tcell_agent 0.2.21 → 0.2.22

data/spec/lib/tcell_agent/policies/appsensor/request_size_sensor_spec.rb

@@ -51,7 +51,7 @@ module TCellAgent
           it "should not send event" do
             sensor = RequestSizeSensor.new({"enabled" => false})
 
-            expect(sensor).to_not receive(:send_event)
+            expect(TCellAgent::AppSensor::Sensor).to_not receive(:send_event)
             sensor.check({}, 10)
           end
         end
@@ -74,7 +74,7 @@ module TCellAgent
               meta.user_id = "user_id"
               meta.transaction_id = "transaction_id"
 
-              expect(sensor).to_not receive(:send_event)
+              expect(TCellAgent::AppSensor::Sensor).to_not receive(:send_event)
               sensor.check(meta, nil)
             end
           end
@@ -96,7 +96,7 @@ module TCellAgent
               meta.user_id = "user_id"
               meta.transaction_id = "transaction_id"
 
-              expect(sensor).to_not receive(:send_event)
+              expect(TCellAgent::AppSensor::Sensor).to_not receive(:send_event)
               sensor.check(meta, 1024)
             end
           end
@@ -119,7 +119,7 @@ module TCellAgent
                 meta.user_id = "user_id"
                 meta.transaction_id = "transaction_id"
 
-                expect(sensor).to_not receive(:send_event)
+                expect(TCellAgent::AppSensor::Sensor).to_not receive(:send_event)
                 sensor.check(meta, 2048)
               end
             end

data/spec/lib/tcell_agent/policies/appsensor/response_codes_sensor_spec.rb

@@ -65,7 +65,7 @@ module TCellAgent
             meta.user_id = "user_id"
             meta.transaction_id = "transaction_id"
 
-            expect(sensor).to_not receive(:send_event)
+            expect(TCellAgent::AppSensor::Sensor).to_not receive(:send_event)
             sensor.check(meta, 200)
           end
         end
@@ -86,7 +86,7 @@ module TCellAgent
             end
 
             it "should not send an event" do
-              expect(@sensor).to_not receive(:send_event)
+              expect(TCellAgent::AppSensor::Sensor).to_not receive(:send_event)
               @sensor.check(@meta, 200)
             end
 
@@ -94,7 +94,7 @@ module TCellAgent
               it "should not send an event" do
                 @sensor.excluded_route_ids = {}
 
-                expect(@sensor).to_not receive(:send_event)
+                expect(TCellAgent::AppSensor::Sensor).to_not receive(:send_event)
                 @sensor.check(@meta, 200)
               end
             end
@@ -104,7 +104,7 @@ module TCellAgent
                 it "should not send an event" do
                   @sensor.excluded_route_ids = {"route_id" => true}
 
-                  expect(@sensor).to_not receive(:send_event)
+                  expect(TCellAgent::AppSensor::Sensor).to_not receive(:send_event)
                   @sensor.check(@meta, 200)
                 end
               end
@@ -112,7 +112,7 @@ module TCellAgent
                 it "should not send an event" do
                   @sensor.excluded_route_ids = {"unmatching_route_id" => true}
 
-                  expect(@sensor).to_not receive(:send_event)
+                  expect(TCellAgent::AppSensor::Sensor).to_not receive(:send_event)
                   @sensor.check(@meta, 200)
                 end
               end
@@ -131,7 +131,7 @@ module TCellAgent
               meta.user_id = "user_id"
               meta.transaction_id = "transaction_id"
 
-              expect(sensor).to_not receive(:send_event)
+              expect(TCellAgent::AppSensor::Sensor).to_not receive(:send_event)
               sensor.check(meta, 300)
             end
           end
@@ -152,7 +152,7 @@ module TCellAgent
                 meta.user_id = "user_id"
                 meta.transaction_id = "transaction_id"
 
-                expect(sensor).to_not receive(:send_event)
+                expect(TCellAgent::AppSensor::Sensor).to_not receive(:send_event)
                 sensor.check(meta, 400)
               end
             end
@@ -176,7 +176,7 @@ module TCellAgent
               end
 
               it "should send an event" do
-                expect(@sensor).to receive(:send_event).with(
+                expect(TCellAgent::AppSensor::Sensor).to receive(:send_event).with(
                   @meta, ResponseCodesSensor::RESPONSE_CODE_DP_DICT[4], nil, {code: 400} , nil, nil
                 )
                 @sensor.check(@meta, 400)
@@ -186,7 +186,7 @@ module TCellAgent
                 it "should send an event" do
                   @sensor.excluded_route_ids = {}
 
-                  expect(@sensor).to receive(:send_event).with(
+                  expect(TCellAgent::AppSensor::Sensor).to receive(:send_event).with(
                     @meta, ResponseCodesSensor::RESPONSE_CODE_DP_DICT[4], nil, {code: 400} , nil, nil
                   )
                   @sensor.check(@meta, 400)
@@ -198,7 +198,7 @@ module TCellAgent
                   it "should not send an event" do
                     @sensor.excluded_route_ids = {"route_id" => true}
 
-                    expect(@sensor).to_not receive(:send_event)
+                    expect(TCellAgent::AppSensor::Sensor).to_not receive(:send_event)
                     @sensor.check(@meta, 400)
                   end
                 end
@@ -206,7 +206,7 @@ module TCellAgent
                   it "should send an event" do
                     @sensor.excluded_route_ids = {"unmatching_route_id" => true}
 
-                    expect(@sensor).to receive(:send_event).with(
+                    expect(TCellAgent::AppSensor::Sensor).to receive(:send_event).with(
                       @meta, ResponseCodesSensor::RESPONSE_CODE_DP_DICT[4], nil, {code: 400} , nil, nil
                     )
                     @sensor.check(@meta, 400)
@@ -232,7 +232,7 @@ module TCellAgent
                 meta.user_id = "user_id"
                 meta.transaction_id = "transaction_id"
 
-                expect(sensor).to_not receive(:send_event)
+                expect(TCellAgent::AppSensor::Sensor).to_not receive(:send_event)
                 sensor.check(meta, 500)
               end
             end
@@ -254,7 +254,7 @@ module TCellAgent
                 meta.user_id = "user_id"
                 meta.transaction_id = "transaction_id"
 
