tcell_agent 0.2.29.rc2 → 0.2.29

data/spec/lib/tcell_agent/configuration_spec.rb

@@ -178,6 +178,62 @@ module TCellAgent
       end
     end
 
+    describe "#allow_unencrypted_appfirewall_payloads" do
+      context "setting it via config" do
+        context "using allow_unencrypted_appsensor_payloads" do
+          it "should be true" do
+            allow_unencrypted_appfirewall_payloads_enabled = double(
+              "no_data_ex",
+              read: {
+                version: 1,
+                applications: [
+                  app_id: "app_id",
+                  api_key: "api_key",
+                  allow_unencrypted_appsensor_payloads: true
+                ]
+              }.to_json
+            )
+            expect(File).to receive(:file?).with(
+              File.join(Dir.getwd, "config/tcell_agent.config")
+            ).and_return(true)
+            expect(File).to receive(:open).with(
+              File.join(Dir.getwd, "config/tcell_agent.config")
+            ).and_return(allow_unencrypted_appfirewall_payloads_enabled)
+
+            configuration = Configuration.new
+
+            expect(configuration.allow_unencrypted_appfirewall_payloads).to eq(true)
+          end
+        end
+
+        context "using allow_unencrypted_appfirewall_payloads" do
+          it "should be true" do
+            allow_unencrypted_appfirewall_payloads_enabled = double(
+              "no_data_ex",
+              read: {
+                version: 1,
+                applications: [
+                  app_id: "app_id",
+                  api_key: "api_key",
+                  allow_unencrypted_appfirewall_payloads: true
+                ]
+              }.to_json
+            )
+            expect(File).to receive(:file?).with(
+              File.join(Dir.getwd, "config/tcell_agent.config")
+            ).and_return(true)
+            expect(File).to receive(:open).with(
+              File.join(Dir.getwd, "config/tcell_agent.config")
+            ).and_return(allow_unencrypted_appfirewall_payloads_enabled)
+
+            configuration = Configuration.new
+
+            expect(configuration.allow_unencrypted_appfirewall_payloads).to eq(true)
+          end
+        end
+      end
+    end
+
   end
 
 end

data/spec/lib/tcell_agent/patches/block_rule_spec.rb

@@ -30,11 +30,10 @@ module TCellAgent
           it "should return nil" do
             logger = double("logger")
             expect(TCellAgent).to receive(:logger).and_return(logger)
-            expect(logger).to receive(:error).with("Patches Policy block rule cannot be global. Specify either ips and/or route ids")
+            expect(logger).to receive(:error).with("Patches Policy block rule cannot be global. Specify either ips and/or route ids or blocked paths")
 
             expect(BlockRule.from_json({"action" => "block_403s"})).to eq(nil)
           end
-
         end
 
         context "with all the fields provided" do
@@ -42,6 +41,7 @@ module TCellAgent
             policy_json = {
               "ips" => ["1.1.1.1", "1.3.3.3"],
               "rids" => ["1396482959514716287","1396482959514716237"],
+              "paths" => [{"exact" => "/index/"}, {"starts_with" => "/admin"}],
               "sensor_matches" => {
                 "xss" => {}
               },
@@ -56,9 +56,10 @@ module TCellAgent
             expect(block_rule.sensors_matcher.injections_matcher.enabled).to eq(true)
             expect(block_rule.sensors_matcher.injections_matcher.sensors.size).to eq(1)
             expect(block_rule.sensors_matcher.injections_matcher.sensors[0].active_pattern_ids).to eq(Set.new)
+            expect(block_rule.exact_blocked_paths).to eq(Set.new(["/index", "/index/"]))
+            expect(block_rule.starts_with_blocked_paths).to eq(["/admin"])
           end
         end
-
       end
 
       describe "#block?" do
@@ -82,7 +83,9 @@ module TCellAgent
                     Set.new,
                     Set.new(["route_id"]),
                     SensorsMatcher.new(injections_matcher),
-                    "block_403s"
+                    "block_403s",
+                    Set.new,
+                    []
                   )
 
                   expect(injections_matcher).to receive(:enabled).and_return(false)
@@ -104,7 +107,9 @@ module TCellAgent
                       Set.new,
                       Set.new(["route_id"]),
                       SensorsMatcher.new(injections_matcher),
-                      "block_403s"
+                      "block_403s",
+                      Set.new,
+                      []
                     )
 
