torusguard 1.3.0 → 1.3.2

package/.torusguard/rules/ssrf/TG-SSRF-001-user-controlled-server-side-url-fetch.md

@@ -0,0 +1,68 @@
+# TG-SSRF-001: User-Controlled Server-Side URL Fetch
+
+## Severity
+High by default. Raise to Critical when the request can reach internal administrative services, cloud metadata services, or sensitive network assets.
+
+## Applies To
+- URL preview APIs
+- Remote image/file importers
+- Webhook testers
+- PDF generation services
+- Server-side integrations
+- Any endpoint that fetches a URL supplied by a user
+
+## Why It Matters
+A server that fetches an attacker-controlled URL may be used to access internal systems or send requests from a trusted network location.
+
+## What TorusGuard Looks For
+- fetch(), axios, requests, HttpClient, OkHttp, or equivalent calls
+- URL values derived from request body, query, or path parameters
+- Redirect-following enabled without destination validation
+- No domain or IP allowlist
+- No timeout or response-size limit
+
+## Unsafe Example
+```javascript
+const response = await fetch(req.body.url);
+```
+
+## Safe Example
+```javascript
+const target = new URL(req.body.url);
+if (target.protocol !== "https:") {
+  throw new Error("Only HTTPS URLs are allowed");
+}
+if (!ALLOWED_HOSTS.has(target.hostname)) {
+  throw new Error("Destination is not allowed");
+}
+const response = await fetch(target, {
+  redirect: "error",
+  signal: AbortSignal.timeout(5000)
+});
+```
+
+## Remediation
+1. Parse the URL using a maintained URL parser.
+2. Allow only required schemes.
+3. Prefer an explicit hostname allowlist.
+4. Block private, loopback, link-local, and metadata destinations.
+5. Disable or revalidate redirects.
+6. Apply timeout and response-size limits.
+7. Do not return raw upstream responses.
+
+## Verification
+- Test allowed domains.
+- Test localhost and loopback addresses.
+- Test private IP ranges.
+- Test metadata-service addresses.
+- Test file:// and other unsupported schemes.
+- Test redirects to an untrusted or internal destination.
+- Verify timeout and response-size behavior.
+
+## False Positives and Exceptions
+An exception requires a documented fixed allowlist, network isolation, timeout, response limit, and review owner.
+
+## Related Rules
+- TG-SSRF-002
+- TG-SSRF-003
+- TG-RATE-003

package/.torusguard/rules/ssrf/TG-SSRF-002-missing-internal-network-protection.md

@@ -0,0 +1,37 @@
+# TG-SSRF-002: Missing Internal Network Protection
+
+## Severity
+High by default. Raise to Critical when applicable.
+
+## Applies To
+- Relevant endpoints and services
+
+## Why It Matters
+Explaining the risk of this vulnerability.
+
+## What TorusGuard Looks For
+- Specific code patterns or configurations
+
+## Unsafe Example
+```javascript
+// Unsafe code example
+```
+
+## Safe Example
+```javascript
+// Safe code example
+```
+
+## Remediation
+1. Step one
+2. Step two
+
+## Verification
+- Test case 1
+- Test case 2
+
+## False Positives and Exceptions
+An exception requires documented review.
+
+## Related Rules
+- TG-OTHER-001

package/.torusguard/rules/ssrf/TG-SSRF-003-unsafe-redirect-following.md

@@ -0,0 +1,37 @@
+# TG-SSRF-003: Unsafe Redirect Following
+
+## Severity
+High by default. Raise to Critical when applicable.
+
+## Applies To
+- Relevant endpoints and services
+
+## Why It Matters
+Explaining the risk of this vulnerability.
+
+## What TorusGuard Looks For
+- Specific code patterns or configurations
+
+## Unsafe Example
+```javascript
+// Unsafe code example
+```
+
+## Safe Example
+```javascript
+// Safe code example
+```
+
+## Remediation
+1. Step one
+2. Step two
+
+## Verification
+- Test case 1
+- Test case 2
+
+## False Positives and Exceptions
+An exception requires documented review.
+
+## Related Rules
+- TG-OTHER-001

package/.torusguard/rules/ssrf/TG-SSRF-004-unbounded-outbound-request.md

@@ -0,0 +1,37 @@
+# TG-SSRF-004: Unbounded Outbound Request
+
+## Severity
+High by default. Raise to Critical when applicable.
+
+## Applies To
+- Relevant endpoints and services
+
+## Why It Matters
+Explaining the risk of this vulnerability.
+
+## What TorusGuard Looks For
+- Specific code patterns or configurations
+
+## Unsafe Example
+```javascript
+// Unsafe code example
+```
+
+## Safe Example
+```javascript
+// Safe code example
+```
+
+## Remediation
+1. Step one
+2. Step two
+
+## Verification
+- Test case 1
+- Test case 2
+
+## False Positives and Exceptions
+An exception requires documented review.
+
+## Related Rules
+- TG-OTHER-001

package/.torusguard/rules/supply-chain/TG-SUPPLY-001-missing-or-ignored-dependency-lockfile.md

