tcell_agent 1.1.11 → 2.1.2

data/spec/lib/tcell_agent/rails/middleware/global_middleware_spec.rb

@@ -1,180 +0,0 @@
-require 'spec_helper'
-require 'rack/test'
-require 'rack'
-
-module TCellAgent
-  module Instrumentation
-    module Rails
-      module Middleware
-        class MockRackApp
-          attr_reader :request_body
-
-          def initialize
-            @request_headers = {}
-          end
-
-          def call(env)
-            @env = env
-            @request_body = env['rack.input'].read
-            rack_request = Rack::Request.new(env)
-            response_headers = { 'Content-Type' => 'text/html' }
-            if rack_request.params['rv']
-              response_headers['Location'] = rack_request.params['rv']
-            end
-            [200, response_headers, ['OK']]
-          end
-
-          def [](key)
-            @env[key]
-          end
-        end
-
-        describe HeadersMiddleware do
-          let(:app) { MockRackApp.new }
-          subject { with_tcell_middleware(app) }
-
-          context 'Redirect Middleware' do
-            let(:request) { Rack::MockRequest.new(subject) }
-            let(:agent) { ::TCellAgent::Agent.new(Process.pid) }
-            before(:each) do
-              TCellAgent.configuration = TCellAgent::Configuration.new
-              TCellAgent.configuration.read_config_from_file(get_test_resource_path('normal_config.json'))
-
-              # avoid running start_policy_polling for these specs
-              expect(agent).to receive(:start_policy_polling_loop).at_most(50)
-
-              agent.start
-              TCellAgent.thread_agent = agent
-            end
-
-            context 'not enabled' do
-              it 'passes through unchanged' do
-                agent.process_policy_json(
-                  {
-                    'http-redirect' => {
-                      'policy_id' => '153ed270-7481-11e5-9194-95dad9b9dec3',
-                      'data' => {
-                        'enabled' => false,
-                        'block' => true,
-                        'whitelist' => []
-                      }
-                    }
-                  },
-                  false
-                )
-                response = request.get('/some/path?rv=https://www.google.com', 'CONTENT_TYPE' => 'text/html')
-                expect(response['Location']).to eq('https://www.google.com')
-              end
-            end
-
-            context "doesn't block simple whitelist" do
-              it 'passes through unchanged' do
-                agent.process_policy_json(
-                  {
-                    'http-redirect' => {
-                      'policy_id' => '153ed270-7481-11e5-9194-95dad9b9dec3',
-                      'data' => {
-                        'enabled' => true,
-                        'block' => true,
-                        'whitelist' => ['www.google.com']
-                      }
-                    }
-                  },
-                  false
-                )
-
-                response = request.get('/some/path?rv=https://www.google.com', 'CONTENT_TYPE' => 'text/html')
-                expect(response['Location']).to eq('https://www.google.com')
-              end
-            end
-
-            context "doesn't block wildcard whitelist" do
-              it 'passes through unchanged' do
-                agent.process_policy_json(
-                  {
-                    'http-redirect' => {
-                      'policy_id' => '153ed270-7481-11e5-9194-95dad9b9dec3',
-                      'data' => {
-                        'enabled' => true,
-                        'block' => true,
-                        'whitelist' => ['*.google.com']
-                      }
-                    }
-                  },
-                  false
-                )
-                response = request.get('/some/path?rv=https://www.google.com', 'CONTENT_TYPE' => 'text/html')
-                expect(response['Location']).to eq('https://www.google.com')
-              end
-            end
-
-            context 'DOES block wildcard whitelist' do
-              it 'replaces the value with /' do
-                agent.process_policy_json(
-                  {
-                    'http-redirect' => {
-                      'policy_id' => '153ed270-7481-11e5-9194-95dad9b9dec3',
-                      'data' => {
-                        'enabled' => true,
-                        'block' => true,
-                        'whitelist' => ['*.google-test.com']
-                      }
-                    }
-                  },
-                  false
-                )
-
-                response = request.get('/some/path?rv=https://www.google.com', 'CONTENT_TYPE' => 'text/html')
-                expect(response['Location']).to eq('/')
-              end
-            end
-          end
-
-          context 'CSP Middleware' do
-            let(:request) { Rack::MockRequest.new(subject) }
-            let(:agent) { ::TCellAgent::Agent.new(Process.pid) }
-
-            before(:each) do
-              TCellAgent.configuration = TCellAgent::Configuration.new
-              TCellAgent.configuration.read_config_from_file(get_test_resource_path('normal_config.json'))
-
-              # avoid running start_policy_polling for these specs
-              expect(agent).to receive(:start_policy_polling_loop).at_most(50)
-
-              agent.start
-              TCellAgent.thread_agent = agent
-            end
-
-            context 'Standard CSP Header' do
-              it 'CSP Header is Added' do
-                agent.process_policy_json(
-                  {
-                    'csp-headers' => {
-                      'policy_id' => '153ed270-7481-11e5-9194-95dad9b9dec3',
