torusguard 1.0.0 → 1.3.1

package/skills/torusguard/payload/rules/ssrf/TG-SSRF-004-unbounded-outbound-request.md

@@ -0,0 +1,37 @@
+# TG-SSRF-004: Unbounded Outbound Request
+
+## Severity
+High by default. Raise to Critical when applicable.
+
+## Applies To
+- Relevant endpoints and services
+
+## Why It Matters
+Explaining the risk of this vulnerability.
+
+## What TorusGuard Looks For
+- Specific code patterns or configurations
+
+## Unsafe Example
+```javascript
+// Unsafe code example
+```
+
+## Safe Example
+```javascript
+// Safe code example
+```
+
+## Remediation
+1. Step one
+2. Step two
+
+## Verification
+- Test case 1
+- Test case 2
+
+## False Positives and Exceptions
+An exception requires documented review.
+
+## Related Rules
+- TG-OTHER-001

package/skills/torusguard/payload/rules/supply-chain/TG-SUPPLY-001-missing-or-ignored-dependency-lockfile.md

@@ -0,0 +1,37 @@
+# TG-SUPPLY-001: Missing or Ignored Dependency Lockfile
+
+## Severity
+High by default. Raise to Critical when applicable.
+
+## Applies To
+- Relevant endpoints and services
+
+## Why It Matters
+Explaining the risk of this vulnerability.
+
+## What TorusGuard Looks For
+- Specific code patterns or configurations
+
+## Unsafe Example
+```javascript
+// Unsafe code example
+```
+
+## Safe Example
+```javascript
+// Safe code example
+```
+
+## Remediation
+1. Step one
+2. Step two
+
+## Verification
+- Test case 1
+- Test case 2
+
+## False Positives and Exceptions
+An exception requires documented review.
+
+## Related Rules
+- TG-OTHER-001

package/skills/torusguard/payload/rules/supply-chain/TG-SUPPLY-002-vulnerable-dependency-review-missing.md

@@ -0,0 +1,94 @@
+# TG-SUPPLY-002: Vulnerable Dependency Review Missing
+
+## Severity
+High by default. Escalate to Critical when dependencies with known, weaponized remote code execution (RCE) or authentication bypass CVEs are identified.
+
+## Applies To
+- Node.js / JavaScript / TypeScript (`package.json`, `package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`)
+- Python (`requirements.txt`, `pyproject.toml`, `Pipfile.lock`, `poetry.lock`)
+
+## Why It Matters
+Using third-party open-source packages with known security vulnerabilities exposes production web applications to automated supply-chain exploits, supply-chain poisoning, prototype pollution, cross-site scripting (XSS), and arbitrary code execution.
+
+However, **automated bulk repair commands like `npm audit fix --force` introduce severe supply-chain regression hazards**:
+- `npm audit fix --force` blindly upgrades packages across **major breaking version jumps** (e.g., Express 4 $\rightarrow$ 5, MongoDB Driver v2 $\rightarrow$ v6, Webpack 4 $\rightarrow$ 5).
+- These breaking API changes break production routing, change database connection options, and crash running services.
+- Remediation must be deliberate, selective, and verified through regression suites.
+
+## What TorusGuard Looks For
+1. Unpinned dependency versions or wildcards (`*`, `latest`) in manifests.
+2. Missing automated vulnerability auditing steps (`npm audit`, `pip-audit`) in CI/CD workflows.
+3. Automated fix scripts executing blind `--force` flags without test gates.
+4. Dependencies flagged with CVEs exceeding acceptable severity thresholds.
+
+## Unsafe Example
+```bash
+# UNSAFE: Blind automated fix forcing breaking major version upgrades
+npm audit fix --force
+```
+
+```json
+// UNSAFE: package.json with floating wildcard versions
+{
+  "dependencies": {
+    "express": "*",
+    "jsonwebtoken": "^8.0.0"
+  },
+  "scripts": {
+    "audit-fix": "npm audit fix --force"
+  }
+}
+```
+
+## Safe Example
+```bash
+# SAFE: Apply non-breaking minor and patch fixes only
+npm audit fix
+
+# For dependencies requiring major version bumps to patch CVEs:
+# 1. Inspect breaking changes manually:
+npm audit --json
+
+# 2. Upgrade specific package selectively:
+npm install jsonwebtoken@9.0.2
+
+# 3. Execute regression test suite before merging:
+npm test
+```
+
+```yaml
+# SAFE: Continuous vulnerability scanning in CI workflow (.github/workflows/security.yml)
+name: Dependency Security Audit
+on: [push, pull_request]
+
+jobs:
+  audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Run Node Dependency Audit
+        run: npm audit --audit-level=high
+      - name: Run Python Dependency Audit
+        run: |
+          pip install pip-audit
+          pip-audit -r requirements.txt --strict
+```
+
+## Remediation
+1. **Never use `--force` in CI or production maintenance scripts:** Restrict automated remediation to `npm audit fix` (non-breaking minor/patch updates).
+2. **Selective Major Upgrades:** For vulnerabilities that require a major version jump, consult the upstream CHANGELOG, evaluate breaking API changes, and upgrade the single package explicitly.
+3. **Pin Exact Versions or Use Lockfiles:** Commit reproducible lockfiles (`package-lock.json`, `poetry.lock`, `requirements.txt`) to source control.
+4. **Automate in CI:** Integrate `npm audit` or `pip-audit` as a blocking pull request check for High and Critical severities.
+
+## Verification
+- Run `npm audit` or `pip-audit` to confirm zero High/Critical unhandled CVEs.
+- Confirm all existing unit and integration tests pass after any dependency update.
+- Verify that `package-lock.json` changes reflect only intended, targeted packages.
+
+## False Positives and Exceptions
+- Vulnerabilities located solely in development dependencies (`devDependencies`, e.g., local build tools, linters) that are never bundled into client or server production environments may be exempted with documented risk acceptance.
+
+## Related Rules
+- `TG-SUPPLY-001`: Pinned Dependency Version Missing
+- `TG-SUPPLY-003`: Container Build Secret Persistence
+- `TG-SEC-001`: Hardcoded Secrets in Manifests

