
+          )
+          expect(configuration.config_filename).to eq(
+            File.join(Dir.getwd, "config/tcell_agent.config")
+          )
+
+          ENV["TCELL_AGENT_HOME"] = old_tcell_agent_home
+          ENV["TCELL_AGENT_LOG_DIR"] = old_tcell_agent_log_dir
+        end
+      end
+
+      context "TCELL_AGENT_HOME, TCELL_AGENT_LOG_DIR, and TCELL_AGENT_CONFIG defined " do
+        it "should update config filename, cache file, and log file" do
+          old_tcell_agent_home = ENV["TCELL_AGENT_HOME"]
+          old_tcell_agent_log_dir = ENV["TCELL_AGENT_LOG_DIR"]
+          old_config_filename = ENV["TCELL_AGENT_CONFIG"]
+
+          ENV["TCELL_AGENT_HOME"] = "spec_tcell_home"
+          ENV["TCELL_AGENT_LOG_DIR"] = "spec_tcell_log_dir"
+          ENV["TCELL_AGENT_CONFIG"] = "spec_config/tcell_agent.config"
+
+          expect(FileUtils).to receive(:mkdir_p).with("spec_tcell_log_dir")
+          expect(FileUtils).to receive(:mkdir_p).with("spec_tcell_home/cache")
+
+          configuration = Configuration.new
+
+          expect(configuration.cache_filename).to eq(
+            "spec_tcell_home/cache/tcell_agent.cache"
+          )
+          expect(configuration.log_filename).to eq(
+            "spec_tcell_log_dir/tcell_agent.log"
+          )
+          expect(configuration.config_filename).to eq(
+            "spec_config/tcell_agent.config"
+          )
+
+          ENV["TCELL_AGENT_HOME"] = old_tcell_agent_home
+          ENV["TCELL_AGENT_LOG_DIR"] = old_tcell_agent_log_dir
+          ENV["TCELL_AGENT_CONFIG"] = old_config_filename
+        end
+      end
+    end
+
+    describe "#data_exposure" do
+      context "no data_exposure defined" do
+        it "should set max_data_ex_db_records_per_request to default" do
+          no_data_ex = double(
+            "no_data_ex",
+            read: {
+              version: 1,
+              applications: [
+                app_id: "app_id",
+                name: "test",
+                api_key: "api_key"
+              ]
+            }.to_json
+          )
+          expect(File).to receive(:file?).with(
+            File.join(Dir.getwd, "no_data_ex.config")
+          ).and_return(true)
+          expect(File).to receive(:open).with(
+            File.join(Dir.getwd, "no_data_ex.config")
+          ).and_return(no_data_ex)
+          expect(File).to receive(:file?).with(
+            "config/tcell_agent_payloads.config"
+          ).and_return(false)
+          configuration = Configuration.new("no_data_ex.config")
+
+          expect(configuration.max_data_ex_db_records_per_request).to eq(1000)
+        end
+      end
+
+      context "data_exposure is empty" do
+        it "should set max_data_ex_db_records_per_request to default" do
+          no_data_ex = double(
+            "no_data_ex",
+            read: {
+              version: 1,
+              applications: [
+                app_id: "app_id",
+                name: "test",
+                api_key: "api_key",
+                data_exposure: {}
+              ]
+            }.to_json
+          )
+          expect(File).to receive(:file?).with(
+            File.join(Dir.getwd, "no_data_ex.config")
+          ).and_return(true)
+          expect(File).to receive(:open).with(
+            File.join(Dir.getwd, "no_data_ex.config")
+          ).and_return(no_data_ex)
+          expect(File).to receive(:file?).with(
+            "config/tcell_agent_payloads.config"
+          ).and_return(false)
+          configuration = Configuration.new("no_data_ex.config")
+
+          expect(configuration.max_data_ex_db_records_per_request).to eq(1000)
+        end
+      end
+
+      context "data_exposure contains an override" do
+        it "should set max_data_ex_db_records_per_request to override" do
+          no_data_ex = double(
+            "no_data_ex",
+            read: {