-                      'headers' => [
-                        {
-                          'name' => 'Content-Security-Policy-Report-Only',
-                          'value' => "script-src 'unsafe-inline'",
-                          'report_uri' => 'http://test.tcell.io/report'
-                        }
-                      ]
-                    }
-                  },
-                  false
-                )
-                response = request.get(
-                  '/some/path',
-                  'CONTENT_TYPE' => 'text/plain',
-                  'action_dispatch.request_id' => '35281717-247e-44e6-bd42-0fb1417e80d'
-                )
-                expect(response['Content-Security-Policy-Report-Only']).to eq(
-                  "script-src 'unsafe-inline'; report-uri http://test.tcell.io/report"
-                )
-              end
-            end
-          end
-        end
-      end
-    end
-  end
-end

data/spec/lib/tcell_agent/rails/middleware/redirect_middleware_spec.rb

@@ -1,116 +0,0 @@
-require 'spec_helper'
-require 'rack/test'
-require 'rack'
-
-module TCellAgent
-  module Instrumentation
-    module Rails
-      module Middleware
-        class MockAppsensorRackApp
-          attr_reader :request_body
-
-          def initialize(route_id = nil, hmac_session_id = nil)
-            @route_id = route_id
-            @hmac_session_id = hmac_session_id
-            @request_headers = {}
-          end
-
-          def call(env)
-            @env = env
-            rack_request = Rack::Request.new(env)
-            response_headers = { 'Content-Type' => 'text/html' }
-            env['tcell.request_data'].transaction_id = 'a-b-c-d-e-f'
-            env['tcell.request_data'].hmac_session_id = @hmac_session_id
-            env['tcell.request_data'].route_id = @route_id
-            if rack_request.params['rv']
-              response_headers['Location'] = rack_request.params['rv']
-            end
-            [200, response_headers, ['OK']]
-          end
-
-          def [](key)
-            @env[key]
-          end
-        end
-
-        describe HeadersMiddleware do
-          let(:app) { MockAppsensorRackApp.new }
-          let(:app2) { MockAppsensorRackApp.new('myrouteid', 'hmac_sessionid') }
-
-          subject { with_tcell_middleware(app) }
-
-          context 'Redirect Middleware' do
-            before(:each) do
-              TCellAgent.configuration = TCellAgent::Configuration.new
-              TCellAgent.configuration.read_config_from_file(get_test_resource_path('normal_config.json'))
-            end
-
-            let(:request) { Rack::MockRequest.new(subject) }
-            let(:request2) { Rack::MockRequest.new(with_tcell_middleware(app2)) }
-            let(:agent) { ::TCellAgent::Agent.new }
-
-            context 'Event' do
-              before(:each) do
-                TCellAgent.thread_agent.process_policy_json(
-                  {
-                    'http-redirect' =>
-                    {
-                      'policy_id' => '153ed270-7481-11e5-9194-95dad9b9dec3',
-                      'data' => {
-                        'enabled' => true,
-                        'block' => false,
-                        'whitelist' => []
-                      }
-                    }
-                  },
-                  false
-                )
-                TCellAgent.empty_event_queue
-              end
-
-              it 'sends redirect' do
-                response = request.get(
-                  '/some/path2?abcdef=adsfsadf&rv=https://www.google.com',
-                  'CONTENT_TYPE' => 'text/html',
-                  'REMOTE_ADDR' => '1.3.3.4,3.4.5.6'
-                )
-                expect(response['Location']).to eq('https://www.google.com')
-                expected_as = {
-                  'event_type' => 'redirect',
-                  'method' => 'GET',
-                  'from_domain' => 'example.org',
-                  'status_code' => 200,
-                  'remote_addr' => '1.3.3.4',
-                  'from' => '/some/path2?abcdef=&rv=',
-                  'to' => 'www.google.com'
-                }
-                expect(TCellAgent.event_queue).to include(expected_as)
-              end
-
-              it 'sends redirect event with extra info' do
-                response = request2.get(
-                  '/some/path2?abcdef=adsfsadf&rv=https://www.google.com',
-                  'CONTENT_TYPE' => 'text/html',
-                  'REMOTE_ADDR' => '1.3.3.4,3.4.5.6'
-                )
-                expect(response['Location']).to eq('https://www.google.com')
-                expected_as = {
-                  'event_type' => 'redirect',
-                  'method' => 'GET',
-                  'from_domain' => 'example.org',
-                  'status_code' => 200,
-                  'remote_addr' => '1.3.3.4',
-                  'rid' => 'myrouteid',
-                  'from' => '/some/path2?abcdef=&rv=',
-                  'to' => 'www.google.com',
-                  'sid' => 'hmac_sessionid'
-                }
-                expect(TCellAgent.event_queue).to include(expected_as)
-              end
-            end
-          end
-        end
-      end
-    end
-  end
-end

data/spec/lib/tcell_agent/rust/models_spec.rb

@@ -1,120 +0,0 @@
-
-require 'spec_helper'
-
-module TCellAgent
-  module Rust
-    describe '.create_request_response' do
-      it 'should create request response' do
-        meta_data = TCellAgent::MetaData.new(
-          'GET',
-          '192.168.1.1',
-          '12345',
-          'session_id',
-          'user_id',
-          'transaction_id',
-          'http://192.168.1.1/some/path?xss_param=<script>'
-        )