@@ -0,0 +1,37 @@
+# TG-SUPPLY-001: Missing or Ignored Dependency Lockfile
+
+## Severity
+High by default. Raise to Critical when applicable.
+
+## Applies To
+- Relevant endpoints and services
+
+## Why It Matters
+Explaining the risk of this vulnerability.
+
+## What TorusGuard Looks For
+- Specific code patterns or configurations
+
+## Unsafe Example
+```javascript
+// Unsafe code example
+```
+
+## Safe Example
+```javascript
+// Safe code example
+```
+
+## Remediation
+1. Step one
+2. Step two
+
+## Verification
+- Test case 1
+- Test case 2
+
+## False Positives and Exceptions
+An exception requires documented review.
+
+## Related Rules
+- TG-OTHER-001

package/.torusguard/rules/supply-chain/TG-SUPPLY-002-vulnerable-dependency-review-missing.md

@@ -0,0 +1,94 @@
+# TG-SUPPLY-002: Vulnerable Dependency Review Missing
+
+## Severity
+High by default. Escalate to Critical when dependencies with known, weaponized remote code execution (RCE) or authentication bypass CVEs are identified.
+
+## Applies To
+- Node.js / JavaScript / TypeScript (`package.json`, `package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`)
+- Python (`requirements.txt`, `pyproject.toml`, `Pipfile.lock`, `poetry.lock`)
+
+## Why It Matters
+Using third-party open-source packages with known security vulnerabilities exposes production web applications to automated supply-chain exploits, supply-chain poisoning, prototype pollution, cross-site scripting (XSS), and arbitrary code execution.
+
+However, **automated bulk repair commands like `npm audit fix --force` introduce severe supply-chain regression hazards**:
+- `npm audit fix --force` blindly upgrades packages across **major breaking version jumps** (e.g., Express 4 $\rightarrow$ 5, MongoDB Driver v2 $\rightarrow$ v6, Webpack 4 $\rightarrow$ 5).
+- These breaking API changes break production routing, change database connection options, and crash running services.
+- Remediation must be deliberate, selective, and verified through regression suites.
+
+## What TorusGuard Looks For
+1. Unpinned dependency versions or wildcards (`*`, `latest`) in manifests.
+2. Missing automated vulnerability auditing steps (`npm audit`, `pip-audit`) in CI/CD workflows.
+3. Automated fix scripts executing blind `--force` flags without test gates.
+4. Dependencies flagged with CVEs exceeding acceptable severity thresholds.
+
+## Unsafe Example
+```bash
+# UNSAFE: Blind automated fix forcing breaking major version upgrades
+npm audit fix --force
+```
+
+```json
+// UNSAFE: package.json with floating wildcard versions
+{
+  "dependencies": {
+    "express": "*",
+    "jsonwebtoken": "^8.0.0"
+  },
+  "scripts": {
+    "audit-fix": "npm audit fix --force"
+  }
+}
+```
+
+## Safe Example
+```bash
+# SAFE: Apply non-breaking minor and patch fixes only
+npm audit fix
+
+# For dependencies requiring major version bumps to patch CVEs:
+# 1. Inspect breaking changes manually:
+npm audit --json
+
+# 2. Upgrade specific package selectively:
+npm install jsonwebtoken@9.0.2
+
+# 3. Execute regression test suite before merging:
+npm test
+```
+
+```yaml
+# SAFE: Continuous vulnerability scanning in CI workflow (.github/workflows/security.yml)
+name: Dependency Security Audit
+on: [push, pull_request]
+
+jobs:
+  audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Run Node Dependency Audit
+        run: npm audit --audit-level=high
+      - name: Run Python Dependency Audit
+        run: |
+          pip install pip-audit
+          pip-audit -r requirements.txt --strict
+```
+
+## Remediation
+1. **Never use `--force` in CI or production maintenance scripts:** Restrict automated remediation to `npm audit fix` (non-breaking minor/patch updates).
+2. **Selective Major Upgrades:** For vulnerabilities that require a major version jump, consult the upstream CHANGELOG, evaluate breaking API changes, and upgrade the single package explicitly.
+3. **Pin Exact Versions or Use Lockfiles:** Commit reproducible lockfiles (`package-lock.json`, `poetry.lock`, `requirements.txt`) to source control.
+4. **Automate in CI:** Integrate `npm audit` or `pip-audit` as a blocking pull request check for High and Critical severities.
+
+## Verification
+- Run `npm audit` or `pip-audit` to confirm zero High/Critical unhandled CVEs.
+- Confirm all existing unit and integration tests pass after any dependency update.
+- Verify that `package-lock.json` changes reflect only intended, targeted packages.
+
+## False Positives and Exceptions
+- Vulnerabilities located solely in development dependencies (`devDependencies`, e.g., local build tools, linters) that are never bundled into client or server production environments may be exempted with documented risk acceptance.
+
+## Related Rules
+- `TG-SUPPLY-001`: Pinned Dependency Version Missing
+- `TG-SUPPLY-003`: Container Build Secret Persistence
+- `TG-SEC-001`: Hardcoded Secrets in Manifests