+              version: 1,
+              applications: [
+                app_id: "app_id",
+                name: "test",
+                api_key: "api_key",
+                data_exposure: {
+                  max_data_ex_db_records_per_request: 5000
+                }
+              ]
+            }.to_json
+          )
+          expect(File).to receive(:file?).with(
+            File.join(Dir.getwd, "no_data_ex.config")
+          ).and_return(true)
+          expect(File).to receive(:open).with(
+            File.join(Dir.getwd, "no_data_ex.config")
+          ).and_return(no_data_ex)
+          expect(File).to receive(:file?).with(
+            "config/tcell_agent_payloads.config"
+          ).and_return(false)
+          configuration = Configuration.new("no_data_ex.config")
+
+          expect(configuration.max_data_ex_db_records_per_request).to eq(5000)
+        end
+      end
+    end
+
+  end
+
+end

data/spec/lib/tcell_agent/rails/middleware/appsensor_middleware_spec.rb

@@ -64,24 +64,24 @@ module TCellAgent
               end
               it "alerts on get xss payload" do
                 response = request.get("/foo?xyz=%3Cscript%3Ealert(1)%3C%2Fscript%3E", 'REMOTE_ADDR' => '1.3.3.4,3.4.5.6')
-                expected_as = {"event_type"=>"as", "dp"=>"xss", "param"=>"xyz", "remote_addr"=>"1.3.3.4", "m"=>"GET", "loc"=>"/foo?xyz=", "tid"=>"a-b-c-d-e-f"}
+                expected_as = {"event_type"=>"as", "dp"=>"xss", "param"=>"xyz", "remote_addr"=>"1.3.3.4", "m"=>"GET", "loc"=>"http://example.org/foo?xyz=", "tid"=>"a-b-c-d-e-f"}
                 expect(TCellAgent.event_queue).to include(expected_as)
               end
               it "alerts on post xss payload" do
                 response = request.post("/foo", :input => "x=<script>alert(1)</script>", 'REMOTE_ADDR' => '1.2.3.4,3.4.5.6')
-                expected_as = {"event_type"=>"as", "dp"=>"xss", "param"=>"x", "remote_addr"=>"1.2.3.4", "m"=>"POST", "loc"=>"/foo", "tid"=>"a-b-c-d-e-f"}
+                expected_as = {"event_type"=>"as", "dp"=>"xss", "param"=>"x", "remote_addr"=>"1.2.3.4", "m"=>"POST", "loc"=>"http://example.org/foo", "tid"=>"a-b-c-d-e-f"}
                 expect(TCellAgent.event_queue).to include(expected_as)
               end #/it
               it "alerts on get xss payload with route_id" do
                 response = request2.get("/foo?xyz=%3Cscript%3Ealert(1)%3C%2Fscript%3E")
-                expected_as = {"event_type"=>"as", "dp"=>"xss", "param"=>"xyz", "remote_addr"=>nil, "rou"=>"myrouteid", "m"=>"GET", "loc"=>"/foo?xyz=", "tid"=>"a-b-c-d-e-f"}
+                expected_as = {"event_type"=>"as", "dp"=>"xss", "param"=>"xyz", "remote_addr"=>nil, "rou"=>"myrouteid", "m"=>"GET", "loc"=>"http://example.org/foo?xyz=", "tid"=>"a-b-c-d-e-f"}
                 expect(TCellAgent.event_queue).to include(expected_as)
               end
               it "checks that payload is sent in xss with route_id" do
                 old_uap = TCellAgent.configuration.allow_unencrypted_appsensor_payloads
                 TCellAgent.configuration.allow_unencrypted_appsensor_payloads = true
                 response = request2.get("/foo?xyz=%3Cscript%3Ealert(1)%3C%2Fscript%3E")
-                expected_as = {"event_type"=>"as", "dp"=>"xss", "param"=>"xyz", "remote_addr"=>nil, "rou"=>"myrouteid", "m"=>"GET", "loc"=>"/foo?xyz=", "tid"=>"a-b-c-d-e-f", "payload"=>"<script>alert(1)</script>"}
+                expected_as = {"event_type"=>"as", "dp"=>"xss", "param"=>"xyz", "remote_addr"=>nil, "rou"=>"myrouteid", "m"=>"GET", "loc"=>"http://example.org/foo?xyz=", "tid"=>"a-b-c-d-e-f", "payload"=>"<script>alert(1)</script>"}
                 TCellAgent.configuration.allow_unencrypted_appsensor_payloads = old_uap
                 expect(TCellAgent.event_queue).to include(expected_as)
               end
@@ -104,7 +104,7 @@ module TCellAgent
