torusguard 1.0.0 → 1.3.1

package/.torusguard/scripts/diff_guard.py

@@ -15,12 +15,39 @@ from pathlib import Path
 from typing import Dict, List, Any, Optional
 
 BYPASS_PATTERNS = [
-    (re.compile(r'(?:#|//)\s*(?:TODO\s*:?\s*)?(?:bypass|skip|disable)[_\s]*(?:auth|security|check|guard|filter|csrf|tenant)', re.IGNORECASE), "Suspicious authentication or security check bypass comment"),
+    (re.compile(r'(?:#|//|/\*)\s*(?:TODO\s*:?\s*)?(?:bypass|skip|disable)[_\s]*(?:auth|security|check|guard|filter|csrf|tenant)', re.IGNORECASE), "Suspicious authentication or security check bypass comment"),
+    # TLS / Certificate validation bypasses across Python, Go, Node, Java, C#, PHP, Rust
     (re.compile(r'\bverify\s*=\s*False\b'), "Disabled TLS certificate verification (verify=False)"),
+    (re.compile(r'\bInsecureSkipVerify\s*:\s*true\b'), "Disabled Go TLS certificate verification (InsecureSkipVerify: true)"),
+    (re.compile(r'\bNODE_TLS_REJECT_UNAUTHORIZED\s*=\s*[\'"]?0[\'"]?'), "Disabled Node.js TLS verification (NODE_TLS_REJECT_UNAUTHORIZED=0)"),
+    (re.compile(r'\brejectUnauthorized\s*:\s*false\b'), "Disabled Node.js TLS rejectUnauthorized"),
+    (re.compile(r'\b(?:TrustAllStrategy|NoopHostnameVerifier|DangerousAcceptAnyServerCertificateValidator)\b'), "Disabled Java / C# TLS certificate validation"),
+    (re.compile(r'\bServerCertificateCustomValidationCallback\s*=\s*(?:\([^)]*\)\s*=>\s*true|HttpClientHandler\.DangerousAcceptAnyServerCertificateValidator)'), "Disabled C# TLS certificate callback"),
+    (re.compile(r'\bCURLOPT_SSL_VERIFYPEER\s*(?:=>|,)\s*(?:false|0)\b', re.IGNORECASE), "Disabled PHP curl SSL verification (CURLOPT_SSL_VERIFYPEER => false)"),
+    (re.compile(r'\bdanger_accept_invalid_certs\s*\(\s*true\s*\)'), "Disabled Rust reqwest TLS certificate validation"),
+    # Auth & CSRF bypasses
     (re.compile(r'\b(?:skip_auth|bypass_auth|disable_auth|allow_all|permit_all)\s*=\s*True\b', re.IGNORECASE), "Explicit security bypass flag enabled"),
     (re.compile(r'@(?:csrf_exempt|allow_anonymous|disable_token_check)\b'), "Decorator disabling route-level security or CSRF protection"),
+    (re.compile(r'\[(?:AllowAnonymous|Authorize\s*\(\s*Roles\s*=\s*"\*"\s*\))\]'), "Attribute disabling ASP.NET authentication or authorization"),
+    (re.compile(r'\.csrf\(\)\.disable\(\)|\.csrf\([^)]*AbstractHttpConfigurer::disable\)'), "Spring Security CSRF protection explicitly disabled"),
+    # CORS wildcard with credentials
     (re.compile(r'\bCORS_ALLOW_ALL_ORIGINS\s*=\s*True\b'), "Wildcard CORS origin enabled in patch"),
-    (re.compile(r'(?:#|//)\s*nosec\b', re.IGNORECASE), "Suppression comment (nosec) hiding potential vulnerability")
+    (re.compile(r'@CrossOrigin\s*\(\s*(?:origins\s*=\s*)?["\']\*["\']'), "Wildcard CORS origin annotation in Java/Spring"),
+    # Native dangerous constructs
+    (re.compile(r'\bextract\s*\(\s*\$_(?:POST|GET|REQUEST)\s*\)'), "Dangerous PHP extract() on untrusted user input"),
+    (re.compile(r'\bunsafe\s*\{'), "Unvetted Rust unsafe block introduced in patch"),
+    # Polyglot additional security bypasses (Python, Ruby, Java, Kotlin, Elixir, Dart, C++)
+    (re.compile(r'\bSESSION_COOKIE_SECURE\s*=\s*False\b'), "Session cookie secure flag disabled"),
+    (re.compile(r'\bparams\.permit!'), "Rails strong parameters mass assignment bypass (params.permit!)"),
+    (re.compile(r'\b(?:csrf(?:\(\))?\.disable\(\)|\.csrf\(\)\.disable\(\)|\.csrf\([^)]*AbstractHttpConfigurer::disable\))'), "CSRF protection explicitly disabled"),
+    (re.compile(r'\b(?:verify_peer\s*:\s*false|verify\s*:\s*:verify_none)\b'), "Disabled Elixir TLS certificate verification"),
+    (re.compile(r'\bbadCertificateCallback\s*='), "Disabled Dart/Flutter badCertificateCallback validation"),
+    (re.compile(r'\bSSL_VERIFY_NONE\b'), "Disabled C/C++ OpenSSL certificate verification (SSL_VERIFY_NONE)"),
+    (re.compile(r'\bpermitAll\(\)'), "Unrestricted access granted via permitAll()"),
+    (re.compile(r'\bverify\s*(?:=>|=)\s*false\b', re.IGNORECASE), "Disabled TLS/HTTP client verification (verify => false)"),
+    # Linters and scanners suppressions
+    (re.compile(r'(?:#|//|/\*)\s*nosec\b', re.IGNORECASE), "Suppression comment (nosec) hiding potential vulnerability"),
+    (re.compile(r'@SuppressWarnings\s*\(\s*["\'](?:security|all)["\']\s*\)'), "Java security suppression annotation")
 ]
 
