tcell_agent 0.2.19 → 0.2.21

data/spec/lib/tcell_agent/policies/appsensor/xss_sensor_spec.rb

@@ -1,3 +1,5 @@
+# encoding: utf-8
+
 require 'spec_helper'
 
 module TCellAgent
@@ -166,6 +168,48 @@ module TCellAgent
           @sensor = XssSensor.new({"enabled" => true})
         end
 
+        context "with libinjection enabled" do
+          context "with param value that doesn't match any vulnerabilities" do
+            it "should return nil" do
+              @sensor.libinjection = true
+
+              ruleset = double("ruleset")
+              expect(@sensor).to receive(:get_ruleset).and_return(ruleset)
+              expect(ruleset).to receive(:check_violation).with(
+                "param", "value", {}, false
+              ).and_return(nil)
+
+              expect(@sensor.find_vulnerability("param", "value")).to eq(nil)
+            end
+
+            context "and it has utf-8 chars" do
+              it "should return nil but not fail miserably" do
+                @sensor.libinjection = true
+
+                ruleset = double("ruleset")
+                expect(@sensor).to receive(:get_ruleset).and_return(ruleset)
+                expect(ruleset).to receive(:check_violation).with(
+                  "param", "Müller", {}, false
+                ).and_return(nil)
+
+                expect(@sensor.find_vulnerability("param", "Müller")).to eq(nil)
+              end
+            end
+          end
+
+          context "with param value that matches a vulnerability" do
+            it "should return the param and it's value" do
+              @sensor.libinjection = true
+
+              expect(@sensor).to_not receive(:get_ruleset)
+
+              expect(@sensor.find_vulnerability("param_name", "<script>")).to eq(
+                {"param"=>"param_name", "value"=>"<script>", "pattern"=>"li"}
+              )
+            end
+          end
+        end
+
         context "with no ruleset" do
           it "should return nil" do
             expect(@sensor).to receive(:get_ruleset).and_return(nil)
@@ -203,6 +247,8 @@ module TCellAgent
 
       describe "#check" do
         before(:each) do
+          @payloads_policy = double("payloads_policy")
+
           @meta = TCellAgent::SensorEvents::AppSensorMetaEvent.new
           @meta.remote_address = "remote_address"
           @meta.method = "get"
@@ -215,8 +261,10 @@ module TCellAgent
 
         context "disabled sensor" do
           it "should return false" do
+            expect(@payloads_policy).to_not receive(:apply)
+
             sensor = XssSensor.new({"enabled" => false})
-            result = sensor.check(XssSensor::GET_PARAM, @meta, "param_name", "param_value")
+            result = sensor.check(XssSensor::GET_PARAM, @meta, "param_name", "param_value", @payloads_policy)
 
             expect(result).to eq(false)
           end
@@ -229,8 +277,16 @@ module TCellAgent
 
           context "param has NO vulnerability" do
             it "should return false" do
+              expect(@payloads_policy).to_not receive(:apply)
+
               sensor = XssSensor.new({"enabled" => false})
-              result = sensor.check(XssSensor::GET_PARAM, @meta, "param_name", "param_value")
+              result = sensor.check(
+                XssSensor::GET_PARAM,
+                @meta,
+                "param_name",
+                "param_value",
+                @payloads_policy
+              )
 
               expect(result).to eq(false)
             end
@@ -238,7 +294,7 @@ module TCellAgent
             context "no excluded routes" do
               it "should return false" do
                 sensor = XssSensor.new({"enabled" => false, "exclude_routes" => []})
-                result = sensor.check(XssSensor::GET_PARAM, @meta, "param_name", "param_value")
+                result = sensor.check(XssSensor::GET_PARAM, @meta, "param_name", "param_value", @payloads_policy)
 
                 expect(result).to eq(false)
               end
@@ -248,7 +304,7 @@ module TCellAgent
               context "route id matches" do
                 it "should return false" do
                   sensor = XssSensor.new({"enabled" => false, "exclude_routes" => ["route_id"]})
-                  result = sensor.check(XssSensor::GET_PARAM, @meta, "param_name", "param_value")
+                  result = sensor.check(XssSensor::GET_PARAM, @meta, "param_name", "param_value", @payloads_policy)
 