                     expect(injections_matcher).to receive(:enabled).and_return(true)
@@ -126,7 +131,9 @@ module TCellAgent
                       Set.new,
                       Set.new(["route_id"]),
                       SensorsMatcher.new(injections_matcher),
-                      "block_403s"
+                      "block_403s",
+                      Set.new,
+                      []
                     )
 
                     expect(injections_matcher).to receive(:enabled).and_return(true)
@@ -153,7 +160,9 @@ module TCellAgent
                     Set.new,
                     Set.new(["route_id"]),
                     SensorsMatcher.new(injections_matcher),
-                    "block_403s"
+                    "block_403s",
+                    Set.new,
+                    []
                   )
 
                   expect(injections_matcher).to_not receive(:enabled)
@@ -175,7 +184,9 @@ module TCellAgent
                       Set.new,
                       Set.new(["route_id"]),
                       SensorsMatcher.new(injections_matcher),
-                      "block_403s"
+                      "block_403s",
+                      Set.new,
+                      []
                     )
 
                     expect(injections_matcher).to_not receive(:enabled)
@@ -196,7 +207,9 @@ module TCellAgent
                       Set.new,
                       Set.new(["route_id"]),
                       SensorsMatcher.new(injections_matcher),
-                      "block_403s"
+                      "block_403s",
+                      Set.new,
+                      []
                     )
 
                     expect(injections_matcher).to_not receive(:enabled)
@@ -222,7 +235,9 @@ module TCellAgent
                 Set.new(["2.2.2.2"]),
                 Set.new(["route_id"]),
                 SensorsMatcher.new(injections_matcher),
-                "block_403s"
+                "block_403s",
+                Set.new,
+                []
               )
 
               expect(injections_matcher).to_not receive(:enabled)
@@ -246,7 +261,9 @@ module TCellAgent
                       Set.new(["1.1.1.1"]),
                       Set.new(["route_id"]),
                       SensorsMatcher.new(injections_matcher),
-                      "block_403s"
+                      "block_403s",
+                      Set.new,
+                      []
                     )
 
                     expect(injections_matcher).to receive(:enabled).and_return(false)
@@ -268,7 +285,9 @@ module TCellAgent
                         Set.new(["1.1.1.1"]),
                         Set.new(["route_id"]),
                         SensorsMatcher.new(injections_matcher),
-                        "block_403s"
+                        "block_403s",
+                        Set.new,
+                        []
                       )
 
                       expect(injections_matcher).to receive(:enabled).and_return(true)
@@ -290,7 +309,9 @@ module TCellAgent
                         Set.new(["1.1.1.1"]),
                         Set.new(["route_id"]),
                         SensorsMatcher.new(injections_matcher),
-                        "block_403s"
+                        "block_403s",
+                        Set.new,
+                        []
                       )
 
                       expect(injections_matcher).to receive(:enabled).and_return(true)
@@ -317,7 +338,9 @@ module TCellAgent
                       Set.new(["1.1.1.1"]),
                       Set.new(["route_id"]),
                       SensorsMatcher.new(injections_matcher),
-                      "block_403s"
+                      "block_403s",
+                      Set.new,
+                      []
                     )
 
                     expect(injections_matcher).to_not receive(:enabled)
@@ -339,7 +362,9 @@ module TCellAgent
                         Set.new(["1.1.1.1"]),
                         Set.new(["route_id"]),
                         SensorsMatcher.new(injections_matcher),
-                        "block_403s"
+                        "block_403s",
+                        Set.new,
+                        []
                       )
 
                       expect(injections_matcher).to_not receive(:enabled)
@@ -360,7 +385,9 @@ module TCellAgent
                         Set.new(["1.1.1.1"]),
                         Set.new(["route_id"]),
                         SensorsMatcher.new(injections_matcher),
-                        "block_403s"
+                        "block_403s",
+                        Set.new,
+                        []
                       )
 