 SECRET_PATTERNS = [
@@ -35,7 +62,10 @@ TENANT_FILTER_PATTERNS = [
     re.compile(r'\.filter\([^)]*\btenant\s*='),
     re.compile(r'\.filter_by\([^)]*\btenant\s*='),
     re.compile(r'\bwhere\s+tenant_id\s*='),
-    re.compile(r'\btenant_id\s*==?')
+    re.compile(r'\btenant_id\s*==?'),
+    re.compile(r'\btenantId\s*:'),
+    re.compile(r'\.Where\([^)]*(?:tenant_id|TenantId)'),
+    re.compile(r'\bwhere\s*:\s*\{[^}]*tenant')
 ]
 
 
@@ -87,6 +117,50 @@ def check_memory_regressions(
     return violations
 
 
+def is_exempt_diff_path(file_path: Optional[str]) -> bool:
+    """
+    Detects whether a file path is exempt from diff guard checks.
+    Documentation, rule manifests, AI editor prompts, test fixtures, and scanner
+    definitions are exempt to prevent false alarms on security instructions and mock data.
+    """
+    if not file_path:
+        return False
+    clean = file_path.replace("\\", "/").lower().strip()
+    if clean in ("unknown", "", "none"):
+        return False
+
+    # Documentation, changelogs, markdown, plain text
+    if clean.endswith((".md", ".txt", ".rst", ".jsonl")):
+        return True
+
+    # AI editor prompt and rule instruction files
+    if clean.endswith((".cursorrules", ".windsurfrules")) or clean in ("claude.md", "agents.md"):
+        return True
+    if ".agent/rules" in clean or ".cursor/rules" in clean:
+        return True
+
+    # Security rule catalog, schemas, and cryptographic manifests
+    if "/rules/" in clean or clean.startswith("rules/") or "/schemas/" in clean or clean.startswith("schemas/"):
+        return True
+    if clean.endswith((".schema.json", ".manifest.json")):
+        return True
+
+    # Test fixtures, test suites, mocks, and test harness
+    test_markers = [
+        "/test/", "/tests/", "/spec/", "/specs/", "/fixtures/", "/mock/", "/mocks/",
+        "/e2e/", "__tests__", "test_", "_test.", ".test.", ".spec.", "testcase",
+        "harness/"
+    ]
+    if any(m in clean for m in test_markers) or clean.endswith(("_test.go", "test.java", "test.py", ".spec.ts", ".test.ts", ".spec.js", ".test.js")):
+        return True
+
+    # TorusGuard security engine scripts that define scanner regexes / templates
+    if ("/scripts/" in clean or clean.startswith("scripts/")) and any(s in clean for s in ("diff_guard", "harden_runner", "finding_scorer", "rules_sync", "memory_engine", "audit_runner", "apply_runner", "recheck_runner", "manifest_builder")):
+        return True
+
+    return False
+
+
 def audit_diff(
     diff_content: str,
     check_memory: bool = False,
@@ -103,7 +177,7 @@ def audit_diff(
     current_line = 0
 
     additions: List[tuple[int, str]] = []
-    deletions: List[tuple[int, str]] = []
+    deletions: List[tuple[str, int, str]] = []
 
     for line_idx, line in enumerate(lines, 1):
         if line.startswith('+++ b/'):
@@ -123,6 +197,9 @@ def audit_diff(
             added_content = line[1:]
             additions.append((current_line, added_content))
 