                   expect(result).to eq(false)
                 end
@@ -256,7 +312,7 @@ module TCellAgent
               context "route id does not match" do
                 it "should return false" do
                   sensor = XssSensor.new({"enabled" => false, "exclude_routes" => ["unmatching_route_id"]})
-                  result = sensor.check(XssSensor::GET_PARAM, @meta, "param_name", "param_value")
+                  result = sensor.check(XssSensor::GET_PARAM, @meta, "param_name", "param_value", @payloads_policy)
 
                   expect(result).to eq(false)
                 end
@@ -265,17 +321,64 @@ module TCellAgent
           end
 
           context "param has a vulnerability" do
+            context "param is a URI param" do
+              context "exclude forms sensor" do
+                it "should return false" do
+                  @sensor.exclude_forms = true
+                  @sensor.exclude_cookies = false
+
+                  expect(@payloads_policy).to_not receive(:apply)
+                  expect(@sensor).to_not receive(:find_vulnerability)
+                  expect(@sensor).to_not receive(:send_event)
+
+                  result = @sensor.check(XssSensor::URI_PARAM, @meta, "param_name", "param_value", @payloads_policy)
+
+                  expect(result).to eq(false)
+                end
+              end
+
+              context "exclude cookies sensor" do
+                it "should return true" do
+                  @sensor.exclude_forms = false
+                  @sensor.exclude_cookies = true
+
+                  expect(@payloads_policy).to receive(:apply).and_return("vuln_value")
+                  expect(@sensor).to receive(:find_vulnerability).and_return(
+                    {"param" => "vuln_param", "value" => "vuln_value", "pattern" => "1"}
+                  )
+                  expect(@sensor).to receive(:send_event).with(
+                    @meta,
+                    "xss",
+                    "vuln_param",
+                    {"l" => XssSensor::PARAM_TYPE_TO_L[XssSensor::URI_PARAM]},
+                    "vuln_value",
+                    "1"
+                  )
+
+                  result = @sensor.check(XssSensor::URI_PARAM, @meta, "param_name", "param_value", @payloads_policy)
+
+                  expect(result).to eq(true)
+                end
+              end
+            end
+
             context "param is a GET param" do
               context "exclude forms sensor" do
                 it "should return false" do
                   @sensor.exclude_forms = true
                   @sensor.exclude_cookies = false
 
-                  expect(TCellAgent).to_not receive(:configuration)
+                  expect(@payloads_policy).to_not receive(:apply)
                   expect(@sensor).to_not receive(:find_vulnerability)
                   expect(@sensor).to_not receive(:send_event)
 
-                  result = @sensor.check(XssSensor::GET_PARAM, @meta, "param_name", "param_value")
+                  result = @sensor.check(
+                    XssSensor::GET_PARAM,
+                    @meta,
+                    "param_name",
+                    "param_value",
+                    @payloads_policy
+                  )
 
                   expect(result).to eq(false)
                 end
@@ -286,11 +389,11 @@ module TCellAgent
                     @sensor.exclude_cookies = false
                     @sensor.excluded_route_ids = {}
 
-                    expect(TCellAgent).to_not receive(:configuration)
+                    expect(@payloads_policy).to_not receive(:apply)
                     expect(@sensor).to_not receive(:find_vulnerability)
                     expect(@sensor).to_not receive(:send_event)
 
-                    result = @sensor.check(XssSensor::GET_PARAM, @meta, "param_name", "param_value")
+                    result = @sensor.check(XssSensor::GET_PARAM, @meta, "param_name", "param_value", @payloads_policy)
 
                     expect(result).to eq(false)
                   end
@@ -303,11 +406,11 @@ module TCellAgent
                       @sensor.exclude_cookies = false
                       @sensor.excluded_route_ids = {"route_id" => true}
 
-                      expect(TCellAgent).to_not receive(:configuration)
+                      expect(@payloads_policy).to_not receive(:apply)
                       expect(@sensor).to_not receive(:find_vulnerability)
                       expect(@sensor).to_not receive(:send_event)
 