               it "alerts on get sqli payload" do
                 # ' OR '3'='3
                 response = request.get("/foo?xyz=abds&def=%27%20OR%20%273%27%3D%273", 'REMOTE_ADDR' => '1.3.3.4,3.4.5.6')
-                expected_as = {"event_type"=>"as", "dp"=>"sqli", "param"=>"def", "remote_addr"=>"1.3.3.4", "m"=>"GET", "loc"=>"/foo?xyz=&def=", "tid"=>"a-b-c-d-e-f"}
+                expected_as = {"event_type"=>"as", "dp"=>"sqli", "param"=>"def", "remote_addr"=>"1.3.3.4", "m"=>"GET", "loc"=>"http://example.org/foo?xyz=&def=", "tid"=>"a-b-c-d-e-f"}
                 expect(TCellAgent.event_queue).to include(expected_as)
               end
             end #/conext
@@ -124,14 +124,14 @@ module TCellAgent
               end
               it "alerts on most obvious payload" do
                 response = request.get("/foo?xyz=/etc/passwd", 'REMOTE_ADDR' => '1.3.3.4,3.4.5.6')
-                expected_as = {"event_type"=>"as", "dp"=>"fpt", "param"=>"xyz", "remote_addr"=>"1.3.3.4", "m"=>"GET", "loc"=>"/foo?xyz=", "tid"=>"a-b-c-d-e-f"}
+                expected_as = {"event_type"=>"as", "dp"=>"fpt", "param"=>"xyz", "remote_addr"=>"1.3.3.4", "m"=>"GET", "loc"=>"http://example.org/foo?xyz=", "tid"=>"a-b-c-d-e-f"}
                 expect(TCellAgent.event_queue).to include(expected_as)
               end
               it "checks that payload is sent" do
                 old_uap = TCellAgent.configuration.allow_unencrypted_appsensor_payloads
                 TCellAgent.configuration.allow_unencrypted_appsensor_payloads = true
                 response = request.get("/foo?xyz=/etc/passwd", 'REMOTE_ADDR' => '1.3.3.4,3.4.5.6')
-                expected_as = {"event_type"=>"as", "dp"=>"fpt", "param"=>"xyz", "remote_addr"=>"1.3.3.4", "m"=>"GET", "loc"=>"/foo?xyz=", "tid"=>"a-b-c-d-e-f", "payload"=>"/etc/passwd"}
+                expected_as = {"event_type"=>"as", "dp"=>"fpt", "param"=>"xyz", "remote_addr"=>"1.3.3.4", "m"=>"GET", "loc"=>"http://example.org/foo?xyz=", "tid"=>"a-b-c-d-e-f", "payload"=>"/etc/passwd"}
                 TCellAgent.configuration.allow_unencrypted_appsensor_payloads = old_uap
                 expect(TCellAgent.event_queue).to include(expected_as)
               end

data/spec/lib/tcell_agent/sensor_events/tcell_app_sensor_event_processor_spec.rb

@@ -0,0 +1,289 @@
+require 'spec_helper'
+
+module TCellAgent
+  module SensorEvents
+
+    describe TCellAppSensorEventProcessor do
+
+      describe "#appsensor_event" do
+        before(:each) do
+          @app_sensor_event_process = TCellAppSensorEventProcessor.new
+        end
+
+        context "whitelist not present" do
+          context "a term that is blacklisted" do
+            it "should obfuscate the payload" do
+              event = double("event")
+              configuration = double(
+                "configuration",
+                whitelist_present: false,
+                raise_exceptions: true,
+                blacklisted_params: double("bp", {"passwd" => true, "has_key?" => true})
+              )
+
+              expect(TCellAgent).to receive(:configuration).and_return(configuration)
+              expect(TCellAgent::SensorEvents::TCellAppSensorEvent).to receive(:new).with(
+                nil,
+                "xss",
+                nil,
+                nil,
+                "PASSWD",
+                nil,
+                nil,
+                nil,
+                nil,
+                nil,
+                "BLACKLISTED"
+              ).and_return(event)
+              expect(TCellAgent).to receive(:send_event)
+
+              @app_sensor_event_process.appsensor_event("xss", "PASSWD", nil, "%3Cscript%3Ealert(1)%3C%2Fscript%3E")
+            end
+          end
+
+          context "a term that is not blacklisted" do
+            it "should not obfuscate the payload" do
+              event = double("event")
