torusguard 1.3.0 → 1.3.2

package/.torusguard/rules/websocket/TG-WS-001-unauthenticated-websocket-handshake.md

@@ -0,0 +1,82 @@
+# TG-WS-001: Unauthenticated WebSocket Handshake
+
+## Severity
+High. Accepting WebSocket upgrade handshakes without validating authentication cookies or Bearer tokens allows unauthenticated clients to establish persistent sockets and consume server resources.
+
+## Applies To
+- `ws`, `Socket.io`, `fastapi.WebSocket`, `channels` (Django), `aiohttp`
+
+## Why It Matters
+HTTP WebSocket upgrades (`Upgrade: websocket`) begin as standard HTTP requests. If authentication is omitted during the initial HTTP upgrade:
+1. Attackers can flood the server with unbounded persistent open TCP connections, exhausting socket file descriptors.
+2. If authorization is deferred to post-connect messages, unauthenticated clients can linger in memory indefinitely.
+3. Cross-site WebSocket hijacking (CSWSH) can occur if the `Origin` header is trusted blindly.
+
+## What TorusGuard Looks For
+1. WebSocket servers accepting the upgrade connection before validating session cookies, headers, or query tokens.
+2. Missing `Origin` header validation during handshake.
+3. Runtime probe: Attempting a WebSocket handshake without an `Authorization` header or session cookie; flagging if the connection status returns `101 Switching Protocols` instead of `401 Unauthorized`.
+
+## Unsafe Example
+```typescript
+// UNSAFE: Accepting WebSocket upgrade without verifying session
+import { WebSocketServer } from "ws";
+
+const wss = new WebSocketServer({ port: 8080 });
+
+wss.on("connection", (ws, req) => {
+  // Handshake already succeeded without verifying authentication!
+  ws.send("Welcome to real-time events");
+});
+```
+
+## Safe Example
+```typescript
+// SAFE: Validating authentication and origin during the HTTP upgrade
+import http from "http";
+import { WebSocketServer } from "ws";
+import { verifyJwtToken } from "./auth";
+
+const server = http.createServer();
+const wss = new WebSocketServer({ noServer: true });
+
+server.on("upgrade", (req, socket, head) => {
+  // 1. Verify Origin header
+  const origin = req.headers.origin;
+  if (origin !== "https://app.example.com") {
+    socket.write("HTTP/1.1 403 Forbidden\r\n\r\n");
+    socket.destroy();
+    return;
+  }
+
+  // 2. Authenticate token before completing WebSocket handshake
+  const token = req.headers["sec-websocket-protocol"] || req.headers.cookie;
+  const user = verifyJwtToken(token);
+  if (!user) {
+    socket.write("HTTP/1.1 401 Unauthorized\r\n\r\n");
+    socket.destroy();
+    return;
+  }
+
+  // 3. Complete upgrade only when authenticated
+  wss.handleUpgrade(req, socket, head, (ws) => {
+    wss.emit("connection", ws, req, user);
+  });
+});
+```
+
+## Bounded Runtime Probe Protocol
+When probing WebSocket endpoints under `/torusguard web-validate`:
+1. Dispatch an HTTP GET request with `Upgrade: websocket` and `Connection: Upgrade` headers **without authentication credentials**.
+2. Assert that the server returns `HTTP 401` or `HTTP 403` and terminates the socket.
+3. If the server returns `HTTP 101 Switching Protocols`, log a high-confidence finding for unauthenticated handshake.
+
+## Remediation
+1. **Authenticate on HTTP Upgrade:** Reject unauthenticated connections with standard HTTP 401/403 status codes before calling `handleUpgrade`.
+2. **Enforce Strict Origin Checking:** Validate that `req.headers.origin` matches your trusted application domain.
+3. **Set Connection Timeouts:** Automatically disconnect sockets that fail message-level handshakes within 10 seconds.
+
+## Related Rules
+- `TG-WS-002`: Missing Channel-Level Authorization
+- `TG-AUTH-004`: Insecure Session Cookie
+- `TG-RATE-003`: Unbounded Resource Consumption

package/.torusguard/rules/websocket/TG-WS-002-missing-channel-level-authorization.md

