torusguard 1.3.0 → 1.3.1

package/.torusguard/runs/run-20260908-115240-audit/diff_summary.md

@@ -0,0 +1,221 @@
+# TorusGuard Applied Patch Summary: run-20260908-115240-audit
+
+## Applied: `[TG-DB-004]` on `harness/validate_v0_6_1_scale.py:115`
+```diff
+--- a/harness/validate_v0_6_1_scale.py
++++ b/harness/validate_v0_6_1_scale.py
+@@ -113,5 +113,5 @@
+                 "severity": "High",
+                 "target": {"file_path": "apps/django_core/billing/views.py", "line_start": 42, "line_end": 42},
+-                "evidence": {"code_snippet": "Invoice.objects.get(id=inv_id)"},
++                "evidence": {"code_snippet": "Invoice.objects.get(organization_id=request.user.organization_id, id=inv_id)"},
+             },
+             # FastAPI Microservice
+```
+
+## Applied: `[TG-DB-004]` on `harness/validate_v0_6_3_hardening.py:119`
+```diff
+--- a/harness/validate_v0_6_3_hardening.py
++++ b/harness/validate_v0_6_3_hardening.py
+@@ -117,5 +117,5 @@
+         snippet_v1 = """def process_invoice(req, inv_id):
+     # Retrieve invoice
+-    inv = Invoice.objects.get(id=inv_id)
++    inv = Invoice.objects.get(organization_id=request.user.organization_id, id=inv_id)
+     return inv
+ """
+```
+
+## Applied: `[TG-DB-004]` on `harness/validate_v1_0_0_memory.py:265`
+```diff
+--- a/harness/validate_v1_0_0_memory.py
++++ b/harness/validate_v1_0_0_memory.py
+@@ -263,5 +263,5 @@
+ -    return Bill.objects.filter(id=id, tenant=tenant)
+ +def get_bill(id):
+-+    return Bill.objects.get(id=id)
+++    return Bill.objects.get(organization_id=request.user.organization_id, id=id)
+ """
+         res_reg = diff_guard.audit_diff(regression_diff, check_memory=True, root_dir=test_root)
+```
+
+## Applied: `[TG-DB-004]` on `harness/master_validation.py:334`
+```diff
+--- a/harness/master_validation.py
++++ b/harness/master_validation.py
+@@ -332,5 +332,5 @@
+                 "severity": SeverityLevel.CRITICAL,
+                 "path": "rules/TG-DB-004-missing-tenant-query-isolation.md",
+-                "vuln_sample": "record = Invoice.objects.get(id=invoice_id)",
++                "vuln_sample": "record = Invoice.objects.get(organization_id=request.user.organization_id, id=invoice_id)",
+                 "hard_sample": "record = Invoice.objects.filter(id=invoice_id, tenant_id=request.user.tenant_id).first()",
+                 "remediation": "Enforce composite tenant scoping on every data lookup (tenant_id == current_user.tenant_id) and override DRF ViewSet get_queryset().",
+```
+
+## Applied: `[TG-DB-004]` on `harness/runner.py:503`
+```diff
+--- a/harness/runner.py
++++ b/harness/runner.py
+@@ -501,5 +501,5 @@
+ 
+             # 2. Stable Finding Identity
+-            code_a = "def view():\n    return Item.objects.get(id=id)"
++            code_a = "def view():\n    return Item.objects.get(organization_id=request.user.organization_id, id=id)"
+             code_b = "# Shifted comment\ndef view():\n    return Item.objects.get(id=id)"
+             fp1 = IdentityEngine.generate_identity("TG-DB-004", "views.py", code_a, sink_signature="Item.objects.get")
+```
+
+## Applied: `[TG-DB-004]` on `tests/test_v0_6_0_governed_remediation.py:79`
+```diff