+              configuration = double(
+                "configuration",
+                whitelist_present: false,
+                raise_exceptions: true,
+                blacklisted_params: double("bp", {"has_key?" => false})
+              )
+
+              expect(TCellAgent).to receive(:configuration).and_return(configuration)
+              expect(TCellAgent).to receive(:configuration).and_return(configuration)
+              expect(TCellAgent::SensorEvents::TCellAppSensorEvent).to receive(:new).with(
+                nil,
+                "xss",
+                nil,
+                nil,
+                "PASSWD",
+                nil,
+                nil,
+                nil,
+                nil,
+                nil,
+                "%3Cscript%3Ealert(1)%3C%2Fscript%3E"
+              ).and_return(event)
+              expect(TCellAgent).to receive(:send_event)
+
+              @app_sensor_event_process.appsensor_event("xss", "PASSWD", nil, "%3Cscript%3Ealert(1)%3C%2Fscript%3E")
+            end
+          end
+        end
+
+        context "whitelist present" do
+          context "a term is whitelisted" do
+            context "a term that is blacklisted" do
+              it "should obfuscate the payload" do
+                event = double("event")
+                configuration = double(
+                  "configuration",
+                  whitelist_present: true,
+                  raise_exceptions: true,
+                  blacklisted_params: double("bp", {"passwd" => true, "has_key?" => true}),
+                  whitelisted_params: double("wp", {"passwd" => true, "has_key?" => true})
+                )
+
+                expect(TCellAgent).to receive(:configuration).and_return(configuration)
+                expect(TCellAgent::SensorEvents::TCellAppSensorEvent).to receive(:new).with(
+                  nil,
+                  "xss",
+                  nil,
+                  nil,
+                  "PASSWD",
+                  nil,
+                  nil,
+                  nil,
+                  nil,
+                  nil,
+                  "BLACKLISTED"
+                ).and_return(event)
+                expect(TCellAgent).to receive(:send_event)
+
+                @app_sensor_event_process.appsensor_event("xss", "PASSWD", nil, "%3Cscript%3Ealert(1)%3C%2Fscript%3E")
+              end
+            end
+
+            context "a term that is not blacklisted" do
+              it "should not obfuscate the payload" do
+                event = double("event")
+                configuration = double(
+                  "configuration",
+                  whitelist_present: true,
+                  raise_exceptions: true,
+                  blacklisted_params: double("bp", {"has_key?" => false}),
+                  whitelisted_params: double("wp", {"passwd" => true, "has_key?" => true})
+                )
+
+                expect(TCellAgent).to receive(:configuration).and_return(configuration)
+                expect(TCellAgent).to receive(:configuration).and_return(configuration)
+                expect(TCellAgent).to receive(:configuration).and_return(configuration)
+                expect(TCellAgent::SensorEvents::TCellAppSensorEvent).to receive(:new).with(
+                  nil,
+                  "xss",
+                  nil,
+                  nil,
+                  "PASSWD",
+                  nil,
+                  nil,
+                  nil,
+                  nil,
+                  nil,
+                  "%3Cscript%3Ealert(1)%3C%2Fscript%3E"
+                ).and_return(event)
+                expect(TCellAgent).to receive(:send_event)
+
+                @app_sensor_event_process.appsensor_event("xss", "PASSWD", nil, "%3Cscript%3Ealert(1)%3C%2Fscript%3E")
+              end
+            end
+          end
+
+          context "a term is not whitelisted" do