package/skills/torusguard/payload/rules/supply-chain/TG-SUPPLY-003-unsafe-ci-cd-secret-exposure.md

@@ -0,0 +1,37 @@
+# TG-SUPPLY-003: Unsafe CI/CD Secret Exposure
+
+## Severity
+High by default. Raise to Critical when applicable.
+
+## Applies To
+- Relevant endpoints and services
+
+## Why It Matters
+Explaining the risk of this vulnerability.
+
+## What TorusGuard Looks For
+- Specific code patterns or configurations
+
+## Unsafe Example
+```javascript
+// Unsafe code example
+```
+
+## Safe Example
+```javascript
+// Safe code example
+```
+
+## Remediation
+1. Step one
+2. Step two
+
+## Verification
+- Test case 1
+- Test case 2
+
+## False Positives and Exceptions
+An exception requires documented review.
+
+## Related Rules
+- TG-OTHER-001

package/skills/torusguard/payload/rules/supply-chain/TG-SUPPLY-004-unpinned-ci-action.md

@@ -0,0 +1,37 @@
+# TG-SUPPLY-004: Unpinned CI Action
+
+## Severity
+High by default. Raise to Critical when applicable.
+
+## Applies To
+- Relevant endpoints and services
+
+## Why It Matters
+Explaining the risk of this vulnerability.
+
+## What TorusGuard Looks For
+- Specific code patterns or configurations
+
+## Unsafe Example
+```javascript
+// Unsafe code example
+```
+
+## Safe Example
+```javascript
+// Safe code example
+```
+
+## Remediation
+1. Step one
+2. Step two
+
+## Verification
+- Test case 1
+- Test case 2
+
+## False Positives and Exceptions
+An exception requires documented review.
+
+## Related Rules
+- TG-OTHER-001

package/skills/torusguard/payload/rules/supply-chain/TG-SUPPLY-005-unsafe-dependency-install-script.md

@@ -0,0 +1,37 @@
+# TG-SUPPLY-005: Unsafe Dependency Install Script
+
+## Severity
+High by default. Raise to Critical when applicable.
+
+## Applies To
+- Relevant endpoints and services
+
+## Why It Matters
+Explaining the risk of this vulnerability.
+
+## What TorusGuard Looks For
+- Specific code patterns or configurations
+
+## Unsafe Example
+```javascript
+// Unsafe code example
+```
+
+## Safe Example
+```javascript
+// Safe code example
+```
+
+## Remediation
+1. Step one
+2. Step two
+
+## Verification
+- Test case 1
+- Test case 2
+
+## False Positives and Exceptions
+An exception requires documented review.
+
+## Related Rules
+- TG-OTHER-001

package/skills/torusguard/payload/rules/supply-chain/TG-SUPPLY-006-container-build-secret-persistence.md