-                expect(sensor).to receive(:send_event).with(
+                expect(TCellAgent::AppSensor::Sensor).to receive(:send_event).with(
                   meta, ResponseCodesSensor::RESPONSE_CODE_DP_DICT[500], nil, {code: 500} , nil, nil
                 )
                 sensor.check(meta, 500)

data/spec/lib/tcell_agent/policies/appsensor/response_size_sensor_spec.rb

@@ -51,7 +51,7 @@ module TCellAgent
           it "should not send event" do
             sensor = ResponseSizeSensor.new({"enabled" => false})
 
-            expect(sensor).to_not receive(:send_event)
+            expect(TCellAgent::AppSensor::Sensor).to_not receive(:send_event)
             sensor.check({}, 10)
           end
         end
@@ -74,7 +74,7 @@ module TCellAgent
               meta.user_id = "user_id"
               meta.transaction_id = "transaction_id"
 
-              expect(sensor).to_not receive(:send_event)
+              expect(TCellAgent::AppSensor::Sensor).to_not receive(:send_event)
               sensor.check(meta, nil)
             end
           end
@@ -96,7 +96,7 @@ module TCellAgent
               meta.user_id = "user_id"
               meta.transaction_id = "transaction_id"
 
-              expect(sensor).to_not receive(:send_event)
+              expect(TCellAgent::AppSensor::Sensor).to_not receive(:send_event)
               sensor.check(meta, 1024)
             end
           end
@@ -119,7 +119,7 @@ module TCellAgent
                 meta.user_id = "user_id"
                 meta.transaction_id = "transaction_id"
 
-                expect(sensor).to_not receive(:send_event)
+                expect(TCellAgent::AppSensor::Sensor).to_not receive(:send_event)
                 sensor.check(meta, 2048)
               end
             end
@@ -141,7 +141,7 @@ module TCellAgent
                 meta.user_id = "user_id"
                 meta.transaction_id = "transaction_id"
 
-                expect(sensor).to receive(:send_event).with(
+                expect(TCellAgent::AppSensor::Sensor).to receive(:send_event).with(
                   meta, ResponseSizeSensor::DP_UNUSUAL_RESPONSE_SIZE, nil, {"sz" => 2048}, nil, nil
                 )
                 sensor.check(meta, 2048)

data/spec/lib/tcell_agent/policies/appsensor/retr_sensor_spec.rb

@@ -14,7 +14,7 @@ module TCellAgent
             expect(sensor.exclude_forms).to eq(false)
             expect(sensor.exclude_cookies).to eq(false)
             expect(sensor.exclusions).to eq({})
-            expect(sensor.active_pattern_ids).to eq({})
+            expect(sensor.active_pattern_ids).to eq(Set.new)
             expect(sensor.v1_compatability_enabled).to eq(false)
           end
         end
@@ -28,7 +28,7 @@ module TCellAgent
             expect(sensor.exclude_forms).to eq(false)
             expect(sensor.exclude_cookies).to eq(false)
             expect(sensor.exclusions).to eq({})
-            expect(sensor.active_pattern_ids).to eq({})
+            expect(sensor.active_pattern_ids).to eq(Set.new)
             expect(sensor.v1_compatability_enabled).to eq(false)
           end
         end
@@ -42,7 +42,7 @@ module TCellAgent
             expect(sensor.exclude_forms).to eq(false)
             expect(sensor.exclude_cookies).to eq(false)
             expect(sensor.exclusions).to eq({})
-            expect(sensor.active_pattern_ids).to eq({})
+            expect(sensor.active_pattern_ids).to eq(Set.new)
             expect(sensor.v1_compatability_enabled).to eq(false)
           end
         end
@@ -56,7 +56,7 @@ module TCellAgent
             expect(sensor.exclude_forms).to eq(true)
             expect(sensor.exclude_cookies).to eq(false)
             expect(sensor.exclusions).to eq({})
-            expect(sensor.active_pattern_ids).to eq({})
+            expect(sensor.active_pattern_ids).to eq(Set.new)
             expect(sensor.v1_compatability_enabled).to eq(false)
           end
         end
@@ -70,7 +70,7 @@ module TCellAgent
             expect(sensor.exclude_forms).to eq(false)
             expect(sensor.exclude_cookies).to eq(true)
             expect(sensor.exclusions).to eq({})
-            expect(sensor.active_pattern_ids).to eq({})
+            expect(sensor.active_pattern_ids).to eq(Set.new)
             expect(sensor.v1_compatability_enabled).to eq(false)
           end
         end
@@ -84,9 +84,9 @@ module TCellAgent
             expect(sensor.exclude_forms).to eq(false)
             expect(sensor.exclude_cookies).to eq(false)
             expect(sensor.exclusions).to eq(
-              {"word"=>["form", "header"]}
+              {"word"=>Set.new(["form", "header"])}
             )
-            expect(sensor.active_pattern_ids).to eq({})
+            expect(sensor.active_pattern_ids).to eq(Set.new)
             expect(sensor.v1_compatability_enabled).to eq(false)
           end
         end
@@ -101,7 +101,7 @@ module TCellAgent
             expect(sensor.exclude_cookies).to eq(false)
             expect(sensor.exclusions).to eq({})
             expect(sensor.active_pattern_ids).to eq(
-              {"1" => true, "2" => true, "3" => true}
+              Set.new(["1", "2", "3"])
             )
             expect(sensor.v1_compatability_enabled).to eq(false)
           end
@@ -116,12 +116,23 @@ module TCellAgent
             expect(sensor.exclude_forms).to eq(false)
             expect(sensor.exclude_cookies).to eq(false)
             expect(sensor.exclusions).to eq({})
-            expect(sensor.active_pattern_ids).to eq({})
+            expect(sensor.active_pattern_ids).to eq(Set.new)
             expect(sensor.v1_compatability_enabled).to eq(true)
           end
         end
 
       end
+
+      describe "#applicable_for_param_type?" do
+        it "should be applicable for all param types" do
+          sensor = RetrSensor.new
+          expect(sensor.applicable_for_param_type?(InjectionSensor::GET_PARAM)).to eq(true)
+          expect(sensor.applicable_for_param_type?(InjectionSensor::POST_PARAM)).to eq(false)
+          expect(sensor.applicable_for_param_type?(InjectionSensor::JSON_PARAM)).to eq(false)
+          expect(sensor.applicable_for_param_type?(InjectionSensor::COOKIE_PARAM)).to eq(true)
+          expect(sensor.applicable_for_param_type?(InjectionSensor::URI_PARAM)).to eq(true)
+        end
+      end
     end
 
