tcell_agent 0.4.0 → 1.0.0

data/spec/lib/tcell_agent/rust/whisperer_spec.rb

@@ -1,266 +1,589 @@
-# encoding: utf-8
+
 require 'spec_helper'
 
 module TCellAgent
   module Rust
+    describe '.apply_cmdi' do
+      require 'tcell_agent/rust/whisperer'
 
-    describe ".parse_cmd" do
-      require "tcell_agent/rust/whisperer"
+      before(:each) do
+        whisper = Whisperer.create_agent
+        @agent_ptr = whisper['agent_ptr']
+        @report_command_rule_id = 'TJM4ODvkB2jSR47qltL+0Nyy/PGlF6Qa/cin65qtIlc='
+        @compound_rule_id = 'Y+IHN7BJDctqOIIZOb71NR8PkUxru01LDkqU1lZwogY='
+        policy = {
+          'result' => {
+            'cmdi' => {
+              'data' => {
+                'collect_full_commandline' => false,
+                'command_rules' => [
+                  {
+                    'action' => 'report',
+                    'rule_id' => @report_command_rule_id
+                  }
+                ],
+                'compound_statement_rules' => [
+                  {
+                    'action' => 'report',
+                    'rule_id' => @compound_rule_id
+                  }
+                ]
+              },
+              'policy_id' => '0cf0f090-ffc0-11e7-8080-808080808080',
+              'version' => 1
+            }
+          }
+        }
+
+        whisper = Whisperer.update_policies(@agent_ptr, policy)
+        expect(whisper['enablements']).to eq({
+                                               'appfirewall' => false,
+                                               'patches' => false,
+                                               'cmdi' => true
+                                             })
+      end
 
-      context "empty command" do
-        it "should return empty json object" do
-          result = Whisperer.parse_cmd(nil)
+      context 'empty command' do
+        it 'should return empty json object' do
+          result = Whisperer.apply_cmdi(@agent_ptr, nil)
           expect(result).to eq({})
-          result = Whisperer.parse_cmd("")
+          result = Whisperer.apply_cmdi(@agent_ptr, '')
           expect(result).to eq({})
-          result = Whisperer.parse_cmd("   ")
+          result = Whisperer.apply_cmdi(@agent_ptr, '   ')
           expect(result).to eq({})
         end
       end
 
-      context "single command" do
-        it "should return single command parsed" do
-          result = Whisperer.parse_cmd("ifconfig -a")
-          expect(result).to eq({"error"=>nil, "commands"=>[{"command"=>"ifconfig", "arg_count"=>1}]})
-          result = Whisperer.parse_cmd("ifconfig")
-          expect(result).to eq({"error"=>nil, "commands"=>[{"command"=>"ifconfig", "arg_count"=>0}]})
+      context 'single command' do
+        it 'should return single command parsed' do
+          result = Whisperer.apply_cmdi(@agent_ptr, 'ifconfig -a')
+          expect(result).to eq({
+                                 'apply_response' => {
+                                   'blocked' => false,
+                                   'commands' => [{ 'command' => 'ifconfig', 'arg_count' => 1 }],
+                                   'matches' => [{ 'rule_id' => @report_command_rule_id,
+                                                   'command' => 'ifconfig' }],
+                                   'full_commandline' => nil
+                                 }
+                               })
+          result = Whisperer.apply_cmdi(@agent_ptr, 'ifconfig')
+          expect(result).to eq({
+                                 'apply_response' => {
+                                   'blocked' => false,
+                                   'commands' => [{ 'command' => 'ifconfig', 'arg_count' => 0 }],
+                                   'matches' => [{ 'rule_id' => @report_command_rule_id,
+                                                   'command' => 'ifconfig' }],
+                                   'full_commandline' => nil
+                                 }
+                               })
         end
       end
 