@@ -0,0 +1,61 @@
+# TG-SUPPLY-006: Container Build Secret Persistence
+
+## Severity
+High. Embedding credentials, tokens, or private SSH keys into intermediate container build layers exposes secrets in public registry images.
+
+## Applies To
+- Dockerfiles, Containerfile, Docker Compose
+- CI/CD Container Build Pipelines
+
+## Why It Matters
+When `ARG`, `ENV`, or `COPY` directives are used to pass secrets into Docker builds:
+1. Every Docker layer is cached and preserved in the final image manifest.
+2. Even if a subsequent `RUN rm -rf /root/.ssh` is executed, the file remains fully recoverable using container layer extractors (`dive`, `docker history`).
+3. Deploying the image to public or shared registries inadvertently leaks production credentials.
+
+## What TorusGuard Looks For
+1. `ARG` or `ENV` variables with names matching `TOKEN`, `KEY`, `PASSWORD`, `SECRET`.
+2. Direct `COPY` of private SSH keys (`id_rsa`), `.env` files, or npm tokens (`.npmrc`) into build images.
+3. Multi-stage builds copying secret artifacts from builder stages without BuildKit secret mounts.
+
+## Unsafe Example
+```dockerfile
+# UNSAFE: Passing GitHub token via build-arg leaves it in layer metadata
+FROM node:20-alpine
+ARG GITHUB_TOKEN
+ENV GITHUB_TOKEN=$GITHUB_TOKEN
+
+# Secrets remain in image history forever!
+RUN npm install
+```
+
+## Safe Example
+```dockerfile
+# SAFE: Using BuildKit secret mounts (never persisted to image layers)
+# syntax=docker/dockerfile:1.4
+FROM node:20-alpine AS builder
+
+WORKDIR /app
+COPY package*.json ./
+
+# Secret is mounted ephemerally in RAM during the command and never written to disk
+RUN --mount=type=secret,id=npmrc,target=/root/.npmrc \
+    npm ci --only=production
+
+FROM node:20-alpine AS runner
+WORKDIR /app
+COPY --from=builder /app/node_modules ./node_modules
+COPY . .
+
+USER node
+CMD ["node", "server.js"]
+```
+
+## Remediation
+1. **Use BuildKit Secret Mounts:** Replace `ARG` secrets with `RUN --mount=type=secret,id=my_secret`.
+2. **Multi-Stage Clean Separation:** Compile code in an unprivileged builder stage and copy strictly compiled runtime artifacts to the runner image.
+3. **Use `.dockerignore`:** Exclude `.env`, `.git`, `.npmrc`, and credentials from build context.
+
+## Related Rules
+- `TG-SEC-001`: Hardcoded Secrets
+- `TG-SUPPLY-002`: Vulnerable Dependency Review Missing

package/skills/torusguard/payload/rules/webhook/TG-WEBHOOK-001-missing-webhook-signature-verification.md

@@ -0,0 +1,37 @@
+# TG-WEBHOOK-001: Missing Webhook Signature Verification
+
+## Severity
+High by default. Raise to Critical when applicable.
+
+## Applies To
+- Relevant endpoints and services
+
+## Why It Matters
+Explaining the risk of this vulnerability.
+
+## What TorusGuard Looks For
+- Specific code patterns or configurations
+
+## Unsafe Example
+```javascript
+// Unsafe code example
+```
+
+## Safe Example
+```javascript
+// Safe code example
+```
+
+## Remediation
+1. Step one
+2. Step two
+
+## Verification
+- Test case 1
+- Test case 2
+
+## False Positives and Exceptions
+An exception requires documented review.
+
+## Related Rules
+- TG-OTHER-001

package/skills/torusguard/payload/rules/webhook/TG-WEBHOOK-002-replayable-webhook.md