   end

data/spec/lib/tcell_agent/policies/appsensor/sqli_sensor_spec.rb

@@ -17,7 +17,7 @@ module TCellAgent
             expect(sensor.exclude_forms).to eq(false)
             expect(sensor.exclude_cookies).to eq(false)
             expect(sensor.exclusions).to eq({})
-            expect(sensor.active_pattern_ids).to eq({})
+            expect(sensor.active_pattern_ids).to eq(Set.new)
             expect(sensor.v1_compatability_enabled).to eq(false)
           end
         end
@@ -32,7 +32,7 @@ module TCellAgent
             expect(sensor.exclude_forms).to eq(false)
             expect(sensor.exclude_cookies).to eq(false)
             expect(sensor.exclusions).to eq({})
-            expect(sensor.active_pattern_ids).to eq({})
+            expect(sensor.active_pattern_ids).to eq(Set.new)
             expect(sensor.v1_compatability_enabled).to eq(false)
           end
         end
@@ -47,7 +47,7 @@ module TCellAgent
             expect(sensor.exclude_forms).to eq(false)
             expect(sensor.exclude_cookies).to eq(false)
             expect(sensor.exclusions).to eq({})
-            expect(sensor.active_pattern_ids).to eq({})
+            expect(sensor.active_pattern_ids).to eq(Set.new)
             expect(sensor.v1_compatability_enabled).to eq(false)
           end
         end
@@ -62,7 +62,7 @@ module TCellAgent
             expect(sensor.exclude_forms).to eq(false)
             expect(sensor.exclude_cookies).to eq(false)
             expect(sensor.exclusions).to eq({})
-            expect(sensor.active_pattern_ids).to eq({})
+            expect(sensor.active_pattern_ids).to eq(Set.new)
             expect(sensor.v1_compatability_enabled).to eq(false)
           end
         end
@@ -77,7 +77,7 @@ module TCellAgent
             expect(sensor.exclude_forms).to eq(true)
             expect(sensor.exclude_cookies).to eq(false)
             expect(sensor.exclusions).to eq({})
-            expect(sensor.active_pattern_ids).to eq({})
+            expect(sensor.active_pattern_ids).to eq(Set.new)
             expect(sensor.v1_compatability_enabled).to eq(false)
           end
         end
@@ -92,7 +92,7 @@ module TCellAgent
             expect(sensor.exclude_forms).to eq(false)
             expect(sensor.exclude_cookies).to eq(true)
             expect(sensor.exclusions).to eq({})
-            expect(sensor.active_pattern_ids).to eq({})
+            expect(sensor.active_pattern_ids).to eq(Set.new)
             expect(sensor.v1_compatability_enabled).to eq(false)
           end
         end
@@ -107,9 +107,9 @@ module TCellAgent
             expect(sensor.exclude_forms).to eq(false)
             expect(sensor.exclude_cookies).to eq(false)
             expect(sensor.exclusions).to eq(
-              {"word"=>["form", "header"]}
+              {"word"=>Set.new(["form", "header"])}
             )
-            expect(sensor.active_pattern_ids).to eq({})
+            expect(sensor.active_pattern_ids).to eq(Set.new)
             expect(sensor.v1_compatability_enabled).to eq(false)
           end
         end
@@ -125,7 +125,7 @@ module TCellAgent
             expect(sensor.exclude_cookies).to eq(false)
             expect(sensor.exclusions).to eq({})
             expect(sensor.active_pattern_ids).to eq(
-              {"1" => true, "2" => true, "3" => true}
+              Set.new(["1", "2", "3"])
             )
             expect(sensor.v1_compatability_enabled).to eq(false)
           end
@@ -141,7 +141,7 @@ module TCellAgent
             expect(sensor.exclude_forms).to eq(false)
             expect(sensor.exclude_cookies).to eq(false)
             expect(sensor.exclusions).to eq({})
-            expect(sensor.active_pattern_ids).to eq({})
+            expect(sensor.active_pattern_ids).to eq(Set.new)
             expect(sensor.v1_compatability_enabled).to eq(true)
           end
         end
@@ -161,7 +161,7 @@ module TCellAgent
               ruleset = double("ruleset")
               expect(@sensor).to receive(:get_ruleset).and_return(ruleset)
               expect(ruleset).to receive(:check_violation).with(
-                "param", "value", {}, false
+                "param", "value", Set.new, false
               ).and_return(nil)
 
               expect(@sensor.find_vulnerability("param", "value")).to eq(nil)
@@ -174,7 +174,7 @@ module TCellAgent
                 ruleset = double("ruleset")
                 expect(@sensor).to receive(:get_ruleset).and_return(ruleset)
                 expect(ruleset).to receive(:check_violation).with(
-                  "param", "Müller", {}, false
+                  "param", "Müller", Set.new, false
                 ).and_return(nil)
 
                 expect(@sensor.find_vulnerability("param", "Müller")).to eq(nil)
@@ -209,7 +209,7 @@ module TCellAgent
               ruleset = double("ruleset")
               expect(@sensor).to receive(:get_ruleset).and_return(ruleset)
               expect(ruleset).to receive(:check_violation).with(
-                "param", "value", {}, false
+                "param", "value", Set.new, false
               ).and_return(nil)
 
               expect(@sensor.find_vulnerability("param", "value")).to eq(nil)
@@ -221,7 +221,7 @@ module TCellAgent
               ruleset = double("ruleset")
               expect(@sensor).to receive(:get_ruleset).and_return(ruleset)
               expect(ruleset).to receive(:check_violation).with(
-                "param", "value", {}, false
+                "param", "value", Set.new, false
               ).and_return(true)
 
               expect(@sensor.find_vulnerability("param", "value")).to eq(true)
@@ -230,6 +230,16 @@ module TCellAgent
         end
       end
 