-                      result = @sensor.check(XssSensor::GET_PARAM, @meta, "param_name", "param_value")
+                      result = @sensor.check(XssSensor::GET_PARAM, @meta, "param_name", "param_value", @payloads_policy)
 
                       expect(result).to eq(false)
                     end
@@ -318,11 +421,11 @@ module TCellAgent
                       @sensor.exclude_cookies = false
                       @sensor.excluded_route_ids = {"unmatching_route_id" => true}
 
-                      expect(TCellAgent).to_not receive(:configuration)
+                      expect(@payloads_policy).to_not receive(:apply)
                       expect(@sensor).to_not receive(:find_vulnerability)
                       expect(@sensor).to_not receive(:send_event)
 
-                      result = @sensor.check(XssSensor::GET_PARAM, @meta, "param_name", "param_value")
+                      result = @sensor.check(XssSensor::GET_PARAM, @meta, "param_name", "param_value", @payloads_policy)
 
                       expect(result).to eq(false)
                     end
@@ -334,290 +437,53 @@ module TCellAgent
                 it "should return true" do
                   @sensor.exclude_forms = false
                   @sensor.exclude_cookies = true
-                  configuration = double(
-                    "configuration",
-                    allow_unencrypted_appfirewall_payloads_logging: false,
-                    allow_unencrypted_appfirewall_payloads: true,
-                    blacklisted_params: {},
-                    whitelist_present: false
-                  )
 
                   expect(@sensor).to receive(:find_vulnerability).and_return(
                     {"param" => "vuln_param", "value" => "vuln_value", "pattern" => "1"}
                   )
-                  expect(TCellAgent).to receive(:configuration).and_return(configuration).at_least(:once)
+                  expect(@payloads_policy).to receive(:apply).and_return("vuln_value")
                   expect(@sensor).to receive(:send_event).with(
                     @meta,
                     "xss",
                     "vuln_param",
-                    {"t" => XssSensor::GET_PARAM}.to_json,
+                    {"l" => XssSensor::PARAM_TYPE_TO_L[XssSensor::GET_PARAM]},
                     "vuln_value",
                     "1"
                   )
 
-                  result = @sensor.check(XssSensor::GET_PARAM, @meta, "param_name", "param_value")
+                  result = @sensor.check(
+                    XssSensor::GET_PARAM,
+                    @meta,
+                    "param_name",
+                    "param_value",
+                    @payloads_policy
+                  )
 