@@ -0,0 +1,37 @@
+# TG-WEBHOOK-002: Replayable Webhook
+
+## Severity
+High by default. Raise to Critical when applicable.
+
+## Applies To
+- Relevant endpoints and services
+
+## Why It Matters
+Explaining the risk of this vulnerability.
+
+## What TorusGuard Looks For
+- Specific code patterns or configurations
+
+## Unsafe Example
+```javascript
+// Unsafe code example
+```
+
+## Safe Example
+```javascript
+// Safe code example
+```
+
+## Remediation
+1. Step one
+2. Step two
+
+## Verification
+- Test case 1
+- Test case 2
+
+## False Positives and Exceptions
+An exception requires documented review.
+
+## Related Rules
+- TG-OTHER-001

package/skills/torusguard/payload/rules/webhook/TG-WEBHOOK-003-missing-webhook-idempotency.md

@@ -0,0 +1,37 @@
+# TG-WEBHOOK-003: Missing Webhook Idempotency
+
+## Severity
+High by default. Raise to Critical when applicable.
+
+## Applies To
+- Relevant endpoints and services
+
+## Why It Matters
+Explaining the risk of this vulnerability.
+
+## What TorusGuard Looks For
+- Specific code patterns or configurations
+
+## Unsafe Example
+```javascript
+// Unsafe code example
+```
+
+## Safe Example
+```javascript
+// Safe code example
+```
+
+## Remediation
+1. Step one
+2. Step two
+
+## Verification
+- Test case 1
+- Test case 2
+
+## False Positives and Exceptions
+An exception requires documented review.
+
+## Related Rules
+- TG-OTHER-001

package/skills/torusguard/payload/rules/webhook/TG-WEBHOOK-004-unvalidated-webhook-event-type.md

@@ -0,0 +1,37 @@
+# TG-WEBHOOK-004: Unvalidated Webhook Event Type
+
+## Severity
+High by default. Raise to Critical when applicable.
+
+## Applies To
+- Relevant endpoints and services
+
+## Why It Matters
+Explaining the risk of this vulnerability.
+
+## What TorusGuard Looks For
+- Specific code patterns or configurations
+
+## Unsafe Example
+```javascript
+// Unsafe code example
+```
+
+## Safe Example
+```javascript
+// Safe code example
+```
+
+## Remediation
+1. Step one
+2. Step two
+
+## Verification
+- Test case 1
+- Test case 2
+
+## False Positives and Exceptions
+An exception requires documented review.
+
+## Related Rules
+- TG-OTHER-001

package/skills/torusguard/payload/rules/websocket/TG-WS-001-unauthenticated-websocket-handshake.md

@@ -0,0 +1,82 @@
+# TG-WS-001: Unauthenticated WebSocket Handshake
+
+## Severity
+High. Accepting WebSocket upgrade handshakes without validating authentication cookies or Bearer tokens allows unauthenticated clients to establish persistent sockets and consume server resources.
+
+## Applies To
+- `ws`, `Socket.io`, `fastapi.WebSocket`, `channels` (Django), `aiohttp`
+
+## Why It Matters
+HTTP WebSocket upgrades (`Upgrade: websocket`) begin as standard HTTP requests. If authentication is omitted during the initial HTTP upgrade:
+1. Attackers can flood the server with unbounded persistent open TCP connections, exhausting socket file descriptors.
+2. If authorization is deferred to post-connect messages, unauthenticated clients can linger in memory indefinitely.
+3. Cross-site WebSocket hijacking (CSWSH) can occur if the `Origin` header is trusted blindly.
+
+## What TorusGuard Looks For
+1. WebSocket servers accepting the upgrade connection before validating session cookies, headers, or query tokens.
+2. Missing `Origin` header validation during handshake.
+3. Runtime probe: Attempting a WebSocket handshake without an `Authorization` header or session cookie; flagging if the connection status returns `101 Switching Protocols` instead of `401 Unauthorized`.
+
+## Unsafe Example
+```typescript
+// UNSAFE: Accepting WebSocket upgrade without verifying session
+import { WebSocketServer } from "ws";
+
+const wss = new WebSocketServer({ port: 8080 });
+
+wss.on("connection", (ws, req) => {
+  // Handshake already succeeded without verifying authentication!
+  ws.send("Welcome to real-time events");
+});
+```
+
+## Safe Example
+```typescript
+// SAFE: Validating authentication and origin during the HTTP upgrade
+import http from "http";
+import { WebSocketServer } from "ws";
+import { verifyJwtToken } from "./auth";
+
+const server = http.createServer();
+const wss = new WebSocketServer({ noServer: true });
+
+server.on("upgrade", (req, socket, head) => {
+  // 1. Verify Origin header
+  const origin = req.headers.origin;
+  if (origin !== "https://app.example.com") {
+    socket.write("HTTP/1.1 403 Forbidden\r\n\r\n");
+    socket.destroy();
+    return;
+  }
+
+  // 2. Authenticate token before completing WebSocket handshake
+  const token = req.headers["sec-websocket-protocol"] || req.headers.cookie;
+  const user = verifyJwtToken(token);
+  if (!user) {
+    socket.write("HTTP/1.1 401 Unauthorized\r\n\r\n");
+    socket.destroy();
+    return;
+  }
+
+  // 3. Complete upgrade only when authenticated
+  wss.handleUpgrade(req, socket, head, (ws) => {
+    wss.emit("connection", ws, req, user);
+  });
+});
+```
+
+## Bounded Runtime Probe Protocol
+When probing WebSocket endpoints under `/torusguard web-validate`:
+1. Dispatch an HTTP GET request with `Upgrade: websocket` and `Connection: Upgrade` headers **without authentication credentials**.
+2. Assert that the server returns `HTTP 401` or `HTTP 403` and terminates the socket.
+3. If the server returns `HTTP 101 Switching Protocols`, log a high-confidence finding for unauthenticated handshake.
+
+## Remediation
+1. **Authenticate on HTTP Upgrade:** Reject unauthenticated connections with standard HTTP 401/403 status codes before calling `handleUpgrade`.
+2. **Enforce Strict Origin Checking:** Validate that `req.headers.origin` matches your trusted application domain.
+3. **Set Connection Timeouts:** Automatically disconnect sockets that fail message-level handshakes within 10 seconds.
+
+## Related Rules
+- `TG-WS-002`: Missing Channel-Level Authorization
+- `TG-AUTH-004`: Insecure Session Cookie
+- `TG-RATE-003`: Unbounded Resource Consumption