+      describe "#applicable_for_param_type?" do
+        it "should be applicable for all param types" do
+          sensor = SqliSensor.new
+          expect(sensor.applicable_for_param_type?(InjectionSensor::GET_PARAM)).to eq(true)
+          expect(sensor.applicable_for_param_type?(InjectionSensor::POST_PARAM)).to eq(true)
+          expect(sensor.applicable_for_param_type?(InjectionSensor::JSON_PARAM)).to eq(true)
+          expect(sensor.applicable_for_param_type?(InjectionSensor::COOKIE_PARAM)).to eq(true)
+          expect(sensor.applicable_for_param_type?(InjectionSensor::URI_PARAM)).to eq(true)
+        end
+      end
     end
 
   end

data/spec/lib/tcell_agent/policies/appsensor/xss_sensor_spec.rb

@@ -17,7 +17,7 @@ module TCellAgent
             expect(sensor.exclude_forms).to eq(false)
             expect(sensor.exclude_cookies).to eq(false)
             expect(sensor.exclusions).to eq({})
-            expect(sensor.active_pattern_ids).to eq({})
+            expect(sensor.active_pattern_ids).to eq(Set.new)
             expect(sensor.v1_compatability_enabled).to eq(false)
           end
         end
@@ -32,7 +32,7 @@ module TCellAgent
             expect(sensor.exclude_forms).to eq(false)
             expect(sensor.exclude_cookies).to eq(false)
             expect(sensor.exclusions).to eq({})
-            expect(sensor.active_pattern_ids).to eq({})
+            expect(sensor.active_pattern_ids).to eq(Set.new)
             expect(sensor.v1_compatability_enabled).to eq(false)
           end
         end
@@ -47,7 +47,7 @@ module TCellAgent
             expect(sensor.exclude_forms).to eq(false)
             expect(sensor.exclude_cookies).to eq(false)
             expect(sensor.exclusions).to eq({})
-            expect(sensor.active_pattern_ids).to eq({})
+            expect(sensor.active_pattern_ids).to eq(Set.new)
             expect(sensor.v1_compatability_enabled).to eq(false)
           end
         end
@@ -62,7 +62,7 @@ module TCellAgent
             expect(sensor.exclude_forms).to eq(false)
             expect(sensor.exclude_cookies).to eq(false)
             expect(sensor.exclusions).to eq({})
-            expect(sensor.active_pattern_ids).to eq({})
+            expect(sensor.active_pattern_ids).to eq(Set.new)
             expect(sensor.v1_compatability_enabled).to eq(false)
           end
         end
@@ -77,7 +77,7 @@ module TCellAgent
             expect(sensor.exclude_forms).to eq(true)
             expect(sensor.exclude_cookies).to eq(false)
             expect(sensor.exclusions).to eq({})
-            expect(sensor.active_pattern_ids).to eq({})
+            expect(sensor.active_pattern_ids).to eq(Set.new)
             expect(sensor.v1_compatability_enabled).to eq(false)
           end
         end
@@ -92,7 +92,7 @@ module TCellAgent
             expect(sensor.exclude_forms).to eq(false)
             expect(sensor.exclude_cookies).to eq(true)
             expect(sensor.exclusions).to eq({})
-            expect(sensor.active_pattern_ids).to eq({})
+            expect(sensor.active_pattern_ids).to eq(Set.new)
             expect(sensor.v1_compatability_enabled).to eq(false)
           end
         end
@@ -107,9 +107,9 @@ module TCellAgent
             expect(sensor.exclude_forms).to eq(false)
             expect(sensor.exclude_cookies).to eq(false)
             expect(sensor.exclusions).to eq(
-              {"word"=>["form", "header"]}
+              {"word"=>Set.new(["form", "header"])}
             )
-            expect(sensor.active_pattern_ids).to eq({})
+            expect(sensor.active_pattern_ids).to eq(Set.new)
             expect(sensor.v1_compatability_enabled).to eq(false)
           end
         end
@@ -125,7 +125,7 @@ module TCellAgent
             expect(sensor.exclude_cookies).to eq(false)
             expect(sensor.exclusions).to eq({})
             expect(sensor.active_pattern_ids).to eq(
-              {"1" => true, "2" => true, "3" => true}
+              Set.new(["1", "2", "3"])
             )
             expect(sensor.v1_compatability_enabled).to eq(false)
           end
@@ -141,7 +141,7 @@ module TCellAgent
             expect(sensor.exclude_forms).to eq(false)
             expect(sensor.exclude_cookies).to eq(false)
             expect(sensor.exclusions).to eq({})
-            expect(sensor.active_pattern_ids).to eq({})
+            expect(sensor.active_pattern_ids).to eq(Set.new)
             expect(sensor.v1_compatability_enabled).to eq(true)
           end
         end
@@ -156,9 +156,9 @@ module TCellAgent
             expect(sensor.exclude_forms).to eq(false)
             expect(sensor.exclude_cookies).to eq(false)
             expect(sensor.exclusions).to eq({})
-            expect(sensor.active_pattern_ids).to eq({})
+            expect(sensor.active_pattern_ids).to eq(Set.new)
             expect(sensor.v1_compatability_enabled).to eq(false)
-            expect(sensor.excluded_route_ids).to eq({"excluded_route_id" => true})
+            expect(sensor.excluded_route_ids).to eq(Set.new(["excluded_route_id"]))
           end
         end
       end
@@ -176,7 +176,7 @@ module TCellAgent
               ruleset = double("ruleset")
               expect(@sensor).to receive(:get_ruleset).and_return(ruleset)
               expect(ruleset).to receive(:check_violation).with(
-                "param", "value", {}, false
+                "param", "value", Set.new, false
               ).and_return(nil)
 
               expect(@sensor.find_vulnerability("param", "value")).to eq(nil)
@@ -189,7 +189,7 @@ module TCellAgent
                 ruleset = double("ruleset")
                 expect(@sensor).to receive(:get_ruleset).and_return(ruleset)
                 expect(ruleset).to receive(:check_violation).with(
-                  "param", "Müller", {}, false
+                  "param", "Müller", Set.new, false
                 ).and_return(nil)
 
                 expect(@sensor.find_vulnerability("param", "Müller")).to eq(nil)
@@ -224,7 +224,7 @@ module TCellAgent
               ruleset = double("ruleset")
               expect(@sensor).to receive(:get_ruleset).and_return(ruleset)
               expect(ruleset).to receive(:check_violation).with(
-                "param", "value", {}, false
+                "param", "value", Set.new, false
               ).and_return(nil)
 
               expect(@sensor.find_vulnerability("param", "value")).to eq(nil)
@@ -236,7 +236,7 @@ module TCellAgent
               ruleset = double("ruleset")
               expect(@sensor).to receive(:get_ruleset).and_return(ruleset)
               expect(ruleset).to receive(:check_violation).with(
-                "param", "value", {}, false
+                "param", "value", Set.new, false
               ).and_return(true)
 
               expect(@sensor.find_vulnerability("param", "value")).to eq(true)
@@ -245,47 +245,27 @@ module TCellAgent
         end
       end
 