-        meta_data.response_code = 200
-        meta_data.user_agent = 'Mozilla'
-        meta_data.path = '/some/path'
-        meta_data.request_content_bytes_len = 1024
-        meta_data.response_content_bytes_len = 2048
-        meta_data.get_dict = { 'user' => { 'xss_param' => '<script>' } }
-        meta_data.sql_exceptions = [{ 'exception_name' => 'OperationalError', 'exception_payload' => 'Developer Error' }]
-        meta_data.csrf_exception_name = 'ActionController::InvalidAuthenticityToken'
-        meta_data.path_parameters = { 'xss_param' => '<script>' }
-        meta_data.post_dict = { 'xss_param' => '<script>' }
-        meta_data.cookie_dict = { 'xss_param' => '<script>' }
-        meta_data.headers_dict = { 'HTTP_XSS_PARAM' => '<script>' }
-        meta_data.content_type = 'hi'
-        meta_data.raw_request_body = { 'xss_param' => '<script>' }.to_json
-
-        result = Models.create_request_response(meta_data)
-
-        expect(result).to eq(
-          {
-            'method' => 'GET',
-            'status_code' => 200,
-            'route_id' => '12345',
-            'path' => '/some/path',
-            'query_params' => [
-              { 'name' => 'xss_param', 'value' => '<script>' }
-            ],
-            'post_params' => [
-              { 'name' => 'xss_param', 'value' => '<script>' }
-            ],
-            'headers' => [
-              { 'name' => 'xss-param', 'value' => '<script>' }
-            ],
-            'cookies' => [
-              { 'name' => 'xss_param', 'value' => '<script>' }
-            ],
-            'path_params' => [
-              { 'name' => 'xss_param', 'value' => '<script>' }
-            ],
-            'remote_address' => '192.168.1.1',
-            'full_uri' => 'http://192.168.1.1/some/path?xss_param=<script>',
-            'session_id' => 'session_id',
-            'user_id' => 'user_id',
-            'user_agent' => 'Mozilla',
-            :content_type => 'hi',
-            :request_body => '{"xss_param":"<script>"}',
-            'request_bytes_length' => 1024,
-            'response_bytes_length' => 2048,
-            'csrf_exception' => {
-              'exception_name' => 'ActionController::InvalidAuthenticityToken'
-            },
-            'sql_exceptions' => [
-              {
-                'exception_name' => 'OperationalError',
-                'exception_payload' => 'Developer Error'
-              }
-            ]
-          }
-        )
-      end
-    end
-
-    describe '.create_patches_request' do
-      it 'should create patches request' do
-        meta_data = TCellAgent::MetaData.new(
-          'GET',
-          '192.168.1.1',
-          '12345',
-          'session_id',
-          'user_id',
-          'transaction_id',
-          'http://192.168.1.1/some/path?xss_param=<script>'
-        )
-
-        meta_data.path = '/some/path'
-        meta_data.request_content_bytes_len = 1024
-        meta_data.get_dict = { 'user' => { 'xss_param' => '<script>' } }
-        meta_data.post_dict = { 'user' => { 'xss_param' => '<script>' } }
-        meta_data.cookie_dict = { 'xss_param' => '<script>' }
-        meta_data.headers_dict = { 'HTTP_XSS_PARAM' => '<script>' }
-        meta_data.content_type = 'hi'
-        # patches does not use the request body.
-        meta_data.raw_request_body = { 'user' => { 'xss_param' => '<script>' } }.to_json
-
-        result = Models.create_patches_request(meta_data)
-
-        expect(result).to eq(
-          {
-            'method' => 'GET',
-            'path' => '/some/path',
-            'remote_address' => '192.168.1.1',
-            'request_bytes_length' => 1024,
-            :content_type => 'hi',
-            'query_params' => [{ 'name' => 'xss_param', 'value' => '<script>' }],
-            'post_params' => [
-              { 'name' => 'xss_param', 'value' => '<script>' }
-            ],
-            'headers' => [{ 'name' => 'xss-param', 'value' => '<script>' }],
-            'cookies' => [{ 'name' => 'xss_param', 'value' => '<script>' }]
-          }
-        )
-      end
-    end
-  end
-end

data/spec/lib/tcell_agent/rust/whisperer_spec.rb

@@ -1,704 +0,0 @@
-
-require 'spec_helper'
-
-module TCellAgent
-  module Rust
-    describe '.apply_cmdi' do
-      require 'tcell_agent/rust/whisperer'
-
-      before(:each) do
-        configuration = double(
-          'configuration',
-          {
-            'app_id' => 'app_id',
-            'api_key' => 'api_key',
-            'allow_payloads' => true,
-            'js_agent_api_base_url' => 'http://api.tcell.com/',
-            'js_agent_url' => 'https://jsagent.tcell.io/tcellagent.min.js',
-            'max_csp_header_bytes' => nil
-          }
-        )
-        expect(TCellAgent).to receive(:configuration).and_return(configuration).at_least(:once)
-        whisper = Whisperer.create_agent
-        @agent_ptr = whisper['agent_ptr']
-        @report_command_rule_id = 'TJM4ODvkB2jSR47qltL+0Nyy/PGlF6Qa/cin65qtIlc='
-        @compound_rule_id = 'Y+IHN7BJDctqOIIZOb71NR8PkUxru01LDkqU1lZwogY='
-        @block_whoois_on_path_rule_id = 'report-rule-with-path'
-        policy = {
-          'cmdi' => {
-            'data' => {
-              'collect_full_commandline' => false,
-              'command_rules' => [
-                {
-                  'action' => 'report',
-                  'rule_id' => @report_command_rule_id
-                },
-                {
-                  'action' => 'block',
-                  'rule_id' => @block_whoois_on_path_rule_id,
-                  'command' => 'whoois',
-                  'path' => { 'exact' => '/some/path', 'method' => 'GET' }
-                }
-              ],
-              'compound_statement_rules' => [
-                {