-      context "with a compound command" do
-        it "should return parsed commands" do
-          commands = Whisperer.parse_cmd("cd /tcellagent_src && bundle --quiet && bundle exec rake compile && bundle exec rspec")
+      context 'with a compound command' do
+        it 'should return parsed commands' do
+          commands = Whisperer.apply_cmdi(
+            @agent_ptr,
+            'cd /tcellagent_src && bundle --quiet && bundle exec rake compile && bundle exec rspec'
+          )
           expect(commands).to eq({
-            "error"=>nil,
-            "commands"=>[
-              {"command"=>"cd", "arg_count"=>1},
-              {"command"=>"bundle", "arg_count"=>1},
-              {"command"=>"bundle", "arg_count"=>3},
-              {"command"=>"bundle", "arg_count"=>2}
-            ]
-          })
+                                   'apply_response' => {
+                                     'blocked' => false,
+                                     'commands' => [
+                                       { 'command' => 'cd', 'arg_count' => 1 },
+                                       { 'command' => 'bundle', 'arg_count' => 1 },
+                                       { 'command' => 'bundle', 'arg_count' => 3 },
+                                       { 'command' => 'bundle', 'arg_count' => 2 }
+                                     ],
+                                     'matches' => [{ 'rule_id' => @compound_rule_id, 'command' => nil },
+                                                   { 'rule_id' => @report_command_rule_id, 'command' => 'cd' },
+                                                   { 'rule_id' => @report_command_rule_id, 'command' => 'bundle' },
+                                                   { 'rule_id' => @report_command_rule_id, 'command' => 'bundle' },
+                                                   { 'rule_id' => @report_command_rule_id, 'command' => 'bundle' }],
+                                     'full_commandline' => nil
+                                   }
+                                 })
 
-          commands = Whisperer.parse_cmd("cd /tcellagent_src; bundle --quiet; bundle exec rake compile; bundle exec rspec")
+          commands = Whisperer.apply_cmdi(
+            @agent_ptr,
+            'cd /tcellagent_src; bundle --quiet; bundle exec rake compile; bundle exec rspec'
+          )
           expect(commands).to eq({
-            "error"=>nil,
-            "commands"=>[
-              {"command"=>"cd", "arg_count"=>1},
-              {"command"=>"bundle", "arg_count"=>1},
-              {"command"=>"bundle", "arg_count"=>3},
-              {"command"=>"bundle", "arg_count"=>2}
-            ]
-          })
+                                   'apply_response' => {
+                                     'blocked' => false,
+                                     'commands' => [
+                                       { 'command' => 'cd', 'arg_count' => 1 },
+                                       { 'command' => 'bundle', 'arg_count' => 1 },
+                                       { 'command' => 'bundle', 'arg_count' => 3 },
+                                       { 'command' => 'bundle', 'arg_count' => 2 }
+                                     ],
+                                     'matches' => [
+                                       { 'rule_id' => @compound_rule_id, 'command' => nil },
+                                       { 'rule_id' => @report_command_rule_id, 'command' => 'cd' },
+                                       { 'rule_id' => @report_command_rule_id, 'command' => 'bundle' },
+                                       { 'rule_id' => @report_command_rule_id, 'command' => 'bundle' },
+                                       { 'rule_id' => @report_command_rule_id, 'command' => 'bundle' }
+                                     ],
+                                     'full_commandline' => nil
+                                   }
+                                 })
 
-          commands = Whisperer.parse_cmd("cat /etc/passwd | grep root")
+          commands = Whisperer.apply_cmdi(
+            @agent_ptr,
+            'cat /etc/passwd | grep root'
+          )
           expect(commands).to eq({
-              "commands" => [
-                  {"arg_count" => 1, "command" => "cat"},
-                  {"arg_count" => 1, "command" => "grep"}
-              ], "error" => nil
-          })
+                                   'apply_response' => {
+                                     'blocked' => false,
+                                     'commands' => [
+                                       { 'command' => 'cat', 'arg_count' => 1 },
+                                       { 'command' => 'grep', 'arg_count' => 1 }
+                                     ],
+                                     'matches' => [
+                                       { 'rule_id' => @compound_rule_id, 'command' => nil },
+                                       { 'rule_id' => @report_command_rule_id, 'command' => 'cat' },
+                                       { 'rule_id' => @report_command_rule_id, 'command' => 'grep' }
+                                     ],
+                                     'full_commandline' => nil
+                                   }
+                                 })
         end
 