@@ -0,0 +1,37 @@
+# TG-WS-002: Missing Channel-Level Authorization
+
+## Severity
+High by default. Raise to Critical when applicable.
+
+## Applies To
+- Relevant endpoints and services
+
+## Why It Matters
+Explaining the risk of this vulnerability.
+
+## What TorusGuard Looks For
+- Specific code patterns or configurations
+
+## Unsafe Example
+```javascript
+// Unsafe code example
+```
+
+## Safe Example
+```javascript
+// Safe code example
+```
+
+## Remediation
+1. Step one
+2. Step two
+
+## Verification
+- Test case 1
+- Test case 2
+
+## False Positives and Exceptions
+An exception requires documented review.
+
+## Related Rules
+- TG-OTHER-001

package/.torusguard/rules/websocket/TG-WS-003-unvalidated-websocket-message.md

@@ -0,0 +1,37 @@
+# TG-WS-003: Unvalidated WebSocket Message
+
+## Severity
+High by default. Raise to Critical when applicable.
+
+## Applies To
+- Relevant endpoints and services
+
+## Why It Matters
+Explaining the risk of this vulnerability.
+
+## What TorusGuard Looks For
+- Specific code patterns or configurations
+
+## Unsafe Example
+```javascript
+// Unsafe code example
+```
+
+## Safe Example
+```javascript
+// Safe code example
+```
+
+## Remediation
+1. Step one
+2. Step two
+
+## Verification
+- Test case 1
+- Test case 2
+
+## False Positives and Exceptions
+An exception requires documented review.
+
+## Related Rules
+- TG-OTHER-001

package/.torusguard/rules/websocket/TG-WS-004-unbounded-websocket-connections.md

@@ -0,0 +1,37 @@
+# TG-WS-004: Unbounded WebSocket Connections
+
+## Severity
+High by default. Raise to Critical when applicable.
+
+## Applies To
+- Relevant endpoints and services
+
+## Why It Matters
+Explaining the risk of this vulnerability.
+
+## What TorusGuard Looks For
+- Specific code patterns or configurations
+
+## Unsafe Example
+```javascript
+// Unsafe code example
+```
+
+## Safe Example
+```javascript
+// Safe code example
+```
+
+## Remediation
+1. Step one
+2. Step two
+
+## Verification
+- Test case 1
+- Test case 2
+
+## False Positives and Exceptions
+An exception requires documented review.
+
+## Related Rules
+- TG-OTHER-001

package/.torusguard/runs/report-latest.html

@@ -82,11 +82,11 @@
     .gauge-bg { fill: none; stroke: var(--bg-card); stroke-width: 8; }
     .gauge-fill {
       fill: none;
-      stroke: #3fb950;
+      stroke: #f85149;
       stroke-width: 8;
       stroke-linecap: round;
       stroke-dasharray: 251.2;
-      stroke-dashoffset: 37.68000000000001;
+      stroke-dashoffset: 226.07999999999998;
       transition: stroke-dashoffset 0.8s ease;
     }
     .gauge-value {
@@ -140,6 +140,29 @@
       background: var(--border-subtle);
       z-index: 1;
     }
+    .polyglot-chips {
+      display: flex;
+      flex-wrap: wrap;
+      gap: 8px;
+      margin-top: 10px;
+    }
+    .chip {
+      background: var(--bg-card);
+      border: 1px solid var(--border-subtle);
+      border-radius: 16px;
+      padding: 4px 12px;
+      font-size: 12px;
+      font-weight: 500;
+      color: var(--text-main);
+      display: inline-flex;
+      align-items: center;
+      gap: 6px;
+    }
+    .chip-primary {
+      border-color: var(--accent-blue);
+      color: var(--accent-blue);
+      background: rgba(88, 166, 255, 0.1);
+    }
     .grid-bottom {
       display: grid;
       grid-template-columns: 1fr 1fr;
@@ -208,7 +231,7 @@
     <header>
       <div class="logo-group">
         <h1><span class="shield-icon">&#128737;</span> TorusGuard Security Posture</h1>
-        <div class="project-meta">Workspace: <strong>TorusGuard</strong> &middot; Stack: <strong>TypeScript</strong> &middot; 2026-09-07 11:55:40 UTC</div>
+        <div class="project-meta">Workspace: <strong>TorusGuard</strong> &middot; Stack: <strong>TypeScript</strong> &middot; 2026-09-08 11:54:16 IST</div>
       </div>
       <div class="status-badge">&check; Local Governance Active</div>
     </header>
@@ -221,21 +244,21 @@
             <circle class="gauge-bg" cx="50" cy="50" r="40" />
             <circle class="gauge-fill" cx="50" cy="50" r="40" />
           </svg>
-          <div class="gauge-value">85</div>
+          <div class="gauge-value">10</div>
         </div>
         <div class="stat-label" style="margin-top: 12px;">Security Posture Score</div>
       </div>
 
       <div class="card">
         <div class="stat-label">Verified Golden Recipes</div>
-        <div class="stat-value" style="color: var(--accent-green);">0</div>
+        <div class="stat-value" style="color: var(--accent-green);">1</div>
         <div class="stat-sub">Distilled Ponytail fixes (<=35 add, <=25 del)</div>
       </div>
 