+            if is_exempt_diff_path(current_file):
+                continue
+
             # Check bypass patterns
             for pat, desc in BYPASS_PATTERNS:
                 if pat.search(added_content):
@@ -156,10 +233,11 @@ def audit_diff(
 
         elif line.startswith('-') and not line.startswith('---'):
             deleted_content = line[1:]
-            deletions.append((line_idx, deleted_content))
+            if not is_exempt_diff_path(current_file):
+                deletions.append((current_file, line_idx, deleted_content))
 
     # Check for tenant filter deletion without replacement
-    for del_idx, del_line in deletions:
+    for del_file, del_idx, del_line in deletions:
         for t_pat in TENANT_FILTER_PATTERNS:
             if t_pat.search(del_line):
                 # Verify if an equivalent tenant filter exists in additions
@@ -169,7 +247,7 @@ def audit_diff(
                         "rule_id": "TG-DIFF-003",
                         "category": "Tenant Filter Removal",
                         "severity": "HIGH",
-                        "file": current_file,
+                        "file": del_file,
                         "line": del_idx,
                         "content": del_line.strip(),
                         "description": "Tenant isolation filter was removed without being restored in additions"
@@ -198,14 +276,110 @@ def audit_diff_file(file_path: str, check_memory: bool = False, root_dir: Option
     return audit_diff(content, check_memory=check_memory, root_dir=root_dir)
 
 
+def check_diff_content(diff_content: str, file_path: str = "") -> List[Dict[str, Any]]:
+    """Convenience helper to audit diff string directly and return list of violations."""
+    res = audit_diff(diff_content)
+    return res.get("violations", [])
+
+
+def install_pre_commit_hook(root_dir: Optional[Path] = None) -> bool:
+    """Install TorusGuard pre-commit security hook into .git/hooks/pre-commit."""
+    base = Path(root_dir or Path.cwd()).resolve()
+    git_dir = base / ".git"
+    if not git_dir.exists():
+        for parent in base.parents:
+            if (parent / ".git").exists():
+                git_dir = parent / ".git"
+                break
+    if not git_dir.exists():
+        print("[ERROR] Diff Guard: Not a git repository (no .git directory found).", file=sys.stderr)
+        return False
+
+    hooks_dir = git_dir / "hooks"
+    hooks_dir.mkdir(parents=True, exist_ok=True)
+    hook_file = hooks_dir / "pre-commit"
+
+    hook_script = """#!/usr/bin/env sh
+# TorusGuard Pre-Commit Security Diff Guard
+# Automatically blocks commits containing security bypasses, secret leaks, or tenant stripping.
+python .torusguard/scripts/diff_guard.py --pre-commit
+"""
+    try:
+        hook_file.write_text(hook_script, encoding="utf-8")
+        if os.name != "nt":
+            import stat
+            os.chmod(hook_file, hook_file.stat().st_mode | stat.S_IXUSR | stat.S_IXGRP | stat.S_IXOTH)
+        print(f"[SUCCESS] Installed TorusGuard pre-commit hook at: {hook_file}")
+        return True
+    except Exception as e:
+        print(f"[ERROR] Diff Guard: Failed to install pre-commit hook: {e}", file=sys.stderr)
+        return False
+
+
+def uninstall_pre_commit_hook(root_dir: Optional[Path] = None) -> bool:
+    """Uninstall TorusGuard pre-commit hook from .git/hooks/pre-commit."""
+    base = Path(root_dir or Path.cwd()).resolve()
+    git_dir = base / ".git"
+    if not git_dir.exists():
+        for parent in base.parents:
+            if (parent / ".git").exists():
+                git_dir = parent / ".git"
+                break
+    if not git_dir.exists():
+        print("[WARN] Diff Guard: No .git directory found.", file=sys.stderr)
+        return False
+
+    hook_file = git_dir / "hooks" / "pre-commit"
+    if hook_file.exists():
+        try:
+            hook_file.unlink()
+            print("[SUCCESS] Uninstalled TorusGuard pre-commit hook.")
+            return True
+        except Exception as e:
+            print(f"[ERROR] Diff Guard: Failed to delete hook file: {e}", file=sys.stderr)
+            return False
+    else:
+        print("[INFO] Diff Guard: No pre-commit hook currently installed.")
+        return True
+
+
 def main():
     parser = argparse.ArgumentParser(description="TorusGuard Unified Diff Security Scanner")
     parser.add_argument("diff_path", nargs="?", help="Path to unified diff file (or read stdin if omitted)")
     parser.add_argument("--check-memory", action="store_true", help="Check additions against persistent memory regression watch patterns")
+    parser.add_argument("--pre-commit", action="store_true", help="Audit git staged diff (--cached) for pre-commit hook")
+    parser.add_argument("--install-hook", action="store_true", help="Install TorusGuard pre-commit hook into .git/hooks/pre-commit")
+    parser.add_argument("--uninstall-hook", action="store_true", help="Uninstall TorusGuard pre-commit hook")
     parser.add_argument("--json", action="store_true", help="Output results as JSON")
     args = parser.parse_args()
 