+            context "a term that is blacklisted" do
+              it "should obfuscate the payload" do
+                event = double("event")
+                configuration = double(
+                  "configuration",
+                  whitelist_present: true,
+                  raise_exceptions: true,
+                  blacklisted_params: double("bp", {"passwd" => true, "has_key?" => true}),
+                  whitelisted_params: double("wp", {"has_key?" => false})
+                )
+
+                expect(TCellAgent).to receive(:configuration).and_return(configuration)
+                expect(TCellAgent::SensorEvents::TCellAppSensorEvent).to receive(:new).with(
+                  nil,
+                  "xss",
+                  nil,
+                  nil,
+                  "PASSWD",
+                  nil,
+                  nil,
+                  nil,
+                  nil,
+                  nil,
+                  "BLACKLISTED"
+                ).and_return(event)
+                expect(TCellAgent).to receive(:send_event)
+
+                @app_sensor_event_process.appsensor_event("xss", "PASSWD", nil, "%3Cscript%3Ealert(1)%3C%2Fscript%3E")
+              end
+            end
+
+            context "a term that is not blacklisted" do
+              it "should obfuscate the payload" do
+                event = double("event")
+                configuration = double(
+                  "configuration",
+                  whitelist_present: true,
+                  raise_exceptions: true,
+                  blacklisted_params: double("bp", {"has_key?" => false}),
+                  whitelisted_params: double("wp", {"has_key?" => false})
+                )
+
+                expect(TCellAgent).to receive(:configuration).and_return(configuration)
+                expect(TCellAgent).to receive(:configuration).and_return(configuration)
+                expect(TCellAgent).to receive(:configuration).and_return(configuration)
+                expect(TCellAgent::SensorEvents::TCellAppSensorEvent).to receive(:new).with(
+                  nil,
+                  "xss",
+                  nil,
+                  nil,
+                  "PASSWD",
+                  nil,
+                  nil,
+                  nil,
+                  nil,
+                  nil,
+                  "NOT_WHITELISTED"
+                ).and_return(event)
+                expect(TCellAgent).to receive(:send_event)
+
+                @app_sensor_event_process.appsensor_event("xss", "PASSWD", nil, "%3Cscript%3Ealert(1)%3C%2Fscript%3E")
+              end
+            end
+          end
+        end
+      end
+
+      describe "#for_params" do
+        context "with body_params" do
+          it "should iterate over body params" do
+            app_sensor_event_process = TCellAppSensorEventProcessor.new
+            app_sensor_event_process.request_content_length = 67
+            app_sensor_event_process.request_content_type = "application/json"
+            app_sensor_event_process.request_body = {username:"tester",password:"pass"}.to_json
+
+            expect(app_sensor_event_process.body_params).to eq({"username"=>"tester","password"=>"pass"})
+
+            iterated_over = {}
+
+            app_sensor_event_process.for_params do |method, param_name, param_value|
+              iterated_over[param_name] = param_value
+            end
+
+            expect(iterated_over).to eq({"username"=>"tester", "password"=>"pass"})
+          end
+        end
+      end
+
+      describe "#body_params" do
+        context "with text/html content type" do
+          it "should set the body params to empty" do
+            app_sensor_event_process = TCellAppSensorEventProcessor.new
+            app_sensor_event_process.request_content_length = 67
+            app_sensor_event_process.request_content_type = "text/html"