package/skills/torusguard/payload/rules/websocket/TG-WS-002-missing-channel-level-authorization.md

@@ -0,0 +1,37 @@
+# TG-WS-002: Missing Channel-Level Authorization
+
+## Severity
+High by default. Raise to Critical when applicable.
+
+## Applies To
+- Relevant endpoints and services
+
+## Why It Matters
+Explaining the risk of this vulnerability.
+
+## What TorusGuard Looks For
+- Specific code patterns or configurations
+
+## Unsafe Example
+```javascript
+// Unsafe code example
+```
+
+## Safe Example
+```javascript
+// Safe code example
+```
+
+## Remediation
+1. Step one
+2. Step two
+
+## Verification
+- Test case 1
+- Test case 2
+
+## False Positives and Exceptions
+An exception requires documented review.
+
+## Related Rules
+- TG-OTHER-001

package/skills/torusguard/payload/rules/websocket/TG-WS-003-unvalidated-websocket-message.md

@@ -0,0 +1,37 @@
+# TG-WS-003: Unvalidated WebSocket Message
+
+## Severity
+High by default. Raise to Critical when applicable.
+
+## Applies To
+- Relevant endpoints and services
+
+## Why It Matters
+Explaining the risk of this vulnerability.
+
+## What TorusGuard Looks For
+- Specific code patterns or configurations
+
+## Unsafe Example
+```javascript
+// Unsafe code example
+```
+
+## Safe Example
+```javascript
+// Safe code example
+```
+
+## Remediation
+1. Step one
+2. Step two
+
+## Verification
+- Test case 1
+- Test case 2
+
+## False Positives and Exceptions
+An exception requires documented review.
+
+## Related Rules
+- TG-OTHER-001

package/skills/torusguard/payload/rules/websocket/TG-WS-004-unbounded-websocket-connections.md

@@ -0,0 +1,37 @@
+# TG-WS-004: Unbounded WebSocket Connections
+
+## Severity
+High by default. Raise to Critical when applicable.
+
+## Applies To
+- Relevant endpoints and services
+
+## Why It Matters
+Explaining the risk of this vulnerability.
+
+## What TorusGuard Looks For
+- Specific code patterns or configurations
+
+## Unsafe Example
+```javascript
+// Unsafe code example
+```
+
+## Safe Example
+```javascript
+// Safe code example
+```
+
+## Remediation
+1. Step one
+2. Step two
+
+## Verification
+- Test case 1
+- Test case 2
+
+## False Positives and Exceptions
+An exception requires documented review.
+
+## Related Rules
+- TG-OTHER-001