tcell_agent 0.4.0 → 1.0.0

data/spec/lib/tcell_agent/policies/appsensor/xss_sensor_spec.rb

@@ -1,882 +0,0 @@
-# encoding: utf-8
-
-require 'spec_helper'
-
-module TCellAgent
-  module Policies
-
-    describe XssSensor do
-      describe "#initialize" do
-        context "default sensor" do
-          it "should have properties set to defaults" do
-            sensor = XssSensor.new
-            expect(sensor.enabled).to eq(false)
-            expect(sensor.libinjection).to eq(false)
-            expect(sensor.detection_point).to eq("xss")
-            expect(sensor.exclude_headers).to eq(false)
-            expect(sensor.exclude_forms).to eq(false)
-            expect(sensor.exclude_cookies).to eq(false)
-            expect(sensor.exclusions).to eq({})
-            expect(sensor.active_pattern_ids).to eq(Set.new)
-            expect(sensor.v1_compatability_enabled).to eq(false)
-          end
-        end
-
-        context "setting enabled on sensor" do
-          it "should be enabled" do
-            sensor = XssSensor.new({"enabled" => true})
-            expect(sensor.enabled).to eq(true)
-            expect(sensor.libinjection).to eq(false)
-            expect(sensor.detection_point).to eq("xss")
-            expect(sensor.exclude_headers).to eq(false)
-            expect(sensor.exclude_forms).to eq(false)
-            expect(sensor.exclude_cookies).to eq(false)
-            expect(sensor.exclusions).to eq({})
-            expect(sensor.active_pattern_ids).to eq(Set.new)
-            expect(sensor.v1_compatability_enabled).to eq(false)
-          end
-        end
-
-        context "setting libinjection on sensor" do
-          it "should have libinjection" do
-            sensor = XssSensor.new({"libinjection" => true})
-            expect(sensor.enabled).to eq(false)
-            expect(sensor.libinjection).to eq(true)
-            expect(sensor.detection_point).to eq("xss")
-            expect(sensor.exclude_headers).to eq(false)
-            expect(sensor.exclude_forms).to eq(false)
-            expect(sensor.exclude_cookies).to eq(false)
-            expect(sensor.exclusions).to eq({})
-            expect(sensor.active_pattern_ids).to eq(Set.new)
-            expect(sensor.v1_compatability_enabled).to eq(false)
-          end
-        end
-
-        context "setting exclude_headers on sensor" do
-          it "should have exclude_headers" do
-            sensor = XssSensor.new({"exclude_headers" => true})
-            expect(sensor.enabled).to eq(false)
-            expect(sensor.libinjection).to eq(false)
-            expect(sensor.detection_point).to eq("xss")
-            expect(sensor.exclude_headers).to eq(true)
-            expect(sensor.exclude_forms).to eq(false)
-            expect(sensor.exclude_cookies).to eq(false)
-            expect(sensor.exclusions).to eq({})
-            expect(sensor.active_pattern_ids).to eq(Set.new)
-            expect(sensor.v1_compatability_enabled).to eq(false)
-          end
-        end
-
-        context "setting exclude_forms on sensor" do
-          it "should have exclude_forms" do
-            sensor = XssSensor.new({"exclude_forms" => true})
-            expect(sensor.enabled).to eq(false)
-            expect(sensor.libinjection).to eq(false)
-            expect(sensor.detection_point).to eq("xss")
-            expect(sensor.exclude_headers).to eq(false)
-            expect(sensor.exclude_forms).to eq(true)
-            expect(sensor.exclude_cookies).to eq(false)
-            expect(sensor.exclusions).to eq({})
-            expect(sensor.active_pattern_ids).to eq(Set.new)
-            expect(sensor.v1_compatability_enabled).to eq(false)
-          end
-        end
-
-        context "setting exclude_cookies on sensor" do
-          it "should have exclude_cookies" do
-            sensor = XssSensor.new({"exclude_cookies" => true})
-            expect(sensor.enabled).to eq(false)
-            expect(sensor.libinjection).to eq(false)
-            expect(sensor.detection_point).to eq("xss")
-            expect(sensor.exclude_headers).to eq(false)
-            expect(sensor.exclude_forms).to eq(false)
-            expect(sensor.exclude_cookies).to eq(true)
-            expect(sensor.exclusions).to eq({})
-            expect(sensor.active_pattern_ids).to eq(Set.new)
-            expect(sensor.v1_compatability_enabled).to eq(false)
-          end
-        end
-
-        context "setting exclusions on sensor" do
-          it "should have exclude_cookies" do
-            sensor = XssSensor.new({"exclusions" => {"word" => ["form", "header"]}})
-            expect(sensor.enabled).to eq(false)
-            expect(sensor.libinjection).to eq(false)
-            expect(sensor.detection_point).to eq("xss")
-            expect(sensor.exclude_headers).to eq(false)
-            expect(sensor.exclude_forms).to eq(false)
-            expect(sensor.exclude_cookies).to eq(false)
-            expect(sensor.exclusions).to eq(