                       expect(injections_matcher).to_not receive(:enabled)
@@ -373,6 +400,73 @@ module TCellAgent
             end
           end
         end
+
+        context "with blocked paths" do
+          context "without ips" do
+            context "matching paths" do
+              it "should block" do
+                injections_matcher = double("injections_matcher")
+
+                meta_data = TCellAgent::Patches::MetaData.new
+                meta_data.remote_address = "1.1.1.1"
+                meta_data.route_id = "route_id"
+
+                block_rule = BlockRule.new(
+                  Set.new(["1.1.1.1"]),
+                  Set.new(["route_id"]),
+                  SensorsMatcher.new(injections_matcher),
+                  "block_403s",
+                  Set.new(["/index", "/index/"]),
+                  ["/admin"]
+                )
+
+                expect(injections_matcher).to_not receive(:enabled)
+
+                meta_data.path = "/index"
+                expect(block_rule.block?(meta_data)).to eq(true)
+
+                meta_data.path = "/index/"
+                expect(block_rule.block?(meta_data)).to eq(true)
+
+                meta_data.path = "/admin"
+                expect(block_rule.block?(meta_data)).to eq(true)
+
+                meta_data.path = "/admin/users"
+                expect(block_rule.block?(meta_data)).to eq(true)
+              end
+            end
+
+            context "not matching blocking paths" do
+              it "should not block" do
+                injections_matcher = double("injections_matcher")
+
+                meta_data = TCellAgent::Patches::MetaData.new
+                meta_data.remote_address = "1.1.1.1"
+                meta_data.route_id = "route_id"
+
+                block_rule = BlockRule.new(
+                  Set.new(["1.1.1.1"]),
+                  Set.new(["route_id"]),
+                  SensorsMatcher.new(injections_matcher),
+                  "block_403s",
+                  Set.new(["/index", "/index/"]),
+                  ["/admin"]
+                )
+
+                expect(injections_matcher).to_not receive(:enabled)
+
+                meta_data.path = "/index/subpath"
+                expect(block_rule.block?(meta_data)).to eq(false)
+
+                meta_data.path = "/welcome"
+                expect(block_rule.block?(meta_data)).to eq(false)
+
+                meta_data.path = "/welcome/"
+                expect(block_rule.block?(meta_data)).to eq(false)
+              end
+            end
+          end
+        end
       end
 