+--- a/tests/test_v0_6_0_governed_remediation.py
++++ b/tests/test_v0_6_0_governed_remediation.py
+@@ -77,5 +77,5 @@
+         def get_invoice(request, invoice_id):
+             # Fetch invoice directly without tenant filter
+-            invoice = Invoice.objects.get(id=invoice_id)
++            invoice = Invoice.objects.get(organization_id=request.user.organization_id, id=invoice_id)
+             return JsonResponse({"id": invoice.id})
+         """
+```
+
+## Applied: `[TG-INPUT-002]` on `harness/validate_v1_1_0_advanced_memory.py:107`
+```diff
+--- a/harness/validate_v1_1_0_advanced_memory.py
++++ b/harness/validate_v1_1_0_advanced_memory.py
+@@ -105,5 +105,5 @@
+         memory_engine.ensure_memory_structure(root_dir=test_root)
+ 
+-        valid_before = "cursor.execute(f'SELECT * FROM users WHERE id = {uid}')"
++        valid_before = "cursor.execute('SELECT * FROM users WHERE id = %s')"
+         valid_after = "cursor.execute('SELECT * FROM users WHERE id = %s', (uid,))"
+         valid_diff = "- cursor.execute(f'SELECT * FROM users WHERE id = {uid}')\n+ cursor.execute('SELECT * FROM users WHERE id = %s', (uid,))"
+```
+
+## Applied: `[TG-INPUT-002]` on `harness/engine/fixture_manager.py:128`
+```diff
+--- a/harness/engine/fixture_manager.py
++++ b/harness/engine/fixture_manager.py
+@@ -126,5 +126,5 @@
+                 vulnerable_variant=FixtureVariant(
+                     relative_path="examples/python/sqlalchemy-vuln",
+-                    code_pattern="session.execute(f'SELECT * FROM items WHERE name LIKE {q}')",
++                    code_pattern="session.execute('SELECT * FROM items WHERE name LIKE %s')",
+                     expected_findings_count=4,
+                 ),
+```
+
+## Applied: `[TG-INPUT-002]` on `harness/runner.py:232`
+```diff
+--- a/harness/runner.py
++++ b/harness/runner.py
+@@ -230,5 +230,5 @@
+             type=EvidenceType.SOURCE,
+             location="views.py:15",
+-            raw_snippet="User.objects.raw(f'SELECT * FROM users WHERE name = {name}')",
++            raw_snippet="User.objects.raw('SELECT * FROM users WHERE name = %s')",
+             rationale="Direct string concatenation into SQL query.",
+             confidence_level=ConfidenceBand.CONFIRMED,
+```
+
+## Applied: `[TG-INPUT-003]` on `examples/vulnerable-react-express/client/src/App.jsx:53`
+```diff
+--- a/examples/vulnerable-react-express/client/src/App.jsx
++++ b/examples/vulnerable-react-express/client/src/App.jsx
+@@ -51,5 +51,5 @@
+ 
+       {/* TG-INPUT-003: Unsafe HTML rendering */}
+-      <div dangerouslySetInnerHTML={{ __html: bio }} />
++      <div>{bio}</div>
+ 
+       <button onClick={fetchUser}>Fetch user (IDOR demo)</button>
+```
+
+## Applied: `[TG-PLATFORM-001]` on `skills/torusguard/payload/scripts/harden_runner.py:168`
+```diff
+--- a/skills/torusguard/payload/scripts/harden_runner.py
++++ b/skills/torusguard/payload/scripts/harden_runner.py
+@@ -166,5 +166,5 @@
+     # Strategy 5: Permissive CORS with Credentials (TG-PLATFORM-001)
+     elif rule_id == "TG-PLATFORM-001":
+-        if "CORS_ALLOW_ALL_ORIGINS = True" in target_line:
++        CORS_ALLOWED_ORIGINS = [os.environ.get("ALLOWED_ORIGIN", "https://app.example.com")]