-              {"word"=>Set.new(["form", "header"])}
-            )
-            expect(sensor.active_pattern_ids).to eq(Set.new)
-            expect(sensor.v1_compatability_enabled).to eq(false)
-          end
-        end
-
-        context "setting active_pattern_ids on sensor" do
-          it "should have active_pattern_ids" do
-            sensor = XssSensor.new({"patterns" => ["1", "2", "3"]})
-            expect(sensor.enabled).to eq(false)
-            expect(sensor.libinjection).to eq(false)
-            expect(sensor.detection_point).to eq("xss")
-            expect(sensor.exclude_headers).to eq(false)
-            expect(sensor.exclude_forms).to eq(false)
-            expect(sensor.exclude_cookies).to eq(false)
-            expect(sensor.exclusions).to eq({})
-            expect(sensor.active_pattern_ids).to eq(
-              Set.new(["1", "2", "3"])
-            )
-            expect(sensor.v1_compatability_enabled).to eq(false)
-          end
-        end
-
-        context "setting v1_compatability_enabled on sensor" do
-          it "should have v1_compatability_enabled" do
-            sensor = XssSensor.new({"v1_compatability_enabled" => true})
-            expect(sensor.enabled).to eq(false)
-            expect(sensor.libinjection).to eq(false)
-            expect(sensor.detection_point).to eq("xss")
-            expect(sensor.exclude_headers).to eq(false)
-            expect(sensor.exclude_forms).to eq(false)
-            expect(sensor.exclude_cookies).to eq(false)
-            expect(sensor.exclusions).to eq({})
-            expect(sensor.active_pattern_ids).to eq(Set.new)
-            expect(sensor.v1_compatability_enabled).to eq(true)
-          end
-        end
-
-        context "setting excluded_route_ids on sensor" do
-          it "should have excluded_route_ids" do
-            sensor = XssSensor.new({"exclude_routes" => ["excluded_route_id"]})
-            expect(sensor.enabled).to eq(false)
-            expect(sensor.libinjection).to eq(false)
-            expect(sensor.detection_point).to eq("xss")
-            expect(sensor.exclude_headers).to eq(false)
-            expect(sensor.exclude_forms).to eq(false)
-            expect(sensor.exclude_cookies).to eq(false)
-            expect(sensor.exclusions).to eq({})
-            expect(sensor.active_pattern_ids).to eq(Set.new)
-            expect(sensor.v1_compatability_enabled).to eq(false)
-            expect(sensor.excluded_route_ids).to eq(Set.new(["excluded_route_id"]))
-          end
-        end
-      end
-
-      describe "#find_vulnerability" do
-        before(:each) do
-          @sensor = XssSensor.new({"enabled" => true})
-        end
-
-        context "with libinjection enabled" do
-          context "with param value that doesn't match any vulnerabilities" do
-            it "should return nil" do
-              @sensor.libinjection = true
-
-              ruleset = double("ruleset")
-              expect(@sensor).to receive(:get_ruleset).and_return(ruleset)
-              expect(ruleset).to receive(:check_violation).with(
-                "param", "value", Set.new, false
-              ).and_return(nil)
-
-              expect(@sensor.find_vulnerability("param", "value")).to eq(nil)
-            end
-
-            context "and it has utf-8 chars" do
-              it "should return nil but not fail miserably" do
-                @sensor.libinjection = true
-
-                ruleset = double("ruleset")
-                expect(@sensor).to receive(:get_ruleset).and_return(ruleset)
-                expect(ruleset).to receive(:check_violation).with(
-                  "param", "Müller", Set.new, false
-                ).and_return(nil)
-
-                expect(@sensor.find_vulnerability("param", "Müller")).to eq(nil)
-              end
-            end
-          end
-
-          context "with param value that matches a vulnerability" do
-            it "should return the param and it's value" do
-              @sensor.libinjection = true
-
-              expect(@sensor).to_not receive(:get_ruleset)
-
-              expect(@sensor.find_vulnerability("param_name", "<script>")).to eq(
-                {"param"=>"param_name", "value"=>"<script>", "pattern"=>"li"}
-              )
-            end
-          end
-        end
-
-        context "with no ruleset" do
-          it "should return nil" do
-            expect(@sensor).to receive(:get_ruleset).and_return(nil)
-
-            expect(@sensor.find_vulnerability("param", "value")).to eq(nil)
-          end
-        end
-
-        context "with ruletset" do
-          context "with param value that doesn't match any vulnerabilities" do
-            it "should return nil" do
-              ruleset = double("ruleset")
-              expect(@sensor).to receive(:get_ruleset).and_return(ruleset)
-              expect(ruleset).to receive(:check_violation).with(
-                "param", "value", Set.new, false
-              ).and_return(nil)
-