                   expect(result).to eq(true)
                 end
 
-                context "allow_unencrypted_appfirewall_payloads is false" do
-                   context "param is blacklisted" do
-                     it "should return true" do
-                       @sensor.exclude_forms = false
-                       @sensor.exclude_cookies = true
-
-                       configuration = double(
-                         "configuration",
-                         allow_unencrypted_appfirewall_payloads_logging: false,
-                         allow_unencrypted_appfirewall_payloads: false,
-                         blacklisted_params: {"vuln_param" => true},
-                         whitelist_present: false
-                       )
-
-                       expect(@sensor).to receive(:find_vulnerability).and_return(
-                         {"param" => "vuln_param", "value" => "vuln_value", "pattern" => "1"}
-                       )
-                       expect(TCellAgent).to receive(:configuration).and_return(configuration).at_least(:once)
-                       expect(@sensor).to receive(:send_event).with(
-                         @meta,
-                         "xss",
-                         "vuln_param",
-                         {"t" => XssSensor::GET_PARAM}.to_json,
-                         nil,
-                         "1"
-                       )
-
-                       result = @sensor.check(XssSensor::GET_PARAM, @meta, "param_name", "param_value")
-
-                       expect(result).to eq(true)
-                     end
-                   end
-
-                   context "param is whitelisted" do
-                     it "should return true" do
-                       @sensor.exclude_forms = false
-                       @sensor.exclude_cookies = true
-
-                       configuration = double(
-                         "configuration",
-                         allow_unencrypted_appfirewall_payloads_logging: false,
-                         allow_unencrypted_appfirewall_payloads: false,
-                         blacklisted_params: {},
-                         whitelist_present: true,
-                         whitelisted_params: {"vuln_param" => true}
-                       )
-
-                       expect(@sensor).to receive(:find_vulnerability).and_return(
-                         {"param" => "vuln_param", "value" => "vuln_value", "pattern" => "1"}
-                       )
-                       expect(TCellAgent).to receive(:configuration).and_return(configuration).at_least(:once)
-                       expect(@sensor).to receive(:send_event).with(
-                         @meta,
-                         "xss",
-                         "vuln_param",
-                         {"t" => XssSensor::GET_PARAM}.to_json,
-                         nil,
-                         "1"
-                       )
-
-                       result = @sensor.check(XssSensor::GET_PARAM, @meta, "param_name", "param_value")
-
-                       expect(result).to eq(true)
-                     end
-                   end
-
-                   context "params is not blacklisted and there is no whitelist" do
-                     it "should return true" do
-                       @sensor.exclude_forms = false
-                       @sensor.exclude_cookies = true
-
-                       configuration = double(
-                         "configuration",
-                         allow_unencrypted_appfirewall_payloads_logging: false,
-                         allow_unencrypted_appfirewall_payloads: false,
-                         blacklisted_params: {},
-                         whitelist_present: false
-                       )
-
-                       expect(@sensor).to receive(:find_vulnerability).and_return(
-                         {"param" => "vuln_param", "value" => "vuln_value", "pattern" => "1"}
-                       )
-                       expect(TCellAgent).to receive(:configuration).and_return(configuration).at_least(:once)
-                       expect(@sensor).to receive(:send_event).with(
-                         @meta,
-                         "xss",
-                         "vuln_param",
-                         {"t" => XssSensor::GET_PARAM}.to_json,
-                         nil,
-                         "1"
-                       )
-
-                       result = @sensor.check(XssSensor::GET_PARAM, @meta, "param_name", "param_value")
-
-                       expect(result).to eq(true)
-                     end
-                   end
-                end
-
-                context "allow_unencrypted_appfirewall_payloads is true" do
-                   context "params is blacklisted" do
-                     it "should return true" do
-                       @sensor.exclude_forms = false
-                       @sensor.exclude_cookies = true
-
-                       configuration = double(
-                         "configuration",
-                         allow_unencrypted_appfirewall_payloads_logging: false,
-                         allow_unencrypted_appfirewall_payloads: true,
-                         blacklisted_params: {"vuln_param" => true},
-                         whitelist_present: false
-                       )
-
-                       expect(@sensor).to receive(:find_vulnerability).and_return(
-                         {"param" => "vuln_param", "value" => "vuln_value", "pattern" => "1"}
-                       )
-                       expect(TCellAgent).to receive(:configuration).and_return(configuration).at_least(:once)
-                       expect(@sensor).to receive(:send_event).with(
-                         @meta,
-                         "xss",
-                         "vuln_param",
-                         {"t" => XssSensor::GET_PARAM}.to_json,
-                         "BLACKLISTED",
-                         "1"
-                       )
-
-                       result = @sensor.check(XssSensor::GET_PARAM, @meta, "param_name", "param_value")
-
-                       expect(result).to eq(true)
-                     end
-                   end
-
-                   context "param is whitelisted" do
-                     it "should return true" do
-                       @sensor.exclude_forms = false
-                       @sensor.exclude_cookies = true
-
-                       configuration = double(
-                         "configuration",
-                         allow_unencrypted_appfirewall_payloads_logging: false,
-                         allow_unencrypted_appfirewall_payloads: true,
-                         blacklisted_params: {},
-                         whitelist_present: true,
-                         whitelisted_params: {"vuln_param" => true}
-                       )
-
-                       expect(@sensor).to receive(:find_vulnerability).and_return(
-                         {"param" => "vuln_param", "value" => "vuln_value", "pattern" => "1"}
-                       )
-                       expect(TCellAgent).to receive(:configuration).and_return(configuration).at_least(:once)
-                       expect(@sensor).to receive(:send_event).with(
-                         @meta,
-                         "xss",
-                         "vuln_param",
-                         {"t" => XssSensor::GET_PARAM}.to_json,
-                         "vuln_value",
-                         "1"
-                       )
-
-                       result = @sensor.check(XssSensor::GET_PARAM, @meta, "param_name", "param_value")
-
-                       expect(result).to eq(true)
-                     end
-                   end
-
-                   context "param is blacklisted and whitelisted" do
-                     it "should return true" do
-                       @sensor.exclude_forms = false
-                       @sensor.exclude_cookies = true
-
-                       configuration = double(
-                         "configuration",
-                         allow_unencrypted_appfirewall_payloads_logging: false,
-                         allow_unencrypted_appfirewall_payloads: true,
-                         blacklisted_params: {"vuln_param" => true},
-                         whitelist_present: true,
-                         whitelisted_params: {"vuln_param" => true}
-                       )
-
-                       expect(@sensor).to receive(:find_vulnerability).and_return(
-                         {"param" => "vuln_param", "value" => "vuln_value", "pattern" => "1"}
-                       )
-                       expect(TCellAgent).to receive(:configuration).and_return(configuration).at_least(:once)
-                       expect(@sensor).to receive(:send_event).with(
-                         @meta,
-                         "xss",
-                         "vuln_param",
-                         {"t" => XssSensor::GET_PARAM}.to_json,
-                         "BLACKLISTED",
-                         "1"
-                       )
-
-                       result = @sensor.check(XssSensor::GET_PARAM, @meta, "param_name", "param_value")
-
-                       expect(result).to eq(true)
-                     end
-                   end
-
-                   context "params is not blacklisted and there is no whitelist" do
-                     it "should return true" do
-                       @sensor.exclude_forms = false
-                       @sensor.exclude_cookies = true
-
-                       configuration = double(
-                         "configuration",
-                         allow_unencrypted_appfirewall_payloads_logging: false,
-                         allow_unencrypted_appfirewall_payloads: true,
-                         blacklisted_params: {},
-                         whitelist_present: false
-                       )
-
-                       expect(@sensor).to receive(:find_vulnerability).and_return(
-                         {"param" => "vuln_param", "value" => "vuln_value", "pattern" => "1"}
-                       )
-                       expect(TCellAgent).to receive(:configuration).and_return(configuration).at_least(:once)
-                       expect(@sensor).to receive(:send_event).with(
-                         @meta,
-                         "xss",
-                         "vuln_param",
-                         {"t" => XssSensor::GET_PARAM}.to_json,
-                         "vuln_value",
-                         "1"
-                       )
-
-                       result = @sensor.check(XssSensor::GET_PARAM, @meta, "param_name", "param_value")
-
-                       expect(result).to eq(true)
-                     end
-                   end
-                end
-
                 context "no excluded routes" do
                   it "should return true" do
                     @sensor.exclude_forms = false
                     @sensor.exclude_cookies = true
                     @sensor.excluded_route_ids = {}
-                    configuration = double(
-                      "configuration",
-                      allow_unencrypted_appfirewall_payloads_logging: false,
-                      allow_unencrypted_appfirewall_payloads: true,
-                      blacklisted_params: {},
-                      whitelist_present: false
-                    )
 