-                  'action' => 'report',
-                  'rule_id' => @compound_rule_id
-                }
-              ]
-            },
-            'policy_id' => '0cf0f090-ffc0-11e7-8080-808080808080',
-            'version' => 1
-          }
-        }
-
-        whisper = Whisperer.update_policies(@agent_ptr, policy)
-        expect(whisper['enablements']).to eq(
-          {
-            'appfirewall' => false,
-            'patches' => false,
-            'cmdi' => true,
-            'headers' => false,
-            'jsagentinjection' => false
-          }
-        )
-        @tcell_context = nil
-      end
-
-      after(:each) do
-        Whisperer.free_agent(@agent_ptr)
-      end
-
-      context 'empty command' do
-        it 'should return empty json object' do
-          result = Whisperer.apply_cmdi(@agent_ptr, nil, @tcell_context)
-          expect(result).to eq({})
-          result = Whisperer.apply_cmdi(@agent_ptr, '', @tcell_context)
-          expect(result).to eq({})
-          result = Whisperer.apply_cmdi(@agent_ptr, '   ', @tcell_context)
-          expect(result).to eq({})
-        end
-      end
-
-      context 'with a path with method' do
-        it 'that matches, should return event' do
-          tcell_context = TCellAgent::Instrumentation::TCellData.new
-          tcell_context.request_method = 'GET'
-          tcell_context.path = '/some/path'
-          result = Whisperer.apply_cmdi(@agent_ptr, 'whoois', tcell_context)
-          expect(result).to eq(
-            {
-              'apply_response' => {
-                'blocked' => true,
-                'commands' => [{ 'command' => 'whoois', 'arg_count' => 0 }],
-                'matches' => [{ 'rule_id' => @block_whoois_on_path_rule_id,
-                                'command' => 'whoois' }],
-                'full_commandline' => nil
-              }
-            }
-          )
-        end
-
-        it 'that does not match, should match generic report event' do
-          # method doesn't match
-          tcell_context = TCellAgent::Instrumentation::TCellData.new
-          tcell_context.request_method = 'POST'
-          tcell_context.path = '/some/path'
-          result = Whisperer.apply_cmdi(@agent_ptr, 'whoois', tcell_context)
-          expect(result).to eq(
-            {
-              'apply_response' => {
-                'blocked' => false,
-                'commands' => [{ 'command' => 'whoois', 'arg_count' => 0 }],
-                'matches' => [{ 'rule_id' => @report_command_rule_id,
-                                'command' => 'whoois' }],
-                'full_commandline' => nil
-              }
-            }
-          )
-
-          # path doesn't match
-          tcell_context = TCellAgent::Instrumentation::TCellData.new
-          tcell_context.request_method = 'GET'
-          tcell_context.path = '/does/not/match'
-          result = Whisperer.apply_cmdi(@agent_ptr, 'whoois', tcell_context)
-          expect(result).to eq(
-            {
-              'apply_response' => {
-                'blocked' => false,
-                'commands' => [{ 'command' => 'whoois', 'arg_count' => 0 }],
-                'matches' => [{ 'rule_id' => @report_command_rule_id,
-                                'command' => 'whoois' }],
-                'full_commandline' => nil
-              }
-            }
-          )
-        end
-      end
-
-      context 'single command' do
-        it 'should return single command parsed' do
-          result = Whisperer.apply_cmdi(@agent_ptr, 'ifconfig -a', @tcell_context)
-          expect(result).to eq({
-                                 'apply_response' => {
-                                   'blocked' => false,
-                                   'commands' => [{ 'command' => 'ifconfig', 'arg_count' => 1 }],
-                                   'matches' => [{ 'rule_id' => @report_command_rule_id,
-                                                   'command' => 'ifconfig' }],
-                                   'full_commandline' => nil
-                                 }
-                               })
-          result = Whisperer.apply_cmdi(@agent_ptr, 'ifconfig', @tcell_context)
-          expect(result).to eq({
-                                 'apply_response' => {
-                                   'blocked' => false,
-                                   'commands' => [{ 'command' => 'ifconfig', 'arg_count' => 0 }],
-                                   'matches' => [{ 'rule_id' => @report_command_rule_id,
-                                                   'command' => 'ifconfig' }],
-                                   'full_commandline' => nil
-                                 }
-                               })
-        end
-      end
-
-      context 'with a compound command' do
-        it 'should return parsed commands' do
-          commands = Whisperer.apply_cmdi(
-            @agent_ptr,
-            'cd /tcellagent_src && bundle --quiet && bundle exec rake compile && bundle exec rspec',
-            @tcell_context
-          )
-          expect(commands).to eq({
-                                   'apply_response' => {
-                                     'blocked' => false,
-                                     'commands' => [
-                                       { 'command' => 'cd', 'arg_count' => 1 },
-                                       { 'command' => 'bundle', 'arg_count' => 1 },
-                                       { 'command' => 'bundle', 'arg_count' => 3 },
-                                       { 'command' => 'bundle', 'arg_count' => 2 }
-                                     ],
-                                     'matches' => [{ 'rule_id' => @compound_rule_id, 'command' => nil },