-      describe "#check" do
+      describe "#get_injection_attempt" do
         before(:each) do
-          @payloads_policy = double("payloads_policy")
-
-          @meta = TCellAgent::SensorEvents::AppSensorMetaEvent.new
-          @meta.remote_address = "remote_address"
-          @meta.method = "get"
-          @meta.location = "location"
-          @meta.route_id = "route_id"
-          @meta.session_id = "session_id"
-          @meta.user_id = "user_id"
-          @meta.transaction_id = "transaction_id"
-        end
-
-        context "disabled sensor" do
-          it "should return false" do
-            expect(@payloads_policy).to_not receive(:apply)
-
-            sensor = XssSensor.new({"enabled" => false})
-            result = sensor.check(XssSensor::GET_PARAM, @meta, "param_name", "param_value", @payloads_policy)
-
-            expect(result).to eq(false)
-          end
+          @appsensor_meta = TCellAgent::SensorEvents::AppSensorMetaEvent.new
+          @appsensor_meta.remote_address = "remote_address"
+          @appsensor_meta.method = "get"
+          @appsensor_meta.location = "location"
+          @appsensor_meta.route_id = "route_id"
+          @appsensor_meta.session_id = "session_id"
+          @appsensor_meta.user_id = "user_id"
+          @appsensor_meta.transaction_id = "transaction_id"
         end
 
         context "enabled sensor" do
-          before(:each) do
-            @sensor = XssSensor.new({"enabled" => true})
-          end
-
           context "param has NO vulnerability" do
             it "should return false" do
-              expect(@payloads_policy).to_not receive(:apply)
-
-              sensor = XssSensor.new({"enabled" => false})
-              result = sensor.check(
+              sensor = XssSensor.new({"enabled" => true})
+              result = sensor.get_injection_attempt(
                 XssSensor::GET_PARAM,
-                @meta,
+                @appsensor_meta,
                 "param_name",
-                "param_value",
-                @payloads_policy
+                "param_value"
               )
 
               expect(result).to eq(false)
@@ -293,8 +273,13 @@ module TCellAgent
 
             context "no excluded routes" do
               it "should return false" do
-                sensor = XssSensor.new({"enabled" => false, "exclude_routes" => []})
-                result = sensor.check(XssSensor::GET_PARAM, @meta, "param_name", "param_value", @payloads_policy)
+                sensor = XssSensor.new({"enabled" => true, "exclude_routes" => []})
+                result = sensor.get_injection_attempt(
+                  XssSensor::GET_PARAM,
+                  @appsensor_meta,
+                  "param_name",
+                  "param_value"
+                )
 
                 expect(result).to eq(false)
               end
@@ -303,16 +288,26 @@ module TCellAgent
             context "has excluded routes" do
               context "route id matches" do
                 it "should return false" do
-                  sensor = XssSensor.new({"enabled" => false, "exclude_routes" => ["route_id"]})
-                  result = sensor.check(XssSensor::GET_PARAM, @meta, "param_name", "param_value", @payloads_policy)
+                  sensor = XssSensor.new({"enabled" => true, "exclude_routes" => ["route_id"]})
+                  result = sensor.get_injection_attempt(
+                    XssSensor::GET_PARAM,
+                    @appsensor_meta,
+                    "param_name",
+                    "param_value"
+                  )
 
                   expect(result).to eq(false)
                 end
               end
               context "route id does not match" do
                 it "should return false" do
-                  sensor = XssSensor.new({"enabled" => false, "exclude_routes" => ["unmatching_route_id"]})
-                  result = sensor.check(XssSensor::GET_PARAM, @meta, "param_name", "param_value", @payloads_policy)
+                  sensor = XssSensor.new({"enabled" => true, "exclude_routes" => ["unmatching_route_id"]})
+                  result = sensor.get_injection_attempt(
+                    XssSensor::GET_PARAM,
+                    @appsensor_meta,
+                    "param_name",
+                    "param_value"
+                  )
 
                   expect(result).to eq(false)
                 end
@@ -324,40 +319,41 @@ module TCellAgent
             context "param is a URI param" do
               context "exclude forms sensor" do
                 it "should return false" do
-                  @sensor.exclude_forms = true
-                  @sensor.exclude_cookies = false
+                  sensor = XssSensor.new({"enabled" => true, "exclude_forms" => true})
 
-                  expect(@payloads_policy).to_not receive(:apply)
-                  expect(@sensor).to_not receive(:find_vulnerability)
-                  expect(@sensor).to_not receive(:send_event)
+                  expect(sensor).to_not receive(:find_vulnerability)
 
-                  result = @sensor.check(XssSensor::URI_PARAM, @meta, "param_name", "param_value", @payloads_policy)
+                  result = sensor.get_injection_attempt(
+                    XssSensor::URI_PARAM,
+                    @appsensor_meta,
+                    "param_name",
+                    "param_value"
+                  )
 
                   expect(result).to eq(false)
                 end
               end
 
               context "exclude cookies sensor" do
-                it "should return true" do
-                  @sensor.exclude_forms = false
-                  @sensor.exclude_cookies = true
+                it "should return the injection attempt" do
+                  sensor = XssSensor.new({"enabled" => true, "exclude_cookies" => true})
 
-                  expect(@payloads_policy).to receive(:apply).and_return("vuln_value")
-                  expect(@sensor).to receive(:find_vulnerability).and_return(
+                  expect(sensor).to receive(:find_vulnerability).and_return(
                     {"param" => "vuln_param", "value" => "vuln_value", "pattern" => "1"}
                   )
-                  expect(@sensor).to receive(:send_event).with(
-                    @meta,
-                    "xss",
-                    "vuln_param",
-                    {"l" => XssSensor::PARAM_TYPE_TO_L[XssSensor::URI_PARAM]},
-                    "vuln_value",
-                    "1"
-                  )
 
-                  result = @sensor.check(XssSensor::URI_PARAM, @meta, "param_name", "param_value", @payloads_policy)
+                  result = sensor.get_injection_attempt(
+                    XssSensor::URI_PARAM,
+                    @appsensor_meta,
+                    "param_name",
+                    "param_value"
+                  )
 