-        context "spawning multiple lines" do
-          it "should parse the commands" do
-            commands = Whisperer.parse_cmd(<<-eos
+        context 'spawning multiple lines' do
+          it 'should parse the commands' do
+            commands = Whisperer.apply_cmdi(
+              @agent_ptr,
+              <<-EOS
 echo 'first-line'; \
 cat /etc/passwd | grep root
-              eos
+              EOS
             )
             expect(commands).to eq({
-              "error"=>nil,
-              "commands"=>[
-                {"command"=>"echo", "arg_count"=>1},
-                {"command"=>"cat", "arg_count"=>1},
-                {"command"=>"grep", "arg_count"=>1}
-              ]
-            })
+                                     'apply_response' => {
+                                       'blocked' => false,
+                                       'commands' => [
+                                         { 'command' => 'echo', 'arg_count' => 1 },
+                                         { 'command' => 'cat', 'arg_count' => 1 },
+                                         { 'command' => 'grep', 'arg_count' => 1 }
+                                       ],
+                                       'matches' => [
+                                         { 'rule_id' => @compound_rule_id, 'command' => nil },
+                                         { 'rule_id' => @report_command_rule_id, 'command' => 'echo' },
+                                         { 'rule_id' => @report_command_rule_id, 'command' => 'cat' },
+                                         { 'rule_id' => @report_command_rule_id, 'command' => 'grep' }
+                                       ],
+                                       'full_commandline' => nil
+                                     }
+                                   })
 
-            commands = Whisperer.parse_cmd(<<-eos
+            commands = Whisperer.apply_cmdi(
+              @agent_ptr,
+              <<-EOS
 echo 'first-line' && \
 cat /etc/passwd | grep root
-              eos
+              EOS
             )
             expect(commands).to eq({
-              "error"=>nil,
-              "commands"=>[
-                {"command"=>"echo", "arg_count"=>1},
-                {"command"=>"cat", "arg_count"=>1},
-                {"command"=>"grep", "arg_count"=>1}
-              ]
-            })
+                                     'apply_response' => {
+                                       'blocked' => false,
+                                       'commands' => [
+                                         { 'command' => 'echo', 'arg_count' => 1 },
+                                         { 'command' => 'cat', 'arg_count' => 1 },
+                                         { 'command' => 'grep', 'arg_count' => 1 }
+                                       ],
+                                       'matches' => [
+                                         { 'rule_id' => @compound_rule_id, 'command' => nil },
+                                         { 'rule_id' => @report_command_rule_id, 'command' => 'echo' },
+                                         { 'rule_id' => @report_command_rule_id, 'command' => 'cat' },
+                                         { 'rule_id' => @report_command_rule_id, 'command' => 'grep' }
+                                       ],
+                                       'full_commandline' => nil
+                                     }
+                                   })
 
-            commands = Whisperer.parse_cmd(<<-eos
+            commands = Whisperer.apply_cmdi(
+              @agent_ptr,
+              <<-EOS
 cd /tcellagent_src; bundle --quiet; \
 bundle exec rake compile; \
 bundle exec rspec
-              eos
+              EOS
             )
             expect(commands).to eq({
-              "error"=>nil,
-              "commands"=>[
-                {"command"=>"cd", "arg_count"=>1},
-                {"command"=>"bundle", "arg_count"=>1},
-                {"command"=>"bundle", "arg_count"=>3},
-                {"command"=>"bundle", "arg_count"=>2}
-              ]
-            })
+                                     'apply_response' => {
+                                       'blocked' => false,
+                                       'commands' => [
+                                         { 'command' => 'cd', 'arg_count' => 1 },
+                                         { 'command' => 'bundle', 'arg_count' => 1 },
+                                         { 'command' => 'bundle', 'arg_count' => 3 },
+                                         { 'command' => 'bundle', 'arg_count' => 2 }
+                                       ],
+                                       'matches' => [
+                                         { 'rule_id' => @compound_rule_id, 'command' => nil },
+                                         { 'rule_id' => @report_command_rule_id, 'command' => 'cd' },
+                                         { 'rule_id' => @report_command_rule_id, 'command' => 'bundle' },
+                                         { 'rule_id' => @report_command_rule_id, 'command' => 'bundle' },
+                                         { 'rule_id' => @report_command_rule_id, 'command' => 'bundle' }
+                                       ],
+                                       'full_commandline' => nil
+                                     }
+                                   })
           end
         end
       end
 