package/.torusguard/rules/supply-chain/TG-SUPPLY-003-unsafe-ci-cd-secret-exposure.md

@@ -0,0 +1,37 @@
+# TG-SUPPLY-003: Unsafe CI/CD Secret Exposure
+
+## Severity
+High by default. Raise to Critical when applicable.
+
+## Applies To
+- Relevant endpoints and services
+
+## Why It Matters
+Explaining the risk of this vulnerability.
+
+## What TorusGuard Looks For
+- Specific code patterns or configurations
+
+## Unsafe Example
+```javascript
+// Unsafe code example
+```
+
+## Safe Example
+```javascript
+// Safe code example
+```
+
+## Remediation
+1. Step one
+2. Step two
+
+## Verification
+- Test case 1
+- Test case 2
+
+## False Positives and Exceptions
+An exception requires documented review.
+
+## Related Rules
+- TG-OTHER-001

package/.torusguard/rules/supply-chain/TG-SUPPLY-004-unpinned-ci-action.md

@@ -0,0 +1,37 @@
+# TG-SUPPLY-004: Unpinned CI Action
+
+## Severity
+High by default. Raise to Critical when applicable.
+
+## Applies To
+- Relevant endpoints and services
+
+## Why It Matters
+Explaining the risk of this vulnerability.
+
+## What TorusGuard Looks For
+- Specific code patterns or configurations
+
+## Unsafe Example
+```javascript
+// Unsafe code example
+```
+
+## Safe Example
+```javascript
+// Safe code example
+```
+
+## Remediation
+1. Step one
+2. Step two
+
+## Verification
+- Test case 1
+- Test case 2
+
+## False Positives and Exceptions
+An exception requires documented review.
+
+## Related Rules
+- TG-OTHER-001

package/.torusguard/rules/supply-chain/TG-SUPPLY-005-unsafe-dependency-install-script.md

@@ -0,0 +1,37 @@
+# TG-SUPPLY-005: Unsafe Dependency Install Script
+
+## Severity
+High by default. Raise to Critical when applicable.
+
+## Applies To
+- Relevant endpoints and services
+
+## Why It Matters
+Explaining the risk of this vulnerability.
+
+## What TorusGuard Looks For
+- Specific code patterns or configurations
+
+## Unsafe Example
+```javascript
+// Unsafe code example
+```
+
+## Safe Example
+```javascript
+// Safe code example
+```
+
+## Remediation
+1. Step one
+2. Step two
+
+## Verification
+- Test case 1
+- Test case 2
+
+## False Positives and Exceptions
+An exception requires documented review.
+
+## Related Rules
+- TG-OTHER-001

package/.torusguard/rules/supply-chain/TG-SUPPLY-006-container-build-secret-persistence.md

@@ -0,0 +1,61 @@
+# TG-SUPPLY-006: Container Build Secret Persistence
+
+## Severity
+High. Embedding credentials, tokens, or private SSH keys into intermediate container build layers exposes secrets in public registry images.
+
+## Applies To
+- Dockerfiles, Containerfile, Docker Compose
+- CI/CD Container Build Pipelines
+
+## Why It Matters
+When `ARG`, `ENV`, or `COPY` directives are used to pass secrets into Docker builds:
+1. Every Docker layer is cached and preserved in the final image manifest.
+2. Even if a subsequent `RUN rm -rf /root/.ssh` is executed, the file remains fully recoverable using container layer extractors (`dive`, `docker history`).
+3. Deploying the image to public or shared registries inadvertently leaks production credentials.
+
+## What TorusGuard Looks For
+1. `ARG` or `ENV` variables with names matching `TOKEN`, `KEY`, `PASSWORD`, `SECRET`.
+2. Direct `COPY` of private SSH keys (`id_rsa`), `.env` files, or npm tokens (`.npmrc`) into build images.
+3. Multi-stage builds copying secret artifacts from builder stages without BuildKit secret mounts.
+
+## Unsafe Example
+```dockerfile
+# UNSAFE: Passing GitHub token via build-arg leaves it in layer metadata
+FROM node:20-alpine
+ARG GITHUB_TOKEN
+ENV GITHUB_TOKEN=$GITHUB_TOKEN
+
+# Secrets remain in image history forever!
+RUN npm install
+```
+
+## Safe Example
+```dockerfile
+# SAFE: Using BuildKit secret mounts (never persisted to image layers)
+# syntax=docker/dockerfile:1.4
+FROM node:20-alpine AS builder
+
+WORKDIR /app
+COPY package*.json ./
+
+# Secret is mounted ephemerally in RAM during the command and never written to disk
+RUN --mount=type=secret,id=npmrc,target=/root/.npmrc \
+    npm ci --only=production
+
+FROM node:20-alpine AS runner
+WORKDIR /app
+COPY --from=builder /app/node_modules ./node_modules
+COPY . .
+
+USER node
+CMD ["node", "server.js"]
+```
+
+## Remediation
+1. **Use BuildKit Secret Mounts:** Replace `ARG` secrets with `RUN --mount=type=secret,id=my_secret`.
+2. **Multi-Stage Clean Separation:** Compile code in an unprivileged builder stage and copy strictly compiled runtime artifacts to the runner image.
+3. **Use `.dockerignore`:** Exclude `.env`, `.git`, `.npmrc`, and credentials from build context.
+
+## Related Rules
+- `TG-SEC-001`: Hardcoded Secrets
+- `TG-SUPPLY-002`: Vulnerable Dependency Review Missing