       <div class="card">
         <div class="stat-label">Active Memory Patterns</div>
-        <div class="stat-value">0</div>
-        <div class="stat-sub">0 suppressed &middot; 0 recurring</div>
+        <div class="stat-value">7</div>
+        <div class="stat-sub">0 suppressed &middot; 6 recurring</div>
       </div>
 
       <div class="card">
@@ -245,6 +268,19 @@
       </div>
     </div>
 
+    <!-- Polyglot Architecture & Workspace Intelligence -->
+    <div class="card" style="margin-bottom: 24px;">
+      <div class="section-title">&#9670; Polyglot Architecture &amp; Workspace Intelligence</div>
+      <div style="font-size: 13px; color: var(--text-muted); margin-bottom: 12px;">
+        Primary Language: <strong style="color: var(--text-main);">TypeScript</strong>
+        &middot; Framework: <strong style="color: var(--text-main);">None</strong>
+        &middot; Data Layer: <strong style="color: var(--text-main);">None</strong>
+      </div>
+      <div class="polyglot-chips">
+        <span class="chip chip-primary">&#9679; TypeScript</span>
+      </div>
+    </div>
+
     <!-- 7-Stage Canonical Pipeline Tracker -->
     <div class="card pipeline-section">
       <div class="section-title">&#9658; Canonical 7-Stage Closed-Loop Governance Flow</div>
@@ -253,17 +289,17 @@
         <div class="pipeline-step">
           <div class="step-circle active">1</div>
           <div class="step-name">Scan</div>
-          <div class="step-cmd">/audit</div>
+          <div class="step-cmd">audit &middot; /audit</div>
         </div>
         <div class="pipeline-step">
           <div class="step-circle active">2</div>
           <div class="step-name">Score</div>
-          <div class="step-cmd">0-100</div>
+          <div class="step-cmd">0-100 Score</div>
         </div>
         <div class="pipeline-step">
           <div class="step-circle active">3</div>
           <div class="step-name">Harden</div>
-          <div class="step-cmd">/harden</div>
+          <div class="step-cmd">harden &middot; /harden</div>
         </div>
         <div class="pipeline-step">
           <div class="step-circle active">4</div>
@@ -273,17 +309,17 @@
         <div class="pipeline-step">
           <div class="step-circle active">5</div>
           <div class="step-name">Apply</div>
-          <div class="step-cmd">.bak Snapshot</div>
+          <div class="step-cmd">apply &middot; .bak</div>
         </div>
         <div class="pipeline-step">
           <div class="step-circle active">6</div>
           <div class="step-name">Recheck</div>
-          <div class="step-cmd">Differential</div>
+          <div class="step-cmd">recheck &middot; verify</div>
         </div>
         <div class="pipeline-step">
           <div class="step-circle active">7</div>
           <div class="step-name">Report</div>
-          <div class="step-cmd">SARIF v2.1.0</div>
+          <div class="step-cmd">report &middot; SARIF</div>
         </div>
       </div>
     </div>
@@ -292,13 +328,19 @@
     <div class="grid-bottom">
       <!-- Golden Recipes Catalog -->
       <div class="card">
-        <div class="section-title">&#10024; Active Golden Fix Recipes (0)</div>
+        <div class="section-title">&#10024; Active Golden Fix Recipes (1)</div>
         <div class="recipes-list">
           
-        <div class="empty-state">
-          <p>No golden fix recipes captured yet. Run <code>/torusguard-apply</code> on verified remediations to distill reusable recipes.</p>
-        </div>
-        
+            <div class="card recipe-card">
+              <div class="card-header">
+                <span class="badge badge-success">TG-SEC-001</span>
+                <span class="meta-label">Verified 1x &middot; +1/-1 Ponytail</span>
+              </div>
+              <p class="recipe-desc">Migrated secret to environment variable</p>
+              <pre class="diff-block"><code>+ SECRET = env
+- SECRET = test</code></pre>
+            </div>
+            
         </div>
       </div>
 
@@ -314,14 +356,14 @@
             </tr>
           </thead>
           <tbody>
-            <tr><td colspan='3' class='empty-cell'>Zero active security regressions detected. Posture clean.</td></tr>
+            <tr><td colspan='3' class='empty-cell'>Zero active security regressions or suppressions. Posture clean.</td></tr>
           </tbody>
         </table>
       </div>
     </div>
 
     <footer>
-      TorusGuard v1.2.0 &middot; Autonomous Security Engine for AI-Built Applications &middot; 100% Local-First &middot; Zero Cloud Telemetry Leakage
+      TorusGuard v1.3.0 &middot; Autonomous Security Engine for AI-Built Applications &middot; 100% Local-First &middot; Zero Cloud Telemetry Leakage
     </footer>
   </div>
 </body>