-              expect(@sensor.find_vulnerability("param", "value")).to eq(nil)
-            end
-          end
-
-          context "with param value that matches a vulnerability" do
-            it "should return the param and it's value" do
-              ruleset = double("ruleset")
-              expect(@sensor).to receive(:get_ruleset).and_return(ruleset)
-              expect(ruleset).to receive(:check_violation).with(
-                "param", "value", Set.new, false
-              ).and_return(true)
-
-              expect(@sensor.find_vulnerability("param", "value")).to eq(true)
-            end
-          end
-        end
-      end
-
-      describe "#get_injection_attempt" do
-        before(:each) do
-          @appsensor_meta = TCellAgent::SensorEvents::AppSensorMetaEvent.new(
-            "get",
-            "remote_address",
-            "route_id",
-            "session_id",
-            "user_id",
-            "transaction_id")
-        end
-
-        context "enabled sensor" do
-          context "param has NO vulnerability" do
-            it "should return false" do
-              sensor = XssSensor.new({"enabled" => true})
-              result = sensor.get_injection_attempt(
-                XssSensor::GET_PARAM,
-                @appsensor_meta,
-                "param_name",
-                "param_value"
-              )
-
-              expect(result).to eq(false)
-            end
-
-            context "no excluded routes" do
-              it "should return false" do
-                sensor = XssSensor.new({"enabled" => true, "exclude_routes" => []})
-                result = sensor.get_injection_attempt(
-                  XssSensor::GET_PARAM,
-                  @appsensor_meta,
-                  "param_name",
-                  "param_value"
-                )
-
-                expect(result).to eq(false)
-              end
-            end
-
-            context "has excluded routes" do
-              context "route id matches" do
-                it "should return false" do
-                  sensor = XssSensor.new({"enabled" => true, "exclude_routes" => ["route_id"]})
-                  result = sensor.get_injection_attempt(
-                    XssSensor::GET_PARAM,
-                    @appsensor_meta,
-                    "param_name",
-                    "param_value"
-                  )
-
-                  expect(result).to eq(false)
-                end
-              end
-              context "route id does not match" do
-                it "should return false" do
-                  sensor = XssSensor.new({"enabled" => true, "exclude_routes" => ["unmatching_route_id"]})
-                  result = sensor.get_injection_attempt(
-                    XssSensor::GET_PARAM,
-                    @appsensor_meta,
-                    "param_name",
-                    "param_value"
-                  )
-
-                  expect(result).to eq(false)
-                end
-              end
-            end
-          end
-
-          context "param has a vulnerability" do
-            context "param is a URI param" do
-              context "exclude forms sensor" do
-               it "should return false" do
-                  sensor = XssSensor.new({"enabled" => true, "exclude_forms" => true})
-
-                  expect(sensor).to_not receive(:find_vulnerability)
-
-                  result = sensor.get_injection_attempt(
-                    XssSensor::URI_PARAM,
-                    @appsensor_meta,
-                    "param_name",
-                    "param_value"
-                  )
-
-                  expect(result).to eq(false)
-                end
-              end
-
-              context "exclude cookies sensor" do
-                it "should return the injection attempt" do
-                  sensor = XssSensor.new({"enabled" => true, "exclude_cookies" => true})
-
-                  expect(sensor).to receive(:find_vulnerability).and_return(
-                    {"param" => "vuln_param", "value" => "vuln_value", "pattern" => "1"}
-                  )
-
-                  result = sensor.get_injection_attempt(
-                    XssSensor::URI_PARAM,
-                    @appsensor_meta,
-                    "param_name",
-                    "param_value"
-                  )
-
-                  expect(result.type_of_param).to eq(XssSensor::URI_PARAM)
-                  expect(result.detection_point).to eq(sensor.detection_point)
-                  expect(result.param_name).to eq("vuln_param")
-                  expect(result.param_value).to eq("vuln_value")
-                  expect(result.pattern).to eq("1")
-                end
-              end
-            end
-
-            context "param is a GET param" do
-              context "exclude forms sensor" do
-                it "should return false" do
-                  sensor = XssSensor.new({"enabled" => true, "exclude_forms" => true})
-
-                  expect(sensor).to_not receive(:find_vulnerability)