-      context "with a complex command" do
-        it "should parse the commands" do
-          commands = Whisperer.parse_cmd(<<-eos
+      context 'with a complex command' do
+        it 'should parse the commands' do
+          commands = Whisperer.apply_cmdi(
+            @agent_ptr,
+            <<-EOS
 magick -size 320x85 canvas:none -font Bookman-DemiItalic -pointsize 72 \\
 -draw "text 25,60 \'Magick\'" -channel RGBA -blur 0x6 -fill darkred -stroke magenta \\
 -draw "text 20,55 \'Magick\'" fuzzy-magick.png
-            eos
+            EOS
           )
           expect(commands).to eq({
-            "error"=>nil,
-            "commands"=>[
-              {"command"=>"magick", "arg_count"=>24}
-            ]
-          })
+                                   'apply_response' => {
+                                     'blocked' => false,
+                                     'commands' => [{ 'command' => 'magick', 'arg_count' => 24 }],
+                                     'matches' => [{ 'rule_id' => @report_command_rule_id, 'command' => 'magick' }],
+                                     'full_commandline' => nil
+                                   }
+                                 })
 
-          commands = Whisperer.parse_cmd("/usr/local/bin/ruby -eputs 'Hello World!' > /dev/null 2>&1")
+          commands = Whisperer.apply_cmdi(
+            @agent_ptr,
+            "/usr/local/bin/ruby -eputs 'Hello World!' > /dev/null 2>&1"
+          )
           expect(commands).to eq({
-              "commands" => [
-                  {"command" => "ruby", "arg_count" => 6 }
-              ], "error" => nil
-          })
+                                   'apply_response' => {
+                                     'blocked' => false,
+                                     'commands' => [{ 'command' => 'ruby', 'arg_count' => 6 }],
+                                     'matches' => [{ 'rule_id' => @report_command_rule_id, 'command' => 'ruby' }],
+                                     'full_commandline' => nil
+                                   }
+                                 })
         end
       end
 
-      context "with special characters in the command" do
-        it "should parse the commands" do
-          commands = Whisperer.parse_cmd("echo 'bréak' && cat /etc/passwd && grep root")
+      context 'with special characters in the command' do
+        it 'should parse the commands' do
+          commands = Whisperer.apply_cmdi(
+            @agent_ptr,
+            "echo 'bréak' && cat /etc/passwd && grep root"
+          )
           expect(commands).to eq({
-            "error"=>nil,
-            "commands"=>[
-              {"command"=>"echo", "arg_count"=>1},
-              {"command"=>"cat", "arg_count"=>1},
-              {"command"=>"grep", "arg_count"=>1}
-            ]
-          })
+                                   'apply_response' => {
+                                     'blocked' => false,
+                                     'commands' => [
+                                       { 'command' => 'echo', 'arg_count' => 1 },
+                                       { 'command' => 'cat', 'arg_count' => 1 },
+                                       { 'command' => 'grep', 'arg_count' => 1 }
+                                     ],
+                                     'matches' => [
+                                       { 'rule_id' => @compound_rule_id, 'command' => nil },
+                                       { 'rule_id' => @report_command_rule_id, 'command' => 'echo' },
+                                       { 'rule_id' => @report_command_rule_id, 'command' => 'cat' },
+                                       { 'rule_id' => @report_command_rule_id, 'command' => 'grep' }
+                                     ],
+                                     'full_commandline' => nil
+                                   }
+                                 })
         end
       end
 
-      context "with null terminator character in the command" do
-        it "should parse the commands" do
-          commands = Whisperer.parse_cmd("echo 'br\0ak' && cat /etc/passwd && grep root")
+      context 'with null terminator character in the command' do
+        it 'should parse the commands' do
+          commands = Whisperer.apply_cmdi(
+            @agent_ptr,
+            "echo 'br\0ak' && cat /etc/passwd && grep root"
+          )
           expect(commands).to eq({
-            "error"=>nil,
-            "commands"=>[
-              {"command"=>"echo", "arg_count"=>1},
-              {"command"=>"cat", "arg_count"=>1},
-              {"command"=>"grep", "arg_count"=>1}
-            ]
-          })
+                                   'apply_response' => {
+                                     'blocked' => false,
+                                     'commands' => [
+                                       { 'command' => 'echo', 'arg_count' => 1 },
+                                       { 'command' => 'cat', 'arg_count' => 1 },
+                                       { 'command' => 'grep', 'arg_count' => 1 }
+                                     ],
+                                     'matches' => [
+                                       { 'rule_id' => @compound_rule_id, 'command' => nil },
+                                       { 'rule_id' => @report_command_rule_id, 'command' => 'echo' },
+                                       { 'rule_id' => @report_command_rule_id, 'command' => 'cat' },
+                                       { 'rule_id' => @report_command_rule_id, 'command' => 'grep' }
+                                     ],
+                                     'full_commandline' => nil
+                                   }
+                                 })
         end
       end
 