                     expect(@sensor).to receive(:find_vulnerability).and_return(
                       {"param" => "vuln_param", "value" => "vuln_value", "pattern" => "1"}
                     )
-                    expect(TCellAgent).to receive(:configuration).and_return(configuration).at_least(:once)
+                    expect(@payloads_policy).to receive(:apply).with(
+                      "xss", {}, "get", "vuln_param", "vuln_value", {"l"=>"query"}, "1"
+                    ).and_return("vuln_value")
                     expect(@sensor).to receive(:send_event).with(
                       @meta,
                       "xss",
                       "vuln_param",
-                      {"t" => XssSensor::GET_PARAM}.to_json,
+                      {"l" => XssSensor::PARAM_TYPE_TO_L[XssSensor::GET_PARAM]},
                       "vuln_value",
                       "1"
                     )
 
-                    result = @sensor.check(XssSensor::GET_PARAM, @meta, "param_name", "param_value")
+                    result = @sensor.check(XssSensor::GET_PARAM, @meta, "param_name", "param_value", @payloads_policy)
 
                     expect(result).to eq(true)
                   end
@@ -630,11 +496,11 @@ module TCellAgent
                       @sensor.exclude_cookies = true
                       @sensor.excluded_route_ids = {"route_id" => true}
 
-                      expect(TCellAgent).to_not receive(:configuration)
                       expect(@sensor).to_not receive(:find_vulnerability)
+                      expect(@payloads_policy).to_not receive(:apply)
                       expect(@sensor).to_not receive(:send_event)
 