     end

data/spec/lib/tcell_agent/policies/appsensor/payloads_policy_log_spec.rb

@@ -41,53 +41,166 @@ module TCellAgent
         end
 
         context "with log_payloads enabled" do
-          context "with allow_unencrypted_appfirewall_payloads_logging disabled" do
-            it "should not log" do
-              policy = PayloadsPolicy.from_json({
-                "payloads" => {
-                  "log_payloads" => true
-                }
-              })
-
-              configuration = double("configuration")
-
-              expect(TCellAgent).to receive(:configuration).and_return(configuration)
-              expect(configuration).to receive(:allow_unencrypted_appfirewall_payloads_logging).and_return(
-                false
-              )
-              expect(TCellAgent).to_not receive(:appfirewall_payloads_logger)
-
-              policy.log(
-                "xss",
-                @meta,
-                TCellAgent::Utils::Params::GET_PARAM,
-                "password",
-                "alert()",
-                {"l" => "query"},
-                "pattern"
-              )
+          context "with no blacklist" do
+            context "with no whitelist" do
+              it "should log the value" do
+                policy = PayloadsPolicy.from_json({
+                  "payloads" => {
+                    "log_payloads" => true
+                  }
+                })
+                configuration = double("configuration", "enabled" => true)
+                appfirewall_payloads_logger = double("appfirewall_payloads_logger")
+
+                expect(TCellAgent).to receive(:configuration).and_return(configuration).exactly(3).times
+                expect(configuration).to receive(:appfirewall_payloads_logger).and_return(
+                  appfirewall_payloads_logger
+                ).exactly(2).times
+                expect_any_instance_of(TCellAgent::SensorEvents::TCellAppSensorEvent).to receive(
+                  :post_process
+                )
+                expect(appfirewall_payloads_logger).to receive(:info).with({
+                  "event_type" => "as",
+                  "dp" => "xss",
+                  "param" => "password",
+                  "remote_addr" => "remote_address",
+                  "m" => "get",
+                  "pattern" => "pattern",
+                  "meta" => {"l" => "query"},
+                  "rid" => "route_id"
+                }.to_json)
+
+                policy.log(
+                  "xss",
+                  @meta,
+                  TCellAgent::Utils::Params::GET_PARAM,
+                  "password",
+                  "alert()",
+                  {"l" => "query"},
+                  "pattern"
+                )
+              end
+            end
+
+            context "with a whitelist" do
+              context "that does not specify locations for the param" do
+                it "should not log" do
+                  policy = PayloadsPolicy.from_json({
+                    "payloads" => {
+                      "log_payloads" => true,
+                      "log_whitelist" => {
+                        "username" => ["*"]
+                      }
+                    }
+                  })
+
+                  expect(TCellAgent).to_not receive(:configuration)
+
+                  policy.log(
+                    "xss",
+                    @meta,
+                    TCellAgent::Utils::Params::GET_PARAM,
+                    "password",
+                    "alert()",
+                    {"l" => "query"},
+                    "pattern"
+                  )
+                end
+              end
+
+              context "that specifies locations for the param" do
+                context "param location does not match specified location do" do
+                  it "should not log" do
+                    policy = PayloadsPolicy.from_json({
+                      "payloads" => {
+                        "log_payloads" => true,
+                        "log_whitelist" => {
+                          "username" => ["*"],
+                          "password" => ["cookie"]
+                        }
+                      }
+                    })
+
+                    expect(TCellAgent).to_not receive(:configuration)
+
+                    policy.log(
+                      "xss",
+                      @meta,
+                      TCellAgent::Utils::Params::GET_PARAM,
+                      "password",
+                      "alert()",
+                      {"l" => "query"},
+                      "pattern"
+                    )
+                  end
+                end
+
+                context "param location matches the specified location in the whitelist" do
+                  it "should log the value" do
+                    policy = PayloadsPolicy.from_json({
+                      "payloads" => {
+                        "log_payloads" => true,
+                        "log_whitelist" => {
+                          "username" => ["*"],
+                          "PASSWORD" => ["form"]
+                        }
+                      }
+                    })
+                    configuration = double("configuration", "enabled" => true)
+                    appfirewall_payloads_logger = double("appfirewall_payloads_logger")
+
+                    expect(TCellAgent).to receive(:configuration).and_return(configuration).exactly(3).times
+                    expect(configuration).to receive(:appfirewall_payloads_logger).and_return(
+                      appfirewall_payloads_logger
+                    ).exactly(2).times
+                    expect_any_instance_of(TCellAgent::SensorEvents::TCellAppSensorEvent).to receive(
+                      :post_process
+                    )
+                    expect(appfirewall_payloads_logger).to receive(:info).with({
+                      "event_type" => "as",
+                      "dp" => "xss",
+                      "param" => "password",
+                      "remote_addr" => "remote_address",
+                      "m" => "get",
+                      "pattern" => "pattern",
+                      "meta" => {"l" => "query"},
+                      "rid" => "route_id",
+                    }.to_json)
+
+                    policy.log(
+                      "xss",
+                      @meta,
+                      TCellAgent::Utils::Params::GET_PARAM,
+                      "password",
+                      "alert()",
+                      {"l" => "query"},
+                      "pattern"
+                    )
+                  end
+                end
+              end
             end
           end
 
-          context "with allow_unencrypted_appfirewall_payloads_logging enabled" do
-            context "with no blacklist" do
+          context "with a blacklist" do
+            context "that does not specify locations for the param" do
               context "with no whitelist" do
                 it "should log the value" do
                   policy = PayloadsPolicy.from_json({
                     "payloads" => {
-                      "log_payloads" => true
+                      "log_payloads" => true,
+                      "log_blacklist" => {
+                        "username" => ["*"]
+                      }
                     }
                   })
-                  configuration = double("configuration")
+                  configuration = double("configuration", "enabled" => true)
                   appfirewall_payloads_logger = double("appfirewall_payloads_logger")
 
-                  expect(TCellAgent).to receive(:configuration).and_return(configuration)
-                  expect(configuration).to receive(:allow_unencrypted_appfirewall_payloads_logging).and_return(
-                    true
-                  )
-                  expect(TCellAgent).to receive(:appfirewall_payloads_logger).and_return(
+                  expect(TCellAgent).to receive(:configuration).and_return(configuration).exactly(3).times
+                  expect(configuration).to receive(:appfirewall_payloads_logger).and_return(
                     appfirewall_payloads_logger
-                  )
+                  ).exactly(2).times
                   expect_any_instance_of(TCellAgent::SensorEvents::TCellAppSensorEvent).to receive(
                     :post_process
                   )
@@ -120,18 +233,16 @@ module TCellAgent
                     policy = PayloadsPolicy.from_json({
                       "payloads" => {
                         "log_payloads" => true,
+                        "log_blacklist" => {
+                          "username" => ["*"]
+                        },
                         "log_whitelist" => {
                           "username" => ["*"]
                         }
                       }
                     })
-                    configuration = double("configuration")
 