-                                                   { 'rule_id' => @report_command_rule_id, 'command' => 'cd' },
-                                                   { 'rule_id' => @report_command_rule_id, 'command' => 'bundle' },
-                                                   { 'rule_id' => @report_command_rule_id, 'command' => 'bundle' },
-                                                   { 'rule_id' => @report_command_rule_id, 'command' => 'bundle' }],
-                                     'full_commandline' => nil
-                                   }
-                                 })
-
-          commands = Whisperer.apply_cmdi(
-            @agent_ptr,
-            'cd /tcellagent_src; bundle --quiet; bundle exec rake compile; bundle exec rspec',
-            @tcell_context
-          )
-          expect(commands).to eq({
-                                   'apply_response' => {
-                                     'blocked' => false,
-                                     'commands' => [
-                                       { 'command' => 'cd', 'arg_count' => 1 },
-                                       { 'command' => 'bundle', 'arg_count' => 1 },
-                                       { 'command' => 'bundle', 'arg_count' => 3 },
-                                       { 'command' => 'bundle', 'arg_count' => 2 }
-                                     ],
-                                     'matches' => [
-                                       { 'rule_id' => @compound_rule_id, 'command' => nil },
-                                       { 'rule_id' => @report_command_rule_id, 'command' => 'cd' },
-                                       { 'rule_id' => @report_command_rule_id, 'command' => 'bundle' },
-                                       { 'rule_id' => @report_command_rule_id, 'command' => 'bundle' },
-                                       { 'rule_id' => @report_command_rule_id, 'command' => 'bundle' }
-                                     ],
-                                     'full_commandline' => nil
-                                   }
-                                 })
-
-          commands = Whisperer.apply_cmdi(
-            @agent_ptr,
-            'cat /etc/passwd | grep root',
-            @tcell_context
-          )
-          expect(commands).to eq({
-                                   'apply_response' => {
-                                     'blocked' => false,
-                                     'commands' => [
-                                       { 'command' => 'cat', 'arg_count' => 1 },
-                                       { 'command' => 'grep', 'arg_count' => 1 }
-                                     ],
-                                     'matches' => [
-                                       { 'rule_id' => @compound_rule_id, 'command' => nil },
-                                       { 'rule_id' => @report_command_rule_id, 'command' => 'cat' },
-                                       { 'rule_id' => @report_command_rule_id, 'command' => 'grep' }
-                                     ],
-                                     'full_commandline' => nil
-                                   }
-                                 })
-        end
-
-        context 'spawning multiple lines' do
-          it 'should parse the commands' do
-            multiline_command = "echo 'first-line'; \ \n" \
-                                'cat /etc/passwd | grep root'
-            commands = Whisperer.apply_cmdi(
-              @agent_ptr,
-              multiline_command,
-              @tcell_context
-            )
-
-            expect(commands).to eq({
-                                     'apply_response' => {
-                                       'blocked' => false,
-                                       'commands' => [
-                                         { 'command' => 'echo', 'arg_count' => 1 },
-                                         { 'command' => 'cat', 'arg_count' => 1 },
-                                         { 'command' => 'grep', 'arg_count' => 1 }
-                                       ],
-                                       'matches' => [
-                                         { 'rule_id' => @compound_rule_id, 'command' => nil },
-                                         { 'rule_id' => @report_command_rule_id, 'command' => 'echo' },
-                                         { 'rule_id' => @report_command_rule_id, 'command' => 'cat' },
-                                         { 'rule_id' => @report_command_rule_id, 'command' => 'grep' }
-                                       ],
-                                       'full_commandline' => nil
-                                     }
-                                   })
-
-            multiline_command = "echo 'first-line' && \ \n" \
-                                'cat /etc/passwd | grep root'
-            commands = Whisperer.apply_cmdi(
-              @agent_ptr,
-              multiline_command,
-              @tcell_context
-            )
-            expect(commands).to eq({
-                                     'apply_response' => {
-                                       'blocked' => false,
-                                       'commands' => [
-                                         { 'command' => 'echo', 'arg_count' => 1 },
-                                         { 'command' => 'cat', 'arg_count' => 1 },
-                                         { 'command' => 'grep', 'arg_count' => 1 }
-                                       ],
-                                       'matches' => [
-                                         { 'rule_id' => @compound_rule_id, 'command' => nil },