-      context "with an sh command" do
-        it "should parse the commands" do
-          commands = Whisperer.parse_cmd("sh -c \"bundle install && rake db:setup db:migrate\"")
-          expect(commands).to eq({
-            "error"=>nil,
-            "commands"=>[
-              {"command"=>"sh", "arg_count"=>2},
-              {"command"=>"bundle", "arg_count"=>1},
-              {"command"=>"rake", "arg_count"=>2}
-            ]
-          })
+      context 'with an sh command' do
+        it 'should parse the commands' do
+          commands = Whisperer.apply_cmdi(
+            @agent_ptr,
+            'sh -c "bundle install && rake db:setup db:migrate"'
+          )
+          expect(commands).to eq(
+            {
+              'apply_response' => {
+                'blocked' => false,
+                'commands' => [
+                  { 'command' => 'sh', 'arg_count' => 2 },
+                  { 'command' => 'bundle', 'arg_count' => 1 },
+                  { 'command' => 'rake', 'arg_count' => 2 }
+                ],
+                'matches' => [
+                  { 'rule_id' => @compound_rule_id, 'command' => nil },
+                  { 'rule_id' => @report_command_rule_id, 'command' => 'sh' },
+                  { 'rule_id' => @report_command_rule_id, 'command' => 'bundle' },
+                  { 'rule_id' => @report_command_rule_id, 'command' => 'rake' }
+                ],
+                'full_commandline' => nil
+              }
+            }
+          )
         end
       end
 
-      context "with an /bin/sh command" do
-        it "should parse the commands" do
-          commands = Whisperer.parse_cmd("/bin/sh -c \"bundle install && rake db:setup db:migrate\"")
-          expect(commands).to eq({
-            "error"=>nil,
-            "commands"=>[
-              {"command"=>"sh", "arg_count"=>2},
-              {"command"=>"bundle", "arg_count"=>1},
-              {"command"=>"rake", "arg_count"=>2}
-            ]
-          })
+      context 'with an /bin/sh command' do
+        it 'should parse the commands' do
+          commands = Whisperer.apply_cmdi(
+            @agent_ptr,
+            '/bin/sh -c "bundle install && rake db:setup db:migrate"'
+          )
+          expect(commands).to eq(
+            {
+              'apply_response' => {
+                'blocked' => false,
+                'commands' => [
+                  { 'command' => 'sh', 'arg_count' => 2 },
+                  { 'command' => 'bundle', 'arg_count' => 1 },
+                  { 'command' => 'rake', 'arg_count' => 2 }
+                ],
+                'matches' => [
+                  { 'rule_id' => @compound_rule_id, 'command' => nil },
+                  { 'rule_id' => @report_command_rule_id, 'command' => 'sh' },
+                  { 'rule_id' => @report_command_rule_id, 'command' => 'bundle' },
+                  { 'rule_id' => @report_command_rule_id, 'command' => 'rake' }
+                ],
+                'full_commandline' => nil
+              }
+            }
+          )
         end
       end
     end
 
-    describe ".convert_result" do
-      it "should catch and log json parse errors" do
-        logger = double("logger")
+    describe '.convert_result' do
+      it 'should log bad responses from native library' do
+        logger = double('logger')
         expect(TCellAgent).to receive(:logger).and_return(logger)
-        expect(logger).to receive(:error).with("JSON::ParserError ocurred when trying to parse native lib response")
+        expect(logger).to receive(:error).with(
+          'Error response from `create_agent` in native library: -1'
+        )
 