-                    expect(TCellAgent).to receive(:configuration).and_return(configuration)
-                    expect(configuration).to receive(:allow_unencrypted_appfirewall_payloads_logging).and_return(
-                      true
-                    )
-                    expect(TCellAgent).to_not receive(:appfirewall_payloads_logger)
+                    expect(TCellAgent).to_not receive(:configuration)
 
                     policy.log(
                       "xss",
@@ -146,24 +257,21 @@ module TCellAgent
                 end
 
                 context "that specifies locations for the param" do
-                  context "param location does not match specified location do" do
+                  context "param location does not match specified location" do
                     it "should not log" do
                       policy = PayloadsPolicy.from_json({
                         "payloads" => {
                           "log_payloads" => true,
-                          "log_whitelist" => {
+                          "log_blacklist" => {
                             "username" => ["*"],
+                          },
+                          "log_whitelist" => {
                             "password" => ["cookie"]
                           }
                         }
                       })
-                      configuration = double("configuration")
 
-                      expect(TCellAgent).to receive(:configuration).and_return(configuration)
-                      expect(configuration).to receive(:allow_unencrypted_appfirewall_payloads_logging).and_return(
-                        true
-                      )
-                      expect(TCellAgent).to_not receive(:appfirewall_payloads_logger)
+                      expect(TCellAgent).to_not receive(:configuration)
 
                       policy.log(
                         "xss",
@@ -177,27 +285,27 @@ module TCellAgent
                     end
                   end
 
-                  context "param location matches the specified location in the whitelist" do
+                  context "param location matches the specified location" do
                     it "should log the value" do
                       policy = PayloadsPolicy.from_json({
                         "payloads" => {
                           "log_payloads" => true,
-                          "log_whitelist" => {
+                          "log_blacklist" => {
                             "username" => ["*"],
+                          },
+                          "log_whitelist" => {
                             "PASSWORD" => ["form"]
                           }
-                        }
+                        },
+                        "uri_options" => {"collect_full_uri" => true}
                       })
-                      configuration = double("configuration")
+                      configuration = double("configuration", "enabled" => true)
                       appfirewall_payloads_logger = double("appfirewall_payloads_logger")
 
-                      expect(TCellAgent).to receive(:configuration).and_return(configuration)
-                      expect(configuration).to receive(:allow_unencrypted_appfirewall_payloads_logging).and_return(
-                        true
-                      )
-                      expect(TCellAgent).to receive(:appfirewall_payloads_logger).and_return(
+                      expect(TCellAgent).to receive(:configuration).and_return(configuration).exactly(3).times
+                      expect(configuration).to receive(:appfirewall_payloads_logger).and_return(
                         appfirewall_payloads_logger
-                      )
+                      ).exactly(2).times
                       expect_any_instance_of(TCellAgent::SensorEvents::TCellAppSensorEvent).to receive(
                         :post_process
                       )
@@ -210,6 +318,7 @@ module TCellAgent
                         "pattern" => "pattern",
                         "meta" => {"l" => "query"},
                         "rid" => "route_id",
+                        "full_uri" => "location"
                       }.to_json)
 
                       policy.log(
@@ -227,249 +336,73 @@ module TCellAgent
               end
             end
 
