torusguard 1.3.3 → 1.3.5

package/.torusguard/runs/run-20260910-120238-audit/remediation.md

@@ -0,0 +1,262 @@
+# TorusGuard Governed Remediation Catalog
+**Run ID:** `run-20260910-120238-audit`  
+**Generated:** `2026-09-10 12:02:48 IST`  
+**Candidate Bundles Formulated:** `16`  
+
+---
+## Formulated Candidate Patches
+
+### [TG-INPUT-003] Unsafe Dynamic Code or HTML Execution
+- **Target:** `examples/vulnerable-react-express/client/src/App.jsx:53` | **Bundle ID:** `bnd-tg-input-003-53-d167b4`
+- **Strategy:** Replaced raw dangerouslySetInnerHTML injection with safe React text interpolation
+- **Ponytail Churn:** `+1 / -1`
+```diff
+--- a/examples/vulnerable-react-express/client/src/App.jsx
++++ b/examples/vulnerable-react-express/client/src/App.jsx
+@@ -51,5 +51,5 @@
+ 
+       {/* TG-INPUT-003: Unsafe HTML rendering */}
+-      <div dangerouslySetInnerHTML={{ __html: bio }} />
++      <div>{bio}</div>
+ 
+       <button onClick={fetchUser}>Fetch user (IDOR demo)</button>
+```
+
+### [TG-SEC-001] Hardcoded Secret or API Key in Tracked Source
+- **Target:** `examples/vulnerable-react-express/server/index.js:9` | **Bundle ID:** `bnd-tg-sec-001-9-f51467`
+- **Strategy:** Migrated hardcoded JWT secret to environment variable process.env.JWT_SECRET
+- **Ponytail Churn:** `+1 / -1`
+```diff
+--- a/examples/vulnerable-react-express/server/index.js
++++ b/examples/vulnerable-react-express/server/index.js
+@@ -7,5 +7,5 @@
+ 
+ // TG-SEC-001: Hardcoded JWT secret
+-const JWT_SECRET = 'FAKE_DEMO_JWT_SECRET_NOT_FOR_PRODUCTION';
++const secret = process.env.JWT_SECRET || "";
+ 
+ // TG-PLATFORM-001: Wildcard CORS with credentials
+```
+
+### [TG-INPUT-002] Unescaped Raw SQL Query Concatenation
+- **Target:** `harness/engine/fixture_manager.py:128` | **Bundle ID:** `bnd-tg-input-002-128-7809a1`
+- **Strategy:** Replaced unsafe Python SQL f-string interpolation with parameterized SQL query placeholder
+- **Ponytail Churn:** `+1 / -1`
+```diff
+--- a/harness/engine/fixture_manager.py
++++ b/harness/engine/fixture_manager.py
+@@ -126,5 +126,5 @@
+                 vulnerable_variant=FixtureVariant(
+                     relative_path="examples/python/sqlalchemy-vuln",
+-                    code_pattern="session.execute(f'SELECT * FROM items WHERE name LIKE {q}')",
++                    code_pattern="session.execute('SELECT * FROM items WHERE name LIKE %s')",
+                     expected_findings_count=4,
+                 ),
+```
+
+### [TG-SEC-001] Hardcoded Secret or API Key in Tracked Source
+- **Target:** `harness/master_validation.py:257` | **Bundle ID:** `bnd-tg-sec-001-257-89bf34`