-                                         { 'rule_id' => @report_command_rule_id, 'command' => 'echo' },
-                                         { 'rule_id' => @report_command_rule_id, 'command' => 'cat' },
-                                         { 'rule_id' => @report_command_rule_id, 'command' => 'grep' }
-                                       ],
-                                       'full_commandline' => nil
-                                     }
-                                   })
-
-            multiline_command = "cd /tcellagent_src; bundle --quiet; \ \n" \
-                                "bundle exec rake compile; \ \n" \
-                                'bundle exec rspec'
-            commands = Whisperer.apply_cmdi(
-              @agent_ptr,
-              multiline_command,
-              @tcell_context
-            )
-            expect(commands).to eq({
-                                     'apply_response' => {
-                                       'blocked' => false,
-                                       'commands' => [
-                                         { 'command' => 'cd', 'arg_count' => 1 },
-                                         { 'command' => 'bundle', 'arg_count' => 1 },
-                                         { 'command' => 'bundle', 'arg_count' => 3 },
-                                         { 'command' => 'bundle', 'arg_count' => 2 }
-                                       ],
-                                       'matches' => [
-                                         { 'rule_id' => @compound_rule_id, 'command' => nil },
-                                         { 'rule_id' => @report_command_rule_id, 'command' => 'cd' },
-                                         { 'rule_id' => @report_command_rule_id, 'command' => 'bundle' },
-                                         { 'rule_id' => @report_command_rule_id, 'command' => 'bundle' },
-                                         { 'rule_id' => @report_command_rule_id, 'command' => 'bundle' }
-                                       ],
-                                       'full_commandline' => nil
-                                     }
-                                   })
-          end
-        end
-      end
-
-      context 'with a complex command' do
-        it 'should parse the commands' do
-          multiline_command = "magick -size 320x85 canvas:none -font Bookman-DemiItalic -pointsize 72 \\ \n" \
-                              "-draw \"text 25,60 \'Magick\'\" -channel RGBA -blur 0x6 -fill darkred -stroke magenta \\ \n" \
-                              "-draw \"text 20,55 \'Magick\'\" fuzzy-magick.png"
-          commands = Whisperer.apply_cmdi(
-            @agent_ptr,
-            multiline_command,
-            @tcell_context
-          )
-          expect(commands).to eq({
-                                   'apply_response' => {
-                                     'blocked' => false,
-                                     'commands' => [{ 'command' => 'magick', 'arg_count' => 26 }],
-                                     'matches' => [{ 'rule_id' => @report_command_rule_id, 'command' => 'magick' }],
-                                     'full_commandline' => nil
-                                   }
-                                 })
-
-          commands = Whisperer.apply_cmdi(
-            @agent_ptr,
-            "/usr/local/bin/ruby -eputs 'Hello World!' > /dev/null 2>&1",
-            @tcell_context
-          )
-          expect(commands).to eq({
-                                   'apply_response' => {
-                                     'blocked' => false,
-                                     'commands' => [{ 'command' => 'ruby', 'arg_count' => 6 }],
-                                     'matches' => [{ 'rule_id' => @report_command_rule_id, 'command' => 'ruby' }],
-                                     'full_commandline' => nil
-                                   }
-                                 })
-        end
-      end
-
-      context 'with special characters in the command' do
-        it 'should parse the commands' do
-          commands = Whisperer.apply_cmdi(
-            @agent_ptr,
-            "echo 'bréak' && cat /etc/passwd && grep root",
-            @tcell_context
-          )
-          expect(commands).to eq({
-                                   'apply_response' => {
-                                     'blocked' => false,
-                                     'commands' => [
-                                       { 'command' => 'echo', 'arg_count' => 1 },
-                                       { 'command' => 'cat', 'arg_count' => 1 },
-                                       { 'command' => 'grep', 'arg_count' => 1 }
-                                     ],
-                                     'matches' => [
-                                       { 'rule_id' => @compound_rule_id, 'command' => nil },
-                                       { 'rule_id' => @report_command_rule_id, 'command' => 'echo' },
-                                       { 'rule_id' => @report_command_rule_id, 'command' => 'cat' },
-                                       { 'rule_id' => @report_command_rule_id, 'command' => 'grep' }
-                                     ],
-                                     'full_commandline' => nil
-                                   }
-                                 })
-        end
-      end
-
-      context 'with null terminator character in the command' do
-        it 'should parse the commands' do
-          commands = Whisperer.apply_cmdi(
-            @agent_ptr,
-            "echo 'br\0ak' && cat /etc/passwd && grep root",
-            @tcell_context
-          )