-        result = FFI::MemoryPointer.from_string("{malformed_json}")
-        whisper = Whisperer.convert_result(result.size, result)
+        result = FFI::MemoryPointer.from_string('')
+        expect(Whisperer.convert_result('create_agent', -1, result)).to eq({})
+      end
+
+      it 'should catch and log json parse errors' do
+        logger = double('logger')
+        expect(TCellAgent).to receive(:logger).and_return(logger)
+        expect(logger).to receive(:error).with(
+          'Could not parse json response from `create_agent` in native library.'
+        )
+
+        result = FFI::MemoryPointer.from_string('{malformed_json}')
+        whisper = Whisperer.convert_result('create_agent', result.size, result)
         expect(whisper).to eq({})
       end
 
-      it "should parse json properly" do
-        result = FFI::MemoryPointer.from_string({'valid' => 'json'}.to_json)
-        whisper = Whisperer.convert_result(result.size, result)
-        expect(whisper).to eq({"valid" => "json"})
+      it 'should parse json properly' do
+        result = FFI::MemoryPointer.from_string({ 'valid' => 'json' }.to_json)
+        whisper = Whisperer.convert_result('create_agent', result.size, result)
+        expect(whisper).to eq({ 'valid' => 'json' })
       end
     end
 
-    describe ".appfirewall" do
-      it "returns an xss injection with an enabled xss sensor" do
+    describe '.apply_appfirewall and .apply_patches' do
+      before(:each) do
+        whisper = Whisperer.create_agent
+        @agent_ptr = whisper['agent_ptr']
         policy = {
-          "policy_id" => "policy_id",
-          "version" => 1,
-          "data" => {
-            "sensors" => {
-              "xss" => {
-                "patterns" => ["1", "2", "4", "5", "6", "7", "8"]
+          'result' => {
+            'regex' => {
+              'data' => {
+                'patterns' => [
+                  {
+                    'id' => 'tc-xss-1',
+                    'pattern' => '(?:<(script|iframe|embed|frame|frameset|object|img|applet|body|html|style|layer|link|ilayer|meta|bgsound))',
+                    'sensor' => 'xss',
+                    'title' => 'Basic Injection'
+                  }
+                ],
+                'version' => 1_518_546_622_571
+              },
+              'policy_id' => 'f3a313b0-10eb-11e8-8080-808080808080',
+              'version' => 1
+            },
+
+            'appsensor' => {
+              'policy_id' => 'f39d6e60-10eb-11e8-8080-808080808080',
+              'version' => 2,
+              'data' => {
+                'sensors' => {
+                  'ignore_rules' => [],
+                  'errors' => {
+                    'csrf_exception_enabled' => true,
+                    'sql_exception_enabled' => true
+                  },
+                  'xss' => {
+                    'dynamic_patterns' => ['tc-xss-1'],
+                    'patterns' => ['1']
+                  }
+                }
               }
+            },
+
+            'patches' => {
+              'data' => {
+                'block_rules' => [],
+                'blocked_ips' => [],
+                'rules' => [
+                  {
+                    'action' => 'BlockIf',
+                    'destinations' => { 'check_equals' => [{ 'path' => '*' }] },
+                    'id' => 'check-absent-rule',
+                    'ignore' => [],
+                    'matches' => [
+                      {
+                        'all' => [
+                          {
+                            'parameters' => {
+                              'check_present' => {
+                                'queries' => [
+                                  'xss_param'
+                                ]
+                              }
+                            }
+                          }
+                        ],
+                        'any' => []
+                      }
+                    ],
+                    'title' => 'check absent rule'
+                  }
+                ]
+              },
+              'policy_id' => 'patches-v1-14',
+              'version' => 2
             }
           }
         }
 
-        whisper = Whisperer.init_appfirewall(policy, true)
-
-        expect(whisper["error"]).to be_nil
-        expect(whisper["enabled"]).to eq(true)
-        expect(whisper["policy_ptr"]).to_not be_nil
+        whisper = Whisperer.update_policies(@agent_ptr, policy)
+        expect(whisper['enablements']).to eq(
+          {
+            'appfirewall' => true,
+            'patches' => true,
+            'cmdi' => false
+          }
+        )
+      end
 