-                      result = @sensor.check(XssSensor::GET_PARAM, @meta, "param_name", "param_value")
+                      result = @sensor.check(XssSensor::GET_PARAM, @meta, "param_name", "param_value", @payloads_policy)
 
                       expect(result).to eq(false)
                     end
@@ -645,28 +511,23 @@ module TCellAgent
                       @sensor.exclude_forms = false
                       @sensor.exclude_cookies = true
                       @sensor.excluded_route_ids = {"unmatching_route_id" => true}
-                      configuration = double(
-                        "configuration",
-                        allow_unencrypted_appfirewall_payloads_logging: false,
-                        allow_unencrypted_appfirewall_payloads: true,
-                        blacklisted_params: {},
-                        whitelist_present: false
-                      )
 
                       expect(@sensor).to receive(:find_vulnerability).and_return(
                         {"param" => "vuln_param", "value" => "vuln_value", "pattern" => "1"}
                       )
-                      expect(TCellAgent).to receive(:configuration).and_return(configuration).at_least(:once)
+                      expect(@payloads_policy).to receive(:apply).with(
+                        "xss", {}, "get", "vuln_param", "vuln_value", {"l"=>"query"}, "1"
+                      ).and_return("vuln_value")
                       expect(@sensor).to receive(:send_event).with(
                         @meta,
                         "xss",
                         "vuln_param",
-                        {"t" => XssSensor::GET_PARAM}.to_json,
+                        {"l" => XssSensor::PARAM_TYPE_TO_L[XssSensor::GET_PARAM]},
                         "vuln_value",
                         "1"
                       )
 
-                      result = @sensor.check(XssSensor::GET_PARAM, @meta, "param_name", "param_value")
+                      result = @sensor.check(XssSensor::GET_PARAM, @meta, "param_name", "param_value", @payloads_policy)
 
                       expect(result).to eq(true)
                     end
@@ -681,11 +542,17 @@ module TCellAgent
                   @sensor.exclude_forms = true
                   @sensor.exclude_cookies = false
 
-                  expect(TCellAgent).to_not receive(:configuration)
+                  expect(@payloads_policy).to_not receive(:apply)
                   expect(@sensor).to_not receive(:find_vulnerability)
                   expect(@sensor).to_not receive(:send_event)
 
-                  result = @sensor.check(XssSensor::POST_PARAM, @meta, "param_name", "param_value")
+                  result = @sensor.check(
+                    XssSensor::POST_PARAM,
+                    @meta,
+                    "param_name",
+                    "param_value",
+                    @payloads_policy
+                  )
 
                   expect(result).to eq(false)
                 end
@@ -695,28 +562,27 @@ module TCellAgent
                 it "should return true" do
                   @sensor.exclude_forms = false
                   @sensor.exclude_cookies = true
-                  configuration = double(
-                    "configuration",
-                    allow_unencrypted_appfirewall_payloads_logging: false,
-                    allow_unencrypted_appfirewall_payloads: true,
-                    blacklisted_params: {},
-                    whitelist_present: false
-                  )
 
                   expect(@sensor).to receive(:find_vulnerability).and_return(
                     {"param" => "vuln_param", "value" => "vuln_value", "pattern" => "1"}
                   )
-                  expect(TCellAgent).to receive(:configuration).and_return(configuration).at_least(:once)
+                  expect(@payloads_policy).to receive(:apply).and_return("vuln_value")
                   expect(@sensor).to receive(:send_event).with(
                     @meta,
                     "xss",
                     "vuln_param",
-                    {"t" => XssSensor::POST_PARAM}.to_json,
+                    {"l" => XssSensor::PARAM_TYPE_TO_L[XssSensor::POST_PARAM]},
                     "vuln_value",
                     "1"
                   )
 
-                  result = @sensor.check(XssSensor::POST_PARAM, @meta, "param_name", "param_value")
+                  result = @sensor.check(
+                    XssSensor::POST_PARAM,
+                    @meta,
+                    "param_name",
+                    "param_value",
+                    @payloads_policy
+                  )
 
                   expect(result).to eq(true)
                 end
@@ -729,11 +595,17 @@ module TCellAgent
                   @sensor.exclude_forms = true
                   @sensor.exclude_cookies = false
 