-          expect(commands).to eq({
-                                   'apply_response' => {
-                                     'blocked' => false,
-                                     'commands' => [
-                                       { 'command' => 'echo', 'arg_count' => 1 },
-                                       { 'command' => 'cat', 'arg_count' => 1 },
-                                       { 'command' => 'grep', 'arg_count' => 1 }
-                                     ],
-                                     'matches' => [
-                                       { 'rule_id' => @compound_rule_id, 'command' => nil },
-                                       { 'rule_id' => @report_command_rule_id, 'command' => 'echo' },
-                                       { 'rule_id' => @report_command_rule_id, 'command' => 'cat' },
-                                       { 'rule_id' => @report_command_rule_id, 'command' => 'grep' }
-                                     ],
-                                     'full_commandline' => nil
-                                   }
-                                 })
-        end
-      end
-
-      context 'with an sh command' do
-        it 'should parse the commands' do
-          commands = Whisperer.apply_cmdi(
-            @agent_ptr,
-            'sh -c "bundle install && rake db:setup db:migrate"',
-            @tcell_context
-          )
-          expect(commands).to eq(
-            {
-              'apply_response' => {
-                'blocked' => false,
-                'commands' => [
-                  { 'command' => 'sh', 'arg_count' => 2 },
-                  { 'command' => 'bundle', 'arg_count' => 1 },
-                  { 'command' => 'rake', 'arg_count' => 2 }
-                ],
-                'matches' => [
-                  { 'rule_id' => @compound_rule_id, 'command' => nil },
-                  { 'rule_id' => @report_command_rule_id, 'command' => 'sh' },
-                  { 'rule_id' => @report_command_rule_id, 'command' => 'bundle' },
-                  { 'rule_id' => @report_command_rule_id, 'command' => 'rake' }
-                ],
-                'full_commandline' => nil
-              }
-            }
-          )
-        end
-      end
-
-      context 'with an /bin/sh command' do
-        it 'should parse the commands' do
-          commands = Whisperer.apply_cmdi(
-            @agent_ptr,
-            '/bin/sh -c "bundle install && rake db:setup db:migrate"',
-            @tcell_context
-          )
-          expect(commands).to eq(
-            {
-              'apply_response' => {
-                'blocked' => false,
-                'commands' => [
-                  { 'command' => 'sh', 'arg_count' => 2 },
-                  { 'command' => 'bundle', 'arg_count' => 1 },
-                  { 'command' => 'rake', 'arg_count' => 2 }
-                ],
-                'matches' => [
-                  { 'rule_id' => @compound_rule_id, 'command' => nil },
-                  { 'rule_id' => @report_command_rule_id, 'command' => 'sh' },
-                  { 'rule_id' => @report_command_rule_id, 'command' => 'bundle' },
-                  { 'rule_id' => @report_command_rule_id, 'command' => 'rake' }
-                ],
-                'full_commandline' => nil
-              }
-            }
-          )
-        end
-      end
-    end
-
-    describe '.convert_result' do
-      it 'should log bad responses from native library' do
-        logger = double('logger')
-        expect(TCellAgent).to receive(:logger).and_return(logger)
-        expect(logger).to receive(:error).with(
-          'Error response from `create_agent` in native library: -1'
-        )
-
-        result = FFI::MemoryPointer.from_string('')
-        expect(Whisperer.convert_result('create_agent', -1, result)).to eq({})
-      end
-
-      it 'should catch and log json parse errors' do
-        logger = double('logger')
-        expect(TCellAgent).to receive(:logger).and_return(logger)
-        expect(logger).to receive(:error).with(
-          'Could not parse json response from `create_agent` in native library.'
-        )
-
-        result = FFI::MemoryPointer.from_string('{malformed_json}')
-        whisper = Whisperer.convert_result('create_agent', result.size, result)
-        expect(whisper).to eq({})
-      end
-
-      it 'should parse json properly' do
-        result = FFI::MemoryPointer.from_string({ 'valid' => 'json' }.to_json)
-        whisper = Whisperer.convert_result('create_agent', result.size, result)
-        expect(whisper).to eq({ 'valid' => 'json' })
-      end
-    end
-
-    describe '.apply_appfirewall and .apply_patches' do
-      before(:each) do
-        configuration = double(
-          'configuration',
-          {
-            'app_id' => 'app_id',
-            'api_key' => 'api_key',
-            'allow_payloads' => true,
-            'js_agent_api_base_url' => 'http://api.tcell.com/',
-            'js_agent_url' => 'https://jsagent.tcell.io/tcellagent.min.js',
-            'max_csp_header_bytes' => nil
-          }
-        )
-        expect(TCellAgent).to receive(:configuration).and_return(configuration).at_least(:once)
-        whisper = Whisperer.create_agent
-        @agent_ptr = whisper['agent_ptr']
-        policy = {
-          'regex' => {
-            'data' => {
-              'patterns' => [
-                {
-                  'id' => 'tc-xss-1',
-                  'pattern' => '(?:<(script|iframe|embed|frame|frameset|object|img|applet|body|html|style|layer|link|ilayer|meta|bgsound))',
-                  'sensor' => 'xss',
-                  'title' => 'Basic Injection'
-                }
-              ],
-              'version' => 1_518_546_622_571