-                  expect(result).to eq(true)
+                  expect(result.type_of_param).to eq(XssSensor::URI_PARAM)
+                  expect(result.detection_point).to eq(sensor.detection_point)
+                  expect(result.param_name).to eq("vuln_param")
+                  expect(result.param_value).to eq("vuln_value")
+                  expect(result.pattern).to eq("1")
                 end
               end
             end
@@ -365,19 +361,15 @@ module TCellAgent
             context "param is a GET param" do
               context "exclude forms sensor" do
                 it "should return false" do
-                  @sensor.exclude_forms = true
-                  @sensor.exclude_cookies = false
+                  sensor = XssSensor.new({"enabled" => true, "exclude_forms" => true})
 
-                  expect(@payloads_policy).to_not receive(:apply)
-                  expect(@sensor).to_not receive(:find_vulnerability)
-                  expect(@sensor).to_not receive(:send_event)
+                  expect(sensor).to_not receive(:find_vulnerability)
 
-                  result = @sensor.check(
+                  result = sensor.get_injection_attempt(
                     XssSensor::GET_PARAM,
-                    @meta,
+                    @appsensor_meta,
                     "param_name",
-                    "param_value",
-                    @payloads_policy
+                    "param_value"
                   )
 
                   expect(result).to eq(false)
@@ -385,15 +377,16 @@ module TCellAgent
 
                 context "no excluded routes" do
                   it "should return false" do
-                    @sensor.exclude_forms = true
-                    @sensor.exclude_cookies = false
-                    @sensor.excluded_route_ids = {}
+                    sensor = XssSensor.new({"enabled" => true, "exclude_forms" => true, "exclude_routes" => []})
 
-                    expect(@payloads_policy).to_not receive(:apply)
-                    expect(@sensor).to_not receive(:find_vulnerability)
-                    expect(@sensor).to_not receive(:send_event)
+                    expect(sensor).to_not receive(:find_vulnerability)
 
-                    result = @sensor.check(XssSensor::GET_PARAM, @meta, "param_name", "param_value", @payloads_policy)
+                    result = sensor.get_injection_attempt(
+                      XssSensor::GET_PARAM,
+                      @appsensor_meta,
+                      "param_name",
+                      "param_value"
+                    )
 
                     expect(result).to eq(false)
                   end
@@ -402,30 +395,41 @@ module TCellAgent
                 context "has excluded routes" do
                   context "route id matches" do
                     it "should return false" do
-                      @sensor.exclude_forms = true
-                      @sensor.exclude_cookies = false
-                      @sensor.excluded_route_ids = {"route_id" => true}
-
-                      expect(@payloads_policy).to_not receive(:apply)
-                      expect(@sensor).to_not receive(:find_vulnerability)
-                      expect(@sensor).to_not receive(:send_event)
-
-                      result = @sensor.check(XssSensor::GET_PARAM, @meta, "param_name", "param_value", @payloads_policy)
+                      sensor = XssSensor.new({
+                        "enabled" => true,
+                        "exclude_forms" => true,
+                        "exclude_routes" => ["route_id"]
+                      })
+
+                      expect(sensor).to_not receive(:find_vulnerability)
+
+                      result = sensor.get_injection_attempt(
+                        XssSensor::GET_PARAM,
+                        @appsensor_meta,
+                        "param_name",
+                        "param_value"
+                      )
 
                       expect(result).to eq(false)
                     end
                   end
+
                   context "route id does not match" do
                     it "should return false" do
-                      @sensor.exclude_forms = true
-                      @sensor.exclude_cookies = false
-                      @sensor.excluded_route_ids = {"unmatching_route_id" => true}
-
-                      expect(@payloads_policy).to_not receive(:apply)
-                      expect(@sensor).to_not receive(:find_vulnerability)
-                      expect(@sensor).to_not receive(:send_event)
-
-                      result = @sensor.check(XssSensor::GET_PARAM, @meta, "param_name", "param_value", @payloads_policy)
+                      sensor = XssSensor.new({
+                        "enabled" => true,
+                        "exclude_forms" => true,
+                        "exclude_routes" => ["unmatching_route_id"]
+                      })
+
+                      expect(sensor).to_not receive(:find_vulnerability)
+
+                      result = sensor.get_injection_attempt(
+                        XssSensor::GET_PARAM,
+                        @appsensor_meta,
+                        "param_name",
+                        "param_value"
+                      )
 
                       expect(result).to eq(false)
                     end
@@ -435,72 +439,73 @@ module TCellAgent
 
               context "exclude cookies sensor" do
                 it "should return true" do
-                  @sensor.exclude_forms = false
-                  @sensor.exclude_cookies = true
+                  sensor = XssSensor.new({
+                    "enabled" => true,
+                    "exclude_cookies" => true,
+                  })
 
-                  expect(@sensor).to receive(:find_vulnerability).and_return(
+                  expect(sensor).to receive(:find_vulnerability).and_return(
                     {"param" => "vuln_param", "value" => "vuln_value", "pattern" => "1"}
                   )
-                  expect(@payloads_policy).to receive(:apply).and_return("vuln_value")
-                  expect(@sensor).to receive(:send_event).with(
-                    @meta,
-                    "xss",
-                    "vuln_param",
-                    {"l" => XssSensor::PARAM_TYPE_TO_L[XssSensor::GET_PARAM]},
-                    "vuln_value",
-                    "1"
-                  )
 
-                  result = @sensor.check(
+                  result = sensor.get_injection_attempt(
                     XssSensor::GET_PARAM,
-                    @meta,
+                    @appsensor_meta,
                     "param_name",
                     "param_value",
-                    @payloads_policy
                   )
 
-                  expect(result).to eq(true)
+                  expect(result.type_of_param).to eq(XssSensor::GET_PARAM)
+                  expect(result.detection_point).to eq(sensor.detection_point)
+                  expect(result.param_name).to eq("vuln_param")
+                  expect(result.param_value).to eq("vuln_value")
+                  expect(result.pattern).to eq("1")
                 end
 
                 context "no excluded routes" do
                   it "should return true" do
-                    @sensor.exclude_forms = false
-                    @sensor.exclude_cookies = true
-                    @sensor.excluded_route_ids = {}
+                    sensor = XssSensor.new({
+                      "enabled" => true,
+                      "exclude_cookies" => true,
+                      "exclude_routes" => []
+                    })
 