+            app_sensor_event_process.request_body = {username:"tester",password:"pass"}.to_json
+
+            expect(app_sensor_event_process.body_params).to eq({})
+          end
+        end
+
+        context "with application/json content type" do
+          before(:each) do
+            @app_sensor_event_process = TCellAppSensorEventProcessor.new
+            @app_sensor_event_process.request_content_length = 67
+            @app_sensor_event_process.request_content_type = "application/json"
+          end
+
+          context "with empty request body" do
+            it "should set the body params to empty" do
+              @app_sensor_event_process.request_body = nil
+
+              expect(@app_sensor_event_process.body_params).to eq({})
+            end
+          end
+
+          context "with bad json in the body" do
+            it "should set the body params to empty" do
+              @app_sensor_event_process.request_body = '{"username":"tester""password":"pass"}'
+
+              expect(@app_sensor_event_process.body_params).to eq({})
+            end
+          end
+
+          context "with valid json in the body" do
+            it "should set the body params" do
+              @app_sensor_event_process.request_body = {username:"tester",password:"pass"}.to_json
+
+              expect(@app_sensor_event_process.body_params).to eq({"username"=>"tester","password"=>"pass"})
+            end
+          end
+
+          context "with a json body that's too big" do
+            it "should set the body params to empty" do
+              @app_sensor_event_process.request_content_length = 2000000
+              @app_sensor_event_process.request_body = '{"username":"tester""password":"pass"}'
+
+              expect(@app_sensor_event_process.body_params).to eq({})
+            end
+          end
+        end
+      end
+
+    end
+
+  end
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: tcell_agent
 version: !ruby/object:Gem::Version
-  version: 0.2.10
+  version: 0.2.11
 platform: ruby
 authors:
 - Garrett
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-03-08 00:00:00.000000000 Z
+date: 2016-04-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rest-client
@@ -234,6 +234,7 @@ files:
 - spec/lib/tcell_agent/agent/static_agent_spec.rb
 - spec/lib/tcell_agent/api/api_spec.rb
 - spec/lib/tcell_agent/appsensor_spec.rb
+- spec/lib/tcell_agent/configuration_spec.rb
 - spec/lib/tcell_agent/instrumentation_spec.rb
 - spec/lib/tcell_agent/policies/appsensor_policy_spec.rb
 - spec/lib/tcell_agent/policies/clickjacking_policy_spec.rb
@@ -252,6 +253,7 @@ files:
 - spec/lib/tcell_agent/rails_spec.rb
 - spec/lib/tcell_agent/sensor_events/dlp_spec.rb
 - spec/lib/tcell_agent/sensor_events/sessions_metric_spec.rb
+- spec/lib/tcell_agent/sensor_events/tcell_app_sensor_event_processor_spec.rb
 - spec/lib/tcell_agent/sensor_events/util/redirect_utils_spec.rb
 - spec/lib/tcell_agent/sensor_events/util/sanitizer_utilities_spec.rb
 - spec/lib/tcell_agent/utils/bounded_queue_spec.rb
@@ -338,6 +340,7 @@ test_files:
 - spec/lib/tcell_agent/agent/static_agent_spec.rb
 - spec/lib/tcell_agent/api/api_spec.rb
 - spec/lib/tcell_agent/appsensor_spec.rb
+- spec/lib/tcell_agent/configuration_spec.rb
 - spec/lib/tcell_agent/instrumentation_spec.rb
 - spec/lib/tcell_agent/policies/appsensor_policy_spec.rb
 - spec/lib/tcell_agent/policies/clickjacking_policy_spec.rb
@@ -356,6 +359,7 @@ test_files:
 - spec/lib/tcell_agent/rails_spec.rb
 - spec/lib/tcell_agent/sensor_events/dlp_spec.rb
 - spec/lib/tcell_agent/sensor_events/sessions_metric_spec.rb
+- spec/lib/tcell_agent/sensor_events/tcell_app_sensor_event_processor_spec.rb
 - spec/lib/tcell_agent/sensor_events/util/redirect_utils_spec.rb
 - spec/lib/tcell_agent/sensor_events/util/sanitizer_utilities_spec.rb
 - spec/lib/tcell_agent/utils/bounded_queue_spec.rb