package/.torusguard/rules/webhook/TG-WEBHOOK-001-missing-webhook-signature-verification.md

@@ -0,0 +1,37 @@
+# TG-WEBHOOK-001: Missing Webhook Signature Verification
+
+## Severity
+High by default. Raise to Critical when applicable.
+
+## Applies To
+- Relevant endpoints and services
+
+## Why It Matters
+Explaining the risk of this vulnerability.
+
+## What TorusGuard Looks For
+- Specific code patterns or configurations
+
+## Unsafe Example
+```javascript
+// Unsafe code example
+```
+
+## Safe Example
+```javascript
+// Safe code example
+```
+
+## Remediation
+1. Step one
+2. Step two
+
+## Verification
+- Test case 1
+- Test case 2
+
+## False Positives and Exceptions
+An exception requires documented review.
+
+## Related Rules
+- TG-OTHER-001

package/.torusguard/rules/webhook/TG-WEBHOOK-002-replayable-webhook.md

@@ -0,0 +1,37 @@
+# TG-WEBHOOK-002: Replayable Webhook
+
+## Severity
+High by default. Raise to Critical when applicable.
+
+## Applies To
+- Relevant endpoints and services
+
+## Why It Matters
+Explaining the risk of this vulnerability.
+
+## What TorusGuard Looks For
+- Specific code patterns or configurations
+
+## Unsafe Example
+```javascript
+// Unsafe code example
+```
+
+## Safe Example
+```javascript
+// Safe code example
+```
+
+## Remediation
+1. Step one
+2. Step two
+
+## Verification
+- Test case 1
+- Test case 2
+
+## False Positives and Exceptions
+An exception requires documented review.
+
+## Related Rules
+- TG-OTHER-001

package/.torusguard/rules/webhook/TG-WEBHOOK-003-missing-webhook-idempotency.md

@@ -0,0 +1,37 @@
+# TG-WEBHOOK-003: Missing Webhook Idempotency
+
+## Severity
+High by default. Raise to Critical when applicable.
+
+## Applies To
+- Relevant endpoints and services
+
+## Why It Matters
+Explaining the risk of this vulnerability.
+
+## What TorusGuard Looks For
+- Specific code patterns or configurations
+
+## Unsafe Example
+```javascript
+// Unsafe code example
+```
+
+## Safe Example
+```javascript
+// Safe code example
+```
+
+## Remediation
+1. Step one
+2. Step two
+
+## Verification
+- Test case 1
+- Test case 2
+
+## False Positives and Exceptions
+An exception requires documented review.
+
+## Related Rules
+- TG-OTHER-001

package/.torusguard/rules/webhook/TG-WEBHOOK-004-unvalidated-webhook-event-type.md

@@ -0,0 +1,37 @@
+# TG-WEBHOOK-004: Unvalidated Webhook Event Type
+
+## Severity
+High by default. Raise to Critical when applicable.
+
+## Applies To
+- Relevant endpoints and services
+
+## Why It Matters
+Explaining the risk of this vulnerability.
+
+## What TorusGuard Looks For
+- Specific code patterns or configurations
+
+## Unsafe Example
+```javascript
+// Unsafe code example
+```
+
+## Safe Example
+```javascript
+// Safe code example
+```
+
+## Remediation
+1. Step one
+2. Step two
+
+## Verification
+- Test case 1
+- Test case 2
+
+## False Positives and Exceptions
+An exception requires documented review.
+
+## Related Rules
+- TG-OTHER-001