-
-                  result = sensor.get_injection_attempt(
-                    XssSensor::GET_PARAM,
-                    @appsensor_meta,
-                    "param_name",
-                    "param_value"
-                  )
-
-                  expect(result).to eq(false)
-                end
-
-                context "no excluded routes" do
-                  it "should return false" do
-                    sensor = XssSensor.new({"enabled" => true, "exclude_forms" => true, "exclude_routes" => []})
-
-                    expect(sensor).to_not receive(:find_vulnerability)
-
-                    result = sensor.get_injection_attempt(
-                      XssSensor::GET_PARAM,
-                      @appsensor_meta,
-                      "param_name",
-                      "param_value"
-                    )
-
-                    expect(result).to eq(false)
-                  end
-                end
-
-                context "has excluded routes" do
-                  context "route id matches" do
-                    it "should return false" do
-                      sensor = XssSensor.new({
-                        "enabled" => true,
-                        "exclude_forms" => true,
-                        "exclude_routes" => ["route_id"]
-                      })
-
-                      expect(sensor).to_not receive(:find_vulnerability)
-
-                      result = sensor.get_injection_attempt(
-                        XssSensor::GET_PARAM,
-                        @appsensor_meta,
-                        "param_name",
-                        "param_value"
-                      )
-
-                      expect(result).to eq(false)
-                    end
-                  end
-
-                  context "route id does not match" do
-                    it "should return false" do
-                      sensor = XssSensor.new({
-                        "enabled" => true,
-                        "exclude_forms" => true,
-                        "exclude_routes" => ["unmatching_route_id"]
-                      })
-
-                      expect(sensor).to_not receive(:find_vulnerability)
-
-                      result = sensor.get_injection_attempt(
-                        XssSensor::GET_PARAM,
-                        @appsensor_meta,
-                        "param_name",
-                        "param_value"
-                      )
-
-                      expect(result).to eq(false)
-                    end
-                  end
-                end
-              end
-
-              context "exclude cookies sensor" do
-                it "should return true" do
-                  sensor = XssSensor.new({
-                    "enabled" => true,
-                    "exclude_cookies" => true,
-                  })
-
-                  expect(sensor).to receive(:find_vulnerability).and_return(
-                    {"param" => "vuln_param", "value" => "vuln_value", "pattern" => "1"}
-                  )
-
-                  result = sensor.get_injection_attempt(
-                    XssSensor::GET_PARAM,
-                    @appsensor_meta,
-                    "param_name",
-                    "param_value",
-                  )
-
-                  expect(result.type_of_param).to eq(XssSensor::GET_PARAM)
-                  expect(result.detection_point).to eq(sensor.detection_point)
-                  expect(result.param_name).to eq("vuln_param")
-                  expect(result.param_value).to eq("vuln_value")
-                  expect(result.pattern).to eq("1")
-                end
-
-                context "no excluded routes" do
-                  it "should return true" do
-                    sensor = XssSensor.new({
-                      "enabled" => true,
-                      "exclude_cookies" => true,
-                      "exclude_routes" => []
-                    })
-
-                    expect(sensor).to receive(:find_vulnerability).and_return(
-                      {"param" => "vuln_param", "value" => "vuln_value", "pattern" => "1"}
-                    )
-
-                    result = sensor.get_injection_attempt(
-                      XssSensor::GET_PARAM,
-                      @appsensor_meta,
-                      "param_name",
-                      "param_value"
-                    )
-
-                    expect(result.type_of_param).to eq(XssSensor::GET_PARAM)
-                    expect(result.detection_point).to eq(sensor.detection_point)
-                    expect(result.param_name).to eq("vuln_param")
-                    expect(result.param_value).to eq("vuln_value")
-                    expect(result.pattern).to eq("1")
-                  end
-                end
-
-                context "has excluded routes" do
-                  context "route id matches" do
-                    it "should return false" do
-                      sensor = XssSensor.new({
-                        "enabled" => true,