-        appfirewall_ptr = whisper["policy_ptr"]
+      it 'should return appfirewall injections' do
+        appsensor_meta = TCellAgent::SensorEvents::AppSensorMetaEvent.new(
+          'GET',
+          '192.168.1.1',
+          '12345',
+          'session_id',
+          'user_id',
+          'transaction_id',
+          'http://192.168.1.1/some/path?xss_param=<script>'
+        )
+        appsensor_meta.path = '/some/path'
+        appsensor_meta.request_content_bytes_len = 1024
+        appsensor_meta.response_content_bytes_len = 2048
+        appsensor_meta.get_dict = { 'xss_param' => '<script>' }
+        appsensor_meta.user_agent = 'Mozilla'
+        appsensor_meta.sql_exceptions = [
+          {
+            'exception_name' => 'OperationalError',
+            'exception_payload' => 'Developer Error'
+          }
+        ]
+        appsensor_meta.csrf_exception_name = 'ActionController::InvalidAuthenticityToken'
 
         whisper = Whisperer.apply_appfirewall(
-            appfirewall_ptr,
-            {
-              "method" => "GET",
-              "route_id" => "12345",
-              "path" => "/some/path",
-              "query_params" => [{"name" => "xss_param", "value" => "<script>"}],
-              "post_params" => [],
-              "headers" => [],
-              "cookies" => [],
-              "remote_address" => "192.1681.1.1",
-              "full_uri" => "http://192.168.1.1:8080/some/path?xss_param=<script>",
-              "session_id" => "session_id",
-              "status_code" => 200
-            })
-
-        expect(whisper).to eq({
-          "apply_response" => [{
-            "detection_point"=>"xss",
-            "method"=>"GET",
-            "parameter"=>"xss_param",
-            "uri"=>"http://192.168.1.1:8080/some/path?xss_param=",
-            "remote_address"=>"192.1681.1.1",
-            "route_id"=>"12345",
-            "session_id"=>"session_id",
-            "pattern"=>"1",
-            "meta"=>{"l"=>"query"}
-          }]
-        })
+          @agent_ptr,
+          appsensor_meta
+        )
+        expect(whisper).to eq(
+          {
+            'apply_response' => [
+              {
+                'detection_point' => 'xss',
+                'method' => 'GET',
+                'parameter' => 'xss_param',
+                'uri' => 'http://192.168.1.1/some/path?xss_param=',
+                'remote_address' => '192.168.1.1',
+                'route_id' => '12345',
+                'session_id' => 'session_id',
+                'user_id' => 'user_id',
+                'pattern' => 'tc-xss-1',
+                'meta' => { 'l' => 'query' }
+              },
+              {
+                'detection_point' => 'exsql',
+                'method' => 'GET',
+                'parameter' => 'OperationalError',
+                'uri' => 'http://192.168.1.1/some/path?xss_param=',
+                'remote_address' => '192.168.1.1',
+                'route_id' => '12345',
+                'session_id' => 'session_id',
+                'user_id' => 'user_id'
+              },
+              {
+                'detection_point' => 'excsrf',
+                'method' => 'GET',
+                'parameter' => 'ActionController::InvalidAuthenticityToken',
+                'uri' => 'http://192.168.1.1/some/path?xss_param=',
+                'remote_address' => '192.168.1.1',
+                'route_id' => '12345',
+                'session_id' => 'session_id',
+                'user_id' => 'user_id'
+              }
+            ]
+          }
+        )
+      end
 
-        Whisperer.free_appfirewall(appfirewall_ptr)
+      it 'should return patches blocking' do
+        appsensor_meta = TCellAgent::Patches::MetaData.new(
+          'GET',
+          '192.168.1.1',
+          '12345',
+          'session_id',
+          'user_id',
+          'transaction_id',
+          'http://192.168.1.1/some/path?xss_param=<script>'
+        )
+        appsensor_meta.path = '/some/path'
+        appsensor_meta.request_content_bytes_len = 1024
+        appsensor_meta.get_dict = { 'xss_param' => '<script>' }
+        whisper = Whisperer.apply_patches(
+          @agent_ptr,
+          appsensor_meta
+        )
+        expect(whisper).to eq(
+          {
+            'apply_response' => {
+              'status' => 'Blocked',
+              'patches_policy_id' => 'patches-v1-14',
+              'rule_id' => 'check-absent-rule'
+            }
+          }
+        )
       end
     end
   end