-                    expect(@sensor).to receive(:find_vulnerability).and_return(
+                    expect(sensor).to receive(:find_vulnerability).and_return(
                       {"param" => "vuln_param", "value" => "vuln_value", "pattern" => "1"}
                     )
-                    expect(@payloads_policy).to receive(:apply).with(
-                      "xss", {}, "get", "vuln_param", "vuln_value", {"l"=>"query"}, "1"
-                    ).and_return("vuln_value")
-                    expect(@sensor).to receive(:send_event).with(
-                      @meta,
-                      "xss",
-                      "vuln_param",
-                      {"l" => XssSensor::PARAM_TYPE_TO_L[XssSensor::GET_PARAM]},
-                      "vuln_value",
-                      "1"
-                    )
 
-                    result = @sensor.check(XssSensor::GET_PARAM, @meta, "param_name", "param_value", @payloads_policy)
+                    result = sensor.get_injection_attempt(
+                      XssSensor::GET_PARAM,
+                      @appsensor_meta,
+                      "param_name",
+                      "param_value"
+                    )
 
-                    expect(result).to eq(true)
+                    expect(result.type_of_param).to eq(XssSensor::GET_PARAM)
+                    expect(result.detection_point).to eq(sensor.detection_point)
+                    expect(result.param_name).to eq("vuln_param")
+                    expect(result.param_value).to eq("vuln_value")
+                    expect(result.pattern).to eq("1")
                   end
                 end
 
                 context "has excluded routes" do
                   context "route id matches" do
                     it "should return false" do
-                      @sensor.exclude_forms = false
-                      @sensor.exclude_cookies = true
-                      @sensor.excluded_route_ids = {"route_id" => true}
-
-                      expect(@sensor).to_not receive(:find_vulnerability)
-                      expect(@payloads_policy).to_not receive(:apply)
-                      expect(@sensor).to_not receive(:send_event)
-
-                      result = @sensor.check(XssSensor::GET_PARAM, @meta, "param_name", "param_value", @payloads_policy)
+                      sensor = XssSensor.new({
+                        "enabled" => true,
+                        "exclude_cookies" => true,
+                        "exclude_routes" => ["route_id"]
+                      })
+
+                      expect(sensor).to_not receive(:find_vulnerability)
+
+                      result = sensor.get_injection_attempt(
+                        XssSensor::GET_PARAM,
+                        @appsensor_meta,
+                        "param_name",
+                        "param_value"
+                      )
 
                       expect(result).to eq(false)
                     end
@@ -508,28 +513,28 @@ module TCellAgent
 
                   context "route id does not match" do
                     it "should return true" do
-                      @sensor.exclude_forms = false
-                      @sensor.exclude_cookies = true
-                      @sensor.excluded_route_ids = {"unmatching_route_id" => true}
+                      sensor = XssSensor.new({
+                        "enabled" => true,
+                        "exclude_cookies" => true,
+                        "exclude_routes" => ["unmatching_route_id"]
+                      })
 
-                      expect(@sensor).to receive(:find_vulnerability).and_return(
+                      expect(sensor).to receive(:find_vulnerability).and_return(
                         {"param" => "vuln_param", "value" => "vuln_value", "pattern" => "1"}
                       )
-                      expect(@payloads_policy).to receive(:apply).with(
-                        "xss", {}, "get", "vuln_param", "vuln_value", {"l"=>"query"}, "1"
-                      ).and_return("vuln_value")
-                      expect(@sensor).to receive(:send_event).with(
-                        @meta,
-                        "xss",
-                        "vuln_param",
-                        {"l" => XssSensor::PARAM_TYPE_TO_L[XssSensor::GET_PARAM]},
-                        "vuln_value",
-                        "1"
-                      )
 
-                      result = @sensor.check(XssSensor::GET_PARAM, @meta, "param_name", "param_value", @payloads_policy)
+                      result = sensor.get_injection_attempt(
+                        XssSensor::GET_PARAM,
+                        @appsensor_meta,
+                        "param_name",
+                        "param_value"
+                      )
 
-                      expect(result).to eq(true)
+                      expect(result.type_of_param).to eq(XssSensor::GET_PARAM)
+                      expect(result.detection_point).to eq(sensor.detection_point)
+                      expect(result.param_name).to eq("vuln_param")
+                      expect(result.param_value).to eq("vuln_value")
+                      expect(result.pattern).to eq("1")
                     end
                   end
                 end
@@ -539,19 +544,18 @@ module TCellAgent
             context "param is a POST param" do
               context "exclude forms sensor" do
                 it "should return false" do
-                  @sensor.exclude_forms = true
-                  @sensor.exclude_cookies = false
+                  sensor = XssSensor.new({
+                    "enabled" => true,
+                    "exclude_forms" => true
+                  })
 
-                  expect(@payloads_policy).to_not receive(:apply)
-                  expect(@sensor).to_not receive(:find_vulnerability)
-                  expect(@sensor).to_not receive(:send_event)
+                  expect(sensor).to_not receive(:find_vulnerability)
 
-                  result = @sensor.check(
+                  result = sensor.get_injection_attempt(
                     XssSensor::POST_PARAM,
-                    @meta,
+                    @appsensor_meta,
                     "param_name",
                     "param_value",
-                    @payloads_policy
                   )
 
                   expect(result).to eq(false)
@@ -560,31 +564,27 @@ module TCellAgent
 
               context "exclude cookies sensor" do
                 it "should return true" do
-                  @sensor.exclude_forms = false
-                  @sensor.exclude_cookies = true
+                  sensor = XssSensor.new({
+                    "enabled" => true,
+                    "exclude_cookies" => true
+                  })
 
-                  expect(@sensor).to receive(:find_vulnerability).and_return(
+                  expect(sensor).to receive(:find_vulnerability).and_return(
                     {"param" => "vuln_param", "value" => "vuln_value", "pattern" => "1"}
                   )
-                  expect(@payloads_policy).to receive(:apply).and_return("vuln_value")
-                  expect(@sensor).to receive(:send_event).with(
-                    @meta,
-                    "xss",
-                    "vuln_param",
-                    {"l" => XssSensor::PARAM_TYPE_TO_L[XssSensor::POST_PARAM]},
-                    "vuln_value",
-                    "1"
-                  )
 