-                        "exclude_cookies" => true,
-                        "exclude_routes" => ["route_id"]
-                      })
-
-                      expect(sensor).to_not receive(:find_vulnerability)
-
-                      result = sensor.get_injection_attempt(
-                        XssSensor::GET_PARAM,
-                        @appsensor_meta,
-                        "param_name",
-                        "param_value"
-                      )
-
-                      expect(result).to eq(false)
-                    end
-                  end
-
-                  context "route id does not match" do
-                    it "should return true" do
-                      sensor = XssSensor.new({
-                        "enabled" => true,
-                        "exclude_cookies" => true,
-                        "exclude_routes" => ["unmatching_route_id"]
-                      })
-
-                      expect(sensor).to receive(:find_vulnerability).and_return(
-                        {"param" => "vuln_param", "value" => "vuln_value", "pattern" => "1"}
-                      )
-
-                      result = sensor.get_injection_attempt(
-                        XssSensor::GET_PARAM,
-                        @appsensor_meta,
-                        "param_name",
-                        "param_value"
-                      )
-
-                      expect(result.type_of_param).to eq(XssSensor::GET_PARAM)
-                      expect(result.detection_point).to eq(sensor.detection_point)
-                      expect(result.param_name).to eq("vuln_param")
-                      expect(result.param_value).to eq("vuln_value")
-                      expect(result.pattern).to eq("1")
-                    end
-                  end
-                end
-              end
-
-              context "exclude headers sensor" do
-                it "should return true" do
-                  sensor = XssSensor.new({
-                    "enabled" => true,
-                    "exclude_headers" => true,
-                  })
-
-                  expect(sensor).to receive(:find_vulnerability).and_return(
-                    {"param" => "vuln_param", "value" => "vuln_value", "pattern" => "1"}
-                  )
-
-                  result = sensor.get_injection_attempt(
-                    XssSensor::GET_PARAM,
-                    @appsensor_meta,
-                    "param_name",
-                    "param_value",
-                  )
-
-                  expect(result.type_of_param).to eq(XssSensor::GET_PARAM)
-                  expect(result.detection_point).to eq(sensor.detection_point)
-                  expect(result.param_name).to eq("vuln_param")
-                  expect(result.param_value).to eq("vuln_value")
-                  expect(result.pattern).to eq("1")
-                end
-              end
-            end
-
-            context "param is a POST param" do
-              context "exclude forms sensor" do
-                it "should return false" do
-                  sensor = XssSensor.new({
-                    "enabled" => true,
-                    "exclude_forms" => true
-                  })
-
-                  expect(sensor).to_not receive(:find_vulnerability)
-
-                  result = sensor.get_injection_attempt(
-                    XssSensor::POST_PARAM,
-                    @appsensor_meta,
-                    "param_name",
-                    "param_value",
-                  )
-
-                  expect(result).to eq(false)
-                end
-              end
-
-              context "exclude cookies sensor" do
-                it "should return true" do
-                  sensor = XssSensor.new({
-                    "enabled" => true,
-                    "exclude_cookies" => true
-                  })
-
-                  expect(sensor).to receive(:find_vulnerability).and_return(
-                    {"param" => "vuln_param", "value" => "vuln_value", "pattern" => "1"}
-                  )
-
-                  result = sensor.get_injection_attempt(
-                    XssSensor::POST_PARAM,
-                    @appsensor_meta,
-                    "param_name",
-                    "param_value",
-                  )
-
-                  expect(result.type_of_param).to eq(XssSensor::POST_PARAM)
-                  expect(result.detection_point).to eq(sensor.detection_point)
-                  expect(result.param_name).to eq("vuln_param")
-                  expect(result.param_value).to eq("vuln_value")
-                  expect(result.pattern).to eq("1")
-                end
-              end
-
-              context "exclude headers sensor" do
-                it "should return true" do
-                  sensor = XssSensor.new({
-                    "enabled" => true,
-                    "exclude_headers" => true,
-                  })
-
-                  expect(sensor).to receive(:find_vulnerability).and_return(