-            },
-            'policy_id' => 'regex-policy-id',
-            'version' => 1
-          },
-
-          'appsensor' => {
-            'policy_id' => 'appsensor-policy-id',
-            'version' => 2,
-            'data' => {
-              'sensors' => {
-                'ignore_rules' => [],
-                'errors' => {
-                  'csrf_exception_enabled' => true,
-                  'sql_exception_enabled' => true
-                },
-                'xss' => {
-                  'dynamic_patterns' => ['tc-xss-1'],
-                  'patterns' => ['1']
-                }
-              }
-            }
-          },
-
-          'patches' => {
-            'data' => {
-              'block_rules' => [],
-              'blocked_ips' => [],
-              'payloads' => {
-                'send_payloads' => true
-              },
-              'rules' => [
-                {
-                  'action' => 'BlockIf',
-                  'destinations' => { 'check_equals' => [{ 'path' => '*' }] },
-                  'id' => 'check-present-rule',
-                  'ignore' => [],
-                  'matches' => [
-                    {
-                      'all' => [
-                        {
-                          'parameters' => {
-                            'check_present' => {
-                              'queries' => [
-                                'xss_param'
-                              ]
-                            }
-                          }
-                        }
-                      ],
-                      'any' => []
-                    }
-                  ],
-                  'title' => 'check present rule'
-                }
-              ]
-            },
-            'policy_id' => 'patches-v1-14',
-            'version' => 2
-          }
-        }
-
-        whisper = Whisperer.update_policies(@agent_ptr, policy)
-        expect(whisper['enablements']).to eq(
-          {
-            'appfirewall' => true,
-            'patches' => true,
-            'cmdi' => false,
-            'headers' => false,
-            'jsagentinjection' => false
-          }
-        )
-      end
-
-      after(:each) do
-        Whisperer.free_agent(@agent_ptr)
-      end
-
-      it 'should return appfirewall injections' do
-        meta_data = TCellAgent::MetaData.new(
-          'GET',
-          '192.168.1.1',
-          '12345',
-          'session_id',
-          'user_id',
-          'transaction_id',
-          'http://192.168.1.1/some/path?xss_param=<script>'
-        )
-        meta_data.path = '/some/path'
-        meta_data.request_content_bytes_len = 1024
-        meta_data.response_content_bytes_len = 2048
-        meta_data.get_dict = { 'xss_param' => '<script>' }
-        meta_data.user_agent = 'Mozilla'
-        meta_data.sql_exceptions = [
-          {
-            'exception_name' => 'OperationalError',
-            'exception_payload' => 'Developer Error'
-          }
-        ]
-        meta_data.csrf_exception_name = 'ActionController::InvalidAuthenticityToken'
-
-        whisper = Whisperer.apply_appfirewall(
-          @agent_ptr,
-          meta_data
-        )
-        expect(whisper).to eq(
-          {
-            'apply_response' => [
-              {
-                'detection_point' => 'xss',
-                'method' => 'GET',
-                'parameter' => 'xss_param',
-                'uri' => 'http://192.168.1.1/some/path?xss_param=',
-                'remote_address' => '192.168.1.1',
-                'route_id' => '12345',
-                'session_id' => 'session_id',
-                'user_id' => 'user_id',
-                'pattern' => 'tc-xss-1',
-                'meta' => { 'l' => 'query', 'h' => [], 'num_headers' => 0, 'summary' => [] }
-              },
-              {
-                'detection_point' => 'exsql',
-                'method' => 'GET',
-                'parameter' => 'OperationalError',
-                'uri' => 'http://192.168.1.1/some/path?xss_param=',
-                'remote_address' => '192.168.1.1',
-                'route_id' => '12345',
-                'session_id' => 'session_id',
-                'user_id' => 'user_id'
-              },
-              {
-                'detection_point' => 'excsrf',
-                'method' => 'GET',
-                'parameter' => 'ActionController::InvalidAuthenticityToken',
-                'uri' => 'http://192.168.1.1/some/path?xss_param=',
-                'remote_address' => '192.168.1.1',
-                'route_id' => '12345',
-                'session_id' => 'session_id',
-                'user_id' => 'user_id'
-              }
-            ]
-          }
-        )
-      end
-
-      it 'should return patches blocking' do
-        meta_data = TCellAgent::MetaData.new(
-          'GET',
-          '192.168.1.1',
-          '12345',
-          'session_id',
-          'user_id',
-          'transaction_id',
-          'http://192.168.1.1/some/path?xss_param=<script>'
-        )
-        meta_data.path = '/some/path'
-        meta_data.request_content_bytes_len = 1024
-        meta_data.get_dict = { 'xss_param' => '<script>' }
-        whisper = Whisperer.apply_patches(
-          @agent_ptr,
-          meta_data
-        )
-        expect(whisper).to eq(
-          {
-            'apply_response' => {
-              'status' => 'Blocked',
-              'patches_policy_id' => 'patches-v1-14',
-              'rule_id' => 'check-present-rule',
-              'regex_pid' => 'regex-policy-id',
-              'payload' => [
-                { 'l' => 'query', 'name' => 'xss_param', 'val' => '<script>' }
-              ]
-            }
-          }
-        )
-      end
-    end
-  end
-end