-                  result = @sensor.check(
+                  result = sensor.get_injection_attempt(
                     XssSensor::POST_PARAM,
-                    @meta,
+                    @appsensor_meta,
                     "param_name",
                     "param_value",
-                    @payloads_policy
                   )
 
-                  expect(result).to eq(true)
+                  expect(result.type_of_param).to eq(XssSensor::POST_PARAM)
+                  expect(result.detection_point).to eq(sensor.detection_point)
+                  expect(result.param_name).to eq("vuln_param")
+                  expect(result.param_value).to eq("vuln_value")
+                  expect(result.pattern).to eq("1")
                 end
               end
             end
@@ -592,19 +592,18 @@ module TCellAgent
             context "param is a JSON param" do
               context "exclude forms sensor" do
                 it "should return false" do
-                  @sensor.exclude_forms = true
-                  @sensor.exclude_cookies = false
+                  sensor = XssSensor.new({
+                    "enabled" => true,
+                    "exclude_forms" => true
+                  })
 
-                  expect(@payloads_policy).to_not receive(:apply)
-                  expect(@sensor).to_not receive(:find_vulnerability)
-                  expect(@sensor).to_not receive(:send_event)
+                  expect(sensor).to_not receive(:find_vulnerability)
 
-                  result = @sensor.check(
+                  result = sensor.get_injection_attempt(
                     XssSensor::JSON_PARAM,
-                    @meta,
+                    @appsensor_meta,
                     "param_name",
                     "param_value",
-                    @payloads_policy
                   )
 
                   expect(result).to eq(false)
@@ -613,31 +612,27 @@ module TCellAgent
 
               context "exclude cookies sensor" do
                 it "should return true" do
-                  @sensor.exclude_forms = false
-                  @sensor.exclude_cookies = true
+                  sensor = XssSensor.new({
+                    "enabled" => true,
+                    "exclude_cookies" => true
+                  })
 
-                  expect(@sensor).to receive(:find_vulnerability).and_return(
+                  expect(sensor).to receive(:find_vulnerability).and_return(
                     {"param" => "vuln_param", "value" => "vuln_value", "pattern" => "1"}
                   )
-                  expect(@payloads_policy).to receive(:apply).and_return("vuln_value")
-                  expect(@sensor).to receive(:send_event).with(
-                    @meta,
-                    "xss",
-                    "vuln_param",
-                    {"l" => XssSensor::PARAM_TYPE_TO_L[XssSensor::JSON_PARAM]},
-                    "vuln_value",
-                    "1"
-                  )
 
-                  result = @sensor.check(
+                  result = sensor.get_injection_attempt(
                     XssSensor::JSON_PARAM,
-                    @meta,
+                    @appsensor_meta,
                     "param_name",
                     "param_value",
-                    @payloads_policy
                   )
 
-                  expect(result).to eq(true)
+                  expect(result.type_of_param).to eq(XssSensor::JSON_PARAM)
+                  expect(result.detection_point).to eq(sensor.detection_point)
+                  expect(result.param_name).to eq("vuln_param")
+                  expect(result.param_value).to eq("vuln_value")
+                  expect(result.pattern).to eq("1")
                 end
               end
             end
@@ -645,49 +640,44 @@ module TCellAgent
             context "param is a COOKIE param" do
               context "exclude forms sensor" do
                 it "should return true" do
-                  @sensor.exclude_forms = true
-                  @sensor.exclude_cookies = false
+                  sensor = XssSensor.new({
+                    "enabled" => true,
+                    "exclude_forms" => true
+                  })
 
-                  expect(@sensor).to receive(:find_vulnerability).and_return(
+                  expect(sensor).to receive(:find_vulnerability).and_return(
                     {"param" => "vuln_param", "value" => "vuln_value", "pattern" => "1"}
                   )
-                  expect(@payloads_policy).to receive(:apply).and_return("vuln_value")
-                  expect(@sensor).to receive(:send_event).with(
-                    @meta,
-                    "xss",
-                    "vuln_param",
-                    {"l" => XssSensor::PARAM_TYPE_TO_L[XssSensor::COOKIE_PARAM]},
-                    "vuln_value",
-                    "1"
-                  )
 
-                  result = @sensor.check(
+                  result = sensor.get_injection_attempt(
                     XssSensor::COOKIE_PARAM,
-                    @meta,
+                    @appsensor_meta,
                     "param_name",
                     "param_value",
-                    @payloads_policy
                   )
 
-                  expect(result).to eq(true)
+                  expect(result.type_of_param).to eq(XssSensor::COOKIE_PARAM)
+                  expect(result.detection_point).to eq(sensor.detection_point)
+                  expect(result.param_name).to eq("vuln_param")
+                  expect(result.param_value).to eq("vuln_value")
+                  expect(result.pattern).to eq("1")
                 end
               end
 
               context "exclude cookies sensor" do
                 it "should return false" do
-                  @sensor.exclude_forms = false
-                  @sensor.exclude_cookies = true
+                  sensor = XssSensor.new({
+                    "enabled" => true,
+                    "exclude_cookies" => true
+                  })
 
-                  expect(@sensor).to_not receive(:find_vulnerability)
-                  expect(@payloads_policy).to_not receive(:apply)
-                  expect(@sensor).to_not receive(:send_event)
+                  expect(sensor).to_not receive(:find_vulnerability)
 
-                  result = @sensor.check(
+                  result = sensor.get_injection_attempt(
                     XssSensor::COOKIE_PARAM,
-                    @meta,
+                    @appsensor_meta,
                     "param_name",
                     "param_value",
-                    @payloads_policy
                   )
 
                   expect(result).to eq(false)
@@ -696,6 +686,18 @@ module TCellAgent
             end
           end
         end
+
+      end
+
+      describe "#applicable_for_param_type?" do
+        it "should be applicable for all param types" do
+          sensor = XssSensor.new
+          expect(sensor.applicable_for_param_type?(InjectionSensor::GET_PARAM)).to eq(true)
+          expect(sensor.applicable_for_param_type?(InjectionSensor::POST_PARAM)).to eq(true)
+          expect(sensor.applicable_for_param_type?(InjectionSensor::JSON_PARAM)).to eq(true)
+          expect(sensor.applicable_for_param_type?(InjectionSensor::COOKIE_PARAM)).to eq(true)
+          expect(sensor.applicable_for_param_type?(InjectionSensor::URI_PARAM)).to eq(true)
+        end
       end
     end