-                  expect(TCellAgent).to_not receive(:configuration)
+                  expect(@payloads_policy).to_not receive(:apply)
                   expect(@sensor).to_not receive(:find_vulnerability)
                   expect(@sensor).to_not receive(:send_event)
 
-                  result = @sensor.check(XssSensor::JSON_PARAM, @meta, "param_name", "param_value")
+                  result = @sensor.check(
+                    XssSensor::JSON_PARAM,
+                    @meta,
+                    "param_name",
+                    "param_value",
+                    @payloads_policy
+                  )
 
                   expect(result).to eq(false)
                 end
@@ -743,28 +615,27 @@ module TCellAgent
                 it "should return true" do
                   @sensor.exclude_forms = false
                   @sensor.exclude_cookies = true
-                  configuration = double(
-                    "configuration",
-                    allow_unencrypted_appfirewall_payloads_logging: false,
-                    allow_unencrypted_appfirewall_payloads: true,
-                    blacklisted_params: {},
-                    whitelist_present: false
-                  )
 
                   expect(@sensor).to receive(:find_vulnerability).and_return(
                     {"param" => "vuln_param", "value" => "vuln_value", "pattern" => "1"}
                   )
-                  expect(TCellAgent).to receive(:configuration).and_return(configuration).at_least(:once)
+                  expect(@payloads_policy).to receive(:apply).and_return("vuln_value")
                   expect(@sensor).to receive(:send_event).with(
                     @meta,
                     "xss",
                     "vuln_param",
-                    {"t" => XssSensor::JSON_PARAM}.to_json,
+                    {"l" => XssSensor::PARAM_TYPE_TO_L[XssSensor::JSON_PARAM]},
                     "vuln_value",
                     "1"
                   )
 
-                  result = @sensor.check(XssSensor::JSON_PARAM, @meta, "param_name", "param_value")
+                  result = @sensor.check(
+                    XssSensor::JSON_PARAM,
+                    @meta,
+                    "param_name",
+                    "param_value",
+                    @payloads_policy
+                  )
 
                   expect(result).to eq(true)
                 end
@@ -776,28 +647,27 @@ module TCellAgent
                 it "should return true" do
                   @sensor.exclude_forms = true
                   @sensor.exclude_cookies = false
-                  configuration = double(
-                    "configuration",
-                    allow_unencrypted_appfirewall_payloads_logging: false,
-                    allow_unencrypted_appfirewall_payloads: true,
-                    blacklisted_params: {},
-                    whitelist_present: false
-                  )
 
                   expect(@sensor).to receive(:find_vulnerability).and_return(
                     {"param" => "vuln_param", "value" => "vuln_value", "pattern" => "1"}
                   )
-                  expect(TCellAgent).to receive(:configuration).and_return(configuration).at_least(:once)
+                  expect(@payloads_policy).to receive(:apply).and_return("vuln_value")
                   expect(@sensor).to receive(:send_event).with(
                     @meta,
                     "xss",
                     "vuln_param",
-                    {"t" => XssSensor::COOKIE_PARAM}.to_json,
+                    {"l" => XssSensor::PARAM_TYPE_TO_L[XssSensor::COOKIE_PARAM]},
                     "vuln_value",
                     "1"
                   )
 
-                  result = @sensor.check(XssSensor::COOKIE_PARAM, @meta, "param_name", "param_value")
+                  result = @sensor.check(
+                    XssSensor::COOKIE_PARAM,
+                    @meta,
+                    "param_name",
+                    "param_value",
+                    @payloads_policy
+                  )
 
                   expect(result).to eq(true)
                 end
@@ -808,11 +678,17 @@ module TCellAgent
                   @sensor.exclude_forms = false
                   @sensor.exclude_cookies = true
 
-                  expect(TCellAgent).to_not receive(:configuration)
                   expect(@sensor).to_not receive(:find_vulnerability)
+                  expect(@payloads_policy).to_not receive(:apply)
                   expect(@sensor).to_not receive(:send_event)
 
-                  result = @sensor.check(XssSensor::COOKIE_PARAM, @meta, "param_name", "param_value")
+                  result = @sensor.check(
+                    XssSensor::COOKIE_PARAM,
+                    @meta,
+                    "param_name",
+                    "param_value",
+                    @payloads_policy
+                  )
 
                   expect(result).to eq(false)
                 end