-            context "with a blacklist" do
-              context "that does not specify locations for the param" do
-                context "with no whitelist" do
-                  it "should log the value" do
-                    policy = PayloadsPolicy.from_json({
-                      "payloads" => {
-                        "log_payloads" => true,
-                        "log_blacklist" => {
-                          "username" => ["*"]
-                        }
+            context "that specifies locations for the param" do
+              context "param location does not match specified location" do
+                it "should log the value" do
+                  policy = PayloadsPolicy.from_json({
+                    "payloads" => {
+                      "log_payloads" => true,
+                      "log_blacklist" => {
+                        "password" => ["cookie"],
                       }
-                    })
-                    configuration = double("configuration")
-                    appfirewall_payloads_logger = double("appfirewall_payloads_logger")
-
-                    expect(TCellAgent).to receive(:configuration).and_return(configuration)
-                    expect(configuration).to receive(:allow_unencrypted_appfirewall_payloads_logging).and_return(
-                      true
-                    )
-                    expect(TCellAgent).to receive(:appfirewall_payloads_logger).and_return(
-                      appfirewall_payloads_logger
-                    )
-                    expect_any_instance_of(TCellAgent::SensorEvents::TCellAppSensorEvent).to receive(
-                      :post_process
-                    )
-                    expect(appfirewall_payloads_logger).to receive(:info).with({
-                      "event_type" => "as",
-                      "dp" => "xss",
-                      "param" => "password",
-                      "remote_addr" => "remote_address",
-                      "m" => "get",
-                      "pattern" => "pattern",
-                      "meta" => {"l" => "query"},
-                      "rid" => "route_id"
-                    }.to_json)
-
-                    policy.log(
-                      "xss",
-                      @meta,
-                      TCellAgent::Utils::Params::GET_PARAM,
-                      "password",
-                      "alert()",
-                      {"l" => "query"},
-                      "pattern"
-                    )
-                  end
-                end
-
-                context "with a whitelist" do
-                  context "that does not specify locations for the param" do
-                    it "should not log" do
-                      policy = PayloadsPolicy.from_json({
-                        "payloads" => {
-                          "log_payloads" => true,
-                          "log_blacklist" => {
-                            "username" => ["*"]
-                          },
-                          "log_whitelist" => {
-                            "username" => ["*"]
-                          }
-                        }
-                      })
-                      configuration = double("configuration")
-
-                      expect(TCellAgent).to receive(:configuration).and_return(configuration)
-                      expect(configuration).to receive(:allow_unencrypted_appfirewall_payloads_logging).and_return(
-                        true
-                      )
-                      expect(TCellAgent).to_not receive(:appfirewall_payloads_logger)
-
-                      policy.log(
-                        "xss",
-                        @meta,
-                        TCellAgent::Utils::Params::GET_PARAM,
-                        "password",
-                        "alert()",
-                        {"l" => "query"},
-                        "pattern"
-                      )
-                    end
-                  end
+                    },
+                    "uri_options" => {"collect_full_uri" => false}
+                  })
+                  configuration = double("configuration", "enabled" => true)
+                  appfirewall_payloads_logger = double("appfirewall_payloads_logger")
 
-                  context "that specifies locations for the param" do
-                    context "param location does not match specified location" do
-                      it "should not log" do
-                        policy = PayloadsPolicy.from_json({
-                          "payloads" => {
-                            "log_payloads" => true,
-                            "log_blacklist" => {
-                              "username" => ["*"],
-                            },
-                            "log_whitelist" => {
-                              "password" => ["cookie"]
-                            }
-                          }
-                        })
-                        configuration = double("configuration")
-
-                        expect(TCellAgent).to receive(:configuration).and_return(configuration)
-                        expect(configuration).to receive(:allow_unencrypted_appfirewall_payloads_logging).and_return(
-                          true
-                        )
-                        expect(TCellAgent).to_not receive(:appfirewall_payloads_logger)
-
-                        policy.log(
-                          "xss",
-                          @meta,
-                          TCellAgent::Utils::Params::GET_PARAM,
-                          "password",
-                          "alert()",
-                          {"l" => "query"},
-                          "pattern"
-                        )
-                      end
-                    end
+                  expect(TCellAgent).to receive(:configuration).and_return(configuration).exactly(3).times
+                  expect(configuration).to receive(:appfirewall_payloads_logger).and_return(
+                    appfirewall_payloads_logger
+                  ).exactly(2).times
+                  expect_any_instance_of(TCellAgent::SensorEvents::TCellAppSensorEvent).to receive(
+                    :post_process
+                  )
+                  expect(appfirewall_payloads_logger).to receive(:info).with({
+                    "event_type" => "as",
+                    "dp" => "xss",
+                    "param" => "password",
+                    "remote_addr" => "remote_address",
+                    "m" => "get",
+                    "pattern" => "pattern",
+                    "meta" => {"l" => "query"},
+                    "rid" => "route_id"
+                  }.to_json)
 