-    if args.diff_path:
+    if args.install_hook:
+        sys.exit(0 if install_pre_commit_hook() else 1)
+
+    if args.uninstall_hook:
+        sys.exit(0 if uninstall_pre_commit_hook() else 1)
+
+    if args.pre_commit:
+        import subprocess
+        try:
+            res_git = subprocess.run(
+                ["git", "diff", "--cached"],
+                capture_output=True,
+                text=True,
+                encoding="utf-8",
+                errors="replace"
+            )
+            diff_text = res_git.stdout
+        except Exception as e:
+            print(f"[ERROR] Diff Guard: Could not read git staged diff: {e}", file=sys.stderr)
+            sys.exit(1)
+
+        if not diff_text.strip():
+            print("[PASS] Diff Guard (pre-commit): No staged changes detected.")
+            sys.exit(0)
+
+        res = audit_diff(diff_text, check_memory=True)
+    elif args.diff_path:
         res = audit_diff_file(args.diff_path, check_memory=args.check_memory)
     else:
         if sys.stdin.isatty():
@@ -229,3 +403,4 @@ def main():
 
 if __name__ == "__main__":
     main()
+

package/.torusguard/scripts/finding_scorer.py

@@ -44,11 +44,13 @@ def compute_memory_boost(
     try:
         with open(patterns_file, "r", encoding="utf-8") as f:
             patterns = json.load(f)
-    except Exception:
+    except (json.JSONDecodeError, OSError, UnicodeDecodeError):
         return 0
 
     boost = 0
     matched_file = False
+    matched_dir = False
+    target_path = Path(file_path) if file_path else None
 
     for pat in patterns:
         if pat.get("rule_id") == rule_id:
@@ -62,18 +64,37 @@ def compute_memory_boost(
             elif ptype == "security_idiom":
                 boost += 5
 
-            # File-specific correlation bonus
-            if file_path and file_path in pat.get("affected_files", []):
+            # File-specific and directory-level correlation bonus
+            affected = pat.get("affected_files", [])
+            if file_path and file_path in affected:
                 matched_file = True
+            elif target_path and any(target_path.parent == Path(af).parent for af in affected if af):
+                matched_dir = True
 
     if matched_file and boost > 0:
         boost += 5
     elif matched_file and boost < 0:
         boost -= 10
+    elif matched_dir and boost > 0:
+        boost += 2
+    elif matched_dir and boost < 0:
+        boost -= 4
 
     return boost
 
 
+def is_test_path(file_path: Optional[str]) -> bool:
+    """Detects whether a file path belongs to a test suite, fixture, or mock."""
+    if not file_path:
+        return False
+    clean = file_path.replace("\\", "/").lower()
+    test_markers = [
+        "/test/", "/tests/", "/spec/", "/specs/", "/fixtures/", "/mock/", "/mocks/",
+        "/e2e/", "__tests__", "test_", "_test.", ".test.", ".spec.", "testcase"
+    ]
+    return any(marker in clean for marker in test_markers) or clean.endswith(("_test.go", "test.java", "test.py", ".spec.ts", ".test.ts", ".spec.js", ".test.js"))
+
+
 def compute_confidence_score(
     evidence_quality: int = 35,
     reproduction_success: int = 0,
@@ -84,7 +105,7 @@ def compute_confidence_score(
     rule_id: Optional[str] = None,
     file_path: Optional[str] = None,
     root_dir: Optional[Path] = None
-) -> Tuple[int, str, Dict[str, int]]:
+) -> Tuple[int, str, Dict[str, Any]]:
     """
     Computes total score and assigns confidence band.
     Max points:
@@ -94,6 +115,7 @@ def compute_confidence_score(
     - environmental_clarity: 15
     - manual_review_status: 10
     - memory_boost: -30 to +20 (modifier from persistent memory)
+    - test_deduction: -30 if file is located in a test/mock path
     Total is clamped to [0, 100].
     """
     eq = min(max(evidence_quality, 0), 35)
@@ -107,7 +129,11 @@ def compute_confidence_score(
     if rule_id and eff_mem_boost == 0:
         eff_mem_boost = compute_memory_boost(rule_id, file_path=file_path, root_dir=root_dir)
 