+             replacement = f'{indent}CORS_ALLOWED_ORIGINS = [os.environ.get("ALLOWED_ORIGIN", "https://app.example.com")]'
+             new_lines[line_number - 1] = replacement
+```
+
+## Applied: `[TG-SEC-001]` on `harness/runner.py:209`
+```diff
+--- a/harness/runner.py
++++ b/harness/runner.py
+@@ -207,5 +207,5 @@
+             type=EvidenceType.SOURCE,
+             location="server/auth.py:42",
+-            raw_snippet="SECRET_KEY = 'super_secret_jwt_key'",
++            raw_snippet = os.environ.get("RAW_SNIPPET", "")
+             rationale="Hardcoded secret credential.",
+             confidence_level=ConfidenceBand.CONFIRMED,
+```
+
+## Applied: `[TG-SEC-001]` on `harness/master_validation.py:257`
+```diff
+--- a/harness/master_validation.py
++++ b/harness/master_validation.py
+@@ -255,5 +255,5 @@
+         self.log("Redaction", "JWT Token Redaction", "Bearer ***REDACTED_JWT***" in masked_jwt and "doNotLeakSignature" not in masked_jwt)
+ 
+-        masked_pwd = mask_sensitive_data("DB_PASSWORD = 'super_secret_database_password_123'")
++        masked_pwd = os.environ.get("MASKED_PWD", "")
+         self.log("Redaction", "Password Variable Redaction", "***REDACTED***" in masked_pwd and "super_secret_database_password_123" not in masked_pwd)
+```
+
+## Applied: `[TG-SEC-001]` on `harness/validate_v0_6_2_modern_stacks.py:341`
+```diff
+--- a/harness/validate_v0_6_2_modern_stacks.py
++++ b/harness/validate_v0_6_2_modern_stacks.py
+@@ -339,5 +339,5 @@
+ COPY . .
+ # Running as root user & hardcoding secrets
+-ENV DATABASE_PASSWORD="secret_in_docker"
++DATABASE_PASSWORD = os.environ.get("DATABASE_PASSWORD", "")
+ CMD ["python", "main.py"]
+ """, encoding="utf-8")
+```
+
+## Applied: `[TG-SEC-001]` on `harness/validate_e2e.py:355`
+```diff
+--- a/harness/validate_e2e.py
++++ b/harness/validate_e2e.py
+@@ -353,5 +353,5 @@
+ 
+     def _create_sample_finding(self, rule_id: str, target_path: str, secret_test: bool = False) -> Finding:
+-        raw_code = "API_KEY = 'sk_live_998877665544332211'\nAuthorization = 'Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.doNotLeakSignature'" if secret_test else f"# Unsafe logic for {rule_id}\nrole = request.headers.get('X-User-Role')"
++        raw_code = os.environ.get("RAW_CODE", "")
+         
+         ev = Evidence(
+```
+
+## Applied: `[TG-SEC-001]` on `harness/validate_qa_v0_6_0.py:64`
+```diff
+--- a/harness/validate_qa_v0_6_0.py
++++ b/harness/validate_qa_v0_6_0.py
+@@ -62,5 +62,5 @@
+             "tiny-repo": {
+                 "vulnerable": {
+-                    "app.py": 'DEBUG = True\nSECRET_KEY = "sk_live_1234567890"\n\ndef index():\n    return "Welcome"\n'
++                    DEBUG = os.environ.get("DEBUG", "")
+                 },
+                 "hardened": {
+```
+
+## Applied: `[TG-SEC-001]` on `examples/vulnerable-react-express/server/index.js:9`
+```diff
+--- a/examples/vulnerable-react-express/server/index.js
++++ b/examples/vulnerable-react-express/server/index.js
+@@ -7,5 +7,5 @@
+ 
+ // TG-SEC-001: Hardcoded JWT secret
+-const JWT_SECRET = 'FAKE_DEMO_JWT_SECRET_NOT_FOR_PRODUCTION';
++const secret = process.env.JWT_SECRET || "";
+ 
+ // TG-PLATFORM-001: Wildcard CORS with credentials
+```