-                    context "param location matches the specified location" do
-                      it "should log the value" do
-                        policy = PayloadsPolicy.from_json({
-                          "payloads" => {
-                            "log_payloads" => true,
-                            "log_blacklist" => {
-                              "username" => ["*"],
-                            },
-                            "log_whitelist" => {
-                              "PASSWORD" => ["form"]
-                            }
-                          }
-                        })
-                        configuration = double("configuration")
-                        appfirewall_payloads_logger = double("appfirewall_payloads_logger")
-
-                        expect(TCellAgent).to receive(:configuration).and_return(configuration)
-                        expect(configuration).to receive(:allow_unencrypted_appfirewall_payloads_logging).and_return(
-                          true
-                        )
-                        expect(TCellAgent).to receive(:appfirewall_payloads_logger).and_return(
-                          appfirewall_payloads_logger
-                        )
-                        expect_any_instance_of(TCellAgent::SensorEvents::TCellAppSensorEvent).to receive(
-                          :post_process
-                        )
-                        expect(appfirewall_payloads_logger).to receive(:info).with({
-                          "event_type" => "as",
-                          "dp" => "xss",
-                          "param" => "password",
-                          "remote_addr" => "remote_address",
-                          "m" => "get",
-                          "pattern" => "pattern",
-                          "meta" => {"l" => "query"},
-                          "rid" => "route_id"
-                        }.to_json)
-
-                        policy.log(
-                          "xss",
-                          @meta,
-                          TCellAgent::Utils::Params::GET_PARAM,
-                          "password",
-                          "alert()",
-                          {"l" => "query"},
-                          "pattern"
-                        )
-                      end
-                    end
-                  end
+                  policy.log(
+                    "xss",
+                    @meta,
+                    TCellAgent::Utils::Params::GET_PARAM,
+                    "password",
+                    "alert()",
+                    {"l" => "query"},
+                    "pattern"
+                  )
                 end
               end
 
-              context "that specifies locations for the param" do
-                context "param location does not match specified location" do
-                  it "should log the value" do
-                    policy = PayloadsPolicy.from_json({
-                      "payloads" => {
-                        "log_payloads" => true,
-                        "log_blacklist" => {
-                          "password" => ["cookie"],
-                        }
-                      }
-                    })
-                    configuration = double("configuration")
-                    appfirewall_payloads_logger = double("appfirewall_payloads_logger")
-
-                    expect(TCellAgent).to receive(:configuration).and_return(configuration)
-                    expect(configuration).to receive(:allow_unencrypted_appfirewall_payloads_logging).and_return(
-                      true
-                    )
-                    expect(TCellAgent).to receive(:appfirewall_payloads_logger).and_return(
-                      appfirewall_payloads_logger
-                    )
-                    expect_any_instance_of(TCellAgent::SensorEvents::TCellAppSensorEvent).to receive(
-                      :post_process
-                    )
-                    expect(appfirewall_payloads_logger).to receive(:info).with({
-                      "event_type" => "as",
-                      "dp" => "xss",
-                      "param" => "password",
-                      "remote_addr" => "remote_address",
-                      "m" => "get",
-                      "pattern" => "pattern",
-                      "meta" => {"l" => "query"},
-                      "rid" => "route_id"
-                    }.to_json)
-
-                    policy.log(
-                      "xss",
-                      @meta,
-                      TCellAgent::Utils::Params::GET_PARAM,
-                      "password",
-                      "alert()",
-                      {"l" => "query"},
-                      "pattern"
-                    )
-                  end
-                end
-
-                context "param location matches the specified location" do
-                  it "should not log" do
-                    policy = PayloadsPolicy.from_json({
-                      "payloads" => {
-                        "log_payloads" => true,
-                        "log_blacklist" => {
-                          "password" => ["form"],
-                        }
+              context "param location matches the specified location" do
+                it "should not log" do
+                  policy = PayloadsPolicy.from_json({
+                    "payloads" => {
+                      "log_payloads" => true,
+                      "log_blacklist" => {
+                        "password" => ["form"],
                       }
-                    })
-                    configuration = double("configuration")
+                    }
+                  })
 
-                    expect(TCellAgent).to receive(:configuration).and_return(configuration)
-                    expect(configuration).to receive(:allow_unencrypted_appfirewall_payloads_logging).and_return(
-                      true
-                    )
-                    expect(TCellAgent).to_not receive(:appfirewall_payloads_logger)
+                  expect(TCellAgent).to_not receive(:configuration)
 
-                    policy.log(
-                      "xss",
-                      @meta,
-                      TCellAgent::Utils::Params::GET_PARAM,
-                      "password",
-                      "alert()",
-                      {"l" => "query"},
-                      "pattern"
-                    )
-                  end
+                  policy.log(
+                    "xss",
+                    @meta,
+                    TCellAgent::Utils::Params::GET_PARAM,
+                    "password",
+                    "alert()",
+                    {"l" => "query"},
+                    "pattern"
+                  )
                 end
               end
             end