-    raw_total = eq + rs + ic + ec + mr + eff_mem_boost
+    # Test path noise suppression: -30 deduction for test mocks/fixtures
+    is_test = is_test_path(file_path)
+    test_deduction = -30 if is_test else 0
+
+    raw_total = eq + rs + ic + ec + mr + eff_mem_boost + test_deduction
     total = min(max(raw_total, 0), 100)
 
     if total >= 90:
@@ -126,6 +152,8 @@ def compute_confidence_score(
         "environmental_clarity": ec,
         "manual_review_status": mr,
         "memory_boost": eff_mem_boost,
+        "test_exemption": is_test,
+        "test_deduction": test_deduction,
         "total_score": total,
         "classification_band": band
     }
@@ -134,6 +162,8 @@ def compute_confidence_score(
 
 def main():
     parser = argparse.ArgumentParser(description="TorusGuard Confidence Scorer")
+    parser.add_argument("--dir", type=str, help="Target project root directory to scan and score")
+    parser.add_argument("--run", type=str, help="Path to run directory to evaluate/score")
     parser.add_argument("--eq", type=int, default=35, help="Evidence quality score (0-35)")
     parser.add_argument("--rs", type=int, default=0, help="Reproduction success score (0-25)")
     parser.add_argument("--ic", type=int, default=5, help="Independent confirmations score (0-15)")
@@ -145,6 +175,62 @@ def main():
     parser.add_argument("--json", action="store_true", help="Output JSON")
     args = parser.parse_args()
 
+    # Bridge: when --dir is provided, delegate to audit_runner
+    if args.dir:
+        scripts_dir = Path(__file__).resolve().parent
+        if str(scripts_dir) not in sys.path:
+            sys.path.insert(0, str(scripts_dir))
+        try:
+            import audit_runner
+            res = audit_runner.execute_audit(Path(args.dir), json_output=args.json)
+            sys.exit(0 if res.get("critical_count", 0) == 0 else 1)
+        except Exception as e:
+            print(f"[ERROR] Finding Scorer: Failed to run audit on {args.dir}: {e}", file=sys.stderr)
+            sys.exit(1)
+
+    # Bridge: when --run is provided, score findings in run folder
+    if args.run:
+        run_p = Path(args.run).resolve()
+        f_file = run_p / "findings.json"
+        if not f_file.is_file():
+            print(f"[ERROR] Run findings not found at: {f_file}", file=sys.stderr)
+            sys.exit(1)
+        try:
+            with open(f_file, "r", encoding="utf-8") as f:
+                findings_data = json.load(f)
+        except Exception as e:
+            print(f"[ERROR] Malformed findings JSON: {e}", file=sys.stderr)
+            sys.exit(1)
+
+        total_score = 0
+        scored_items = []
+        for item in findings_data:
+            s, b, factors = compute_confidence_score(
+                evidence_quality=item.get("evidence_quality", 35),
+                reproduction_success=item.get("reproduction_success", 0),
+                independent_confirmations=item.get("independent_confirmations", 5),
+                environmental_clarity=item.get("environmental_clarity", 15),
+                manual_review_status=item.get("manual_review_status", 0),
+                rule_id=item.get("rule_id"),
+                file_path=item.get("file_path")
+            )
+            item["confidence_score"] = s
+            item["confidence_band"] = b
+            item["confidence_factors"] = factors
+            scored_items.append(item)
+            total_score += s
+
+        avg_score = int(total_score / max(1, len(scored_items)))
+        with open(f_file, "w", encoding="utf-8") as f:
+            json.dump(scored_items, f, indent=2)
+
+        if args.json:
+            print(json.dumps({"run": str(run_p), "findings_count": len(scored_items), "average_confidence": avg_score}, indent=2))
+        else:
+            print(f"[SUCCESS] Scored {len(scored_items)} findings in {run_p.name}")
+            print(f"Average Confidence: {avg_score}/100")
+        sys.exit(0)
+
     total, band, factors = compute_confidence_score(
         evidence_quality=args.eq,
         reproduction_success=args.rs,