-                    {"param" => "vuln_param", "value" => "vuln_value", "pattern" => "1"}
-                  )
-
-                  result = sensor.get_injection_attempt(
-                    XssSensor::POST_PARAM,
-                    @appsensor_meta,
-                    "param_name",
-                    "param_value",
-                  )
-
-                  expect(result.type_of_param).to eq(XssSensor::POST_PARAM)
-                  expect(result.detection_point).to eq(sensor.detection_point)
-                  expect(result.param_name).to eq("vuln_param")
-                  expect(result.param_value).to eq("vuln_value")
-                  expect(result.pattern).to eq("1")
-                end
-              end
-            end
-
-            context "param is a JSON param" do
-              context "exclude forms sensor" do
-                it "should return false" do
-                  sensor = XssSensor.new({
-                    "enabled" => true,
-                    "exclude_forms" => true
-                  })
-
-                  expect(sensor).to_not receive(:find_vulnerability)
-
-                  result = sensor.get_injection_attempt(
-                    XssSensor::JSON_PARAM,
-                    @appsensor_meta,
-                    "param_name",
-                    "param_value",
-                  )
-
-                  expect(result).to eq(false)
-                end
-              end
-
-              context "exclude cookies sensor" do
-                it "should return true" do
-                  sensor = XssSensor.new({
-                    "enabled" => true,
-                    "exclude_cookies" => true
-                  })
-
-                  expect(sensor).to receive(:find_vulnerability).and_return(
-                    {"param" => "vuln_param", "value" => "vuln_value", "pattern" => "1"}
-                  )
-
-                  result = sensor.get_injection_attempt(
-                    XssSensor::JSON_PARAM,
-                    @appsensor_meta,
-                    "param_name",
-                    "param_value",
-                  )
-
-                  expect(result.type_of_param).to eq(XssSensor::JSON_PARAM)
-                  expect(result.detection_point).to eq(sensor.detection_point)
-                  expect(result.param_name).to eq("vuln_param")
-                  expect(result.param_value).to eq("vuln_value")
-                  expect(result.pattern).to eq("1")
-                end
-              end
-
-              context "exclude headers sensor" do
-                it "should return true" do
-                  sensor = XssSensor.new({
-                    "enabled" => true,
-                    "exclude_headers" => true,
-                  })
-
-                  expect(sensor).to receive(:find_vulnerability).and_return(
-                    {"param" => "vuln_param", "value" => "vuln_value", "pattern" => "1"}
-                  )
-
-                  result = sensor.get_injection_attempt(
-                    XssSensor::JSON_PARAM,
-                    @appsensor_meta,
-                    "param_name",
-                    "param_value",
-                  )
-
-                  expect(result.type_of_param).to eq(XssSensor::JSON_PARAM)
-                  expect(result.detection_point).to eq(sensor.detection_point)
-                  expect(result.param_name).to eq("vuln_param")
-                  expect(result.param_value).to eq("vuln_value")
-                  expect(result.pattern).to eq("1")
-                end
-              end
-            end
-
-            context "param is a COOKIE param" do
-              context "exclude forms sensor" do
-                it "should return true" do
-                  sensor = XssSensor.new({
-                    "enabled" => true,
-                    "exclude_forms" => true
-                  })
-
-                  expect(sensor).to receive(:find_vulnerability).and_return(
-                    {"param" => "vuln_param", "value" => "vuln_value", "pattern" => "1"}
-                  )
-
-                  result = sensor.get_injection_attempt(
-                    XssSensor::COOKIE_PARAM,
-                    @appsensor_meta,
-                    "param_name",
-                    "param_value",
-                  )
-
-                  expect(result.type_of_param).to eq(XssSensor::COOKIE_PARAM)
-                  expect(result.detection_point).to eq(sensor.detection_point)
-                  expect(result.param_name).to eq("vuln_param")
-                  expect(result.param_value).to eq("vuln_value")
-                  expect(result.pattern).to eq("1")
-                end
-              end
-
-              context "exclude cookies sensor" do
-                it "should return false" do
-                  sensor = XssSensor.new({
-                    "enabled" => true,
-                    "exclude_cookies" => true
-                  })
-
-                  expect(sensor).to_not receive(:find_vulnerability)
-
-                  result = sensor.get_injection_attempt(
-                    XssSensor::COOKIE_PARAM,
-                    @appsensor_meta,
-                    "param_name",
-                    "param_value",
-                  )
-
-                  expect(result).to eq(false)
-                end
-              end
-
-              context "exclude headers sensor" do
-                it "should return true" do
-                  sensor = XssSensor.new({
-                    "enabled" => true,
-                    "exclude_headers" => true,
-                  })
-
-                  expect(sensor).to receive(:find_vulnerability).and_return(
-                    {"param" => "vuln_param", "value" => "vuln_value", "pattern" => "1"}
-                  )
-
-                  result = sensor.get_injection_attempt(
-                    XssSensor::COOKIE_PARAM,
-                    @appsensor_meta,
-                    "param_name",
-                    "param_value",
-                  )
-
-                  expect(result.type_of_param).to eq(XssSensor::COOKIE_PARAM)
-                  expect(result.detection_point).to eq(sensor.detection_point)
-                  expect(result.param_name).to eq("vuln_param")
-                  expect(result.param_value).to eq("vuln_value")
-                  expect(result.pattern).to eq("1")
-                end
-              end
-            end
-
-            context "param is a HEADER param" do
-              context "exclude forms sensor" do
-                it "should return true" do
-                  sensor = XssSensor.new({
-                    "enabled" => true,
-                    "exclude_forms" => true
-                  })
-
-                  expect(sensor).to receive(:find_vulnerability).and_return(
-                    {"param" => "vuln_param", "value" => "vuln_value", "pattern" => "1"}
-                  )
-
-                  result = sensor.get_injection_attempt(
-                    XssSensor::HEADER_PARAM,
-                    @appsensor_meta,
-                    "param_name",
-                    "param_value",
-                  )
-
-                  expect(result.type_of_param).to eq(XssSensor::HEADER_PARAM)
-                  expect(result.detection_point).to eq(sensor.detection_point)
-                  expect(result.param_name).to eq("vuln_param")
-                  expect(result.param_value).to eq("vuln_value")
-                  expect(result.pattern).to eq("1")
-                end
-              end
-
-              context "exclude cookies sensor" do
-                it "should return true" do
-                  sensor = XssSensor.new({
-                    "enabled" => true,
-                    "exclude_cookies" => true
-                  })
-
-                  expect(sensor).to receive(:find_vulnerability).and_return(
-                    {"param" => "vuln_param", "value" => "vuln_value", "pattern" => "1"}
-                  )
-
-                  result = sensor.get_injection_attempt(
-                    XssSensor::HEADER_PARAM,
-                    @appsensor_meta,
-                    "param_name",
-                    "param_value",
-                  )
-
-                  expect(result.type_of_param).to eq(XssSensor::HEADER_PARAM)
-                  expect(result.detection_point).to eq(sensor.detection_point)
-                  expect(result.param_name).to eq("vuln_param")
-                  expect(result.param_value).to eq("vuln_value")
-                  expect(result.pattern).to eq("1")
-                end
-              end
-
-              context "exclude headers sensor" do
-                it "should return true" do
-                  sensor = XssSensor.new({
-                    "enabled" => true,
-                    "exclude_headers" => true,
-                  })
-
-                  expect(sensor).to_not receive(:find_vulnerability)
-
-                  result = sensor.get_injection_attempt(
-                    XssSensor::HEADER_PARAM,
-                    @appsensor_meta,
-                    "param_name",
-                    "param_value",
-                  )
-
-                  expect(result).to eq(false)
-                end
-              end
-            end
-          end
-        end
-
-      end
-
-      describe "#applicable_for_param_type?" do
-        it "should be applicable for all param types" do
-          sensor = XssSensor.new
-          expect(sensor.applicable_for_param_type?(InjectionSensor::GET_PARAM)).to eq(true)
-          expect(sensor.applicable_for_param_type?(InjectionSensor::POST_PARAM)).to eq(true)
-          expect(sensor.applicable_for_param_type?(InjectionSensor::JSON_PARAM)).to eq(true)
-          expect(sensor.applicable_for_param_type?(InjectionSensor::COOKIE_PARAM)).to eq(true)
-          expect(sensor.applicable_for_param_type?(InjectionSensor::URI_PARAM)).to eq(true)
-        end
-      end
-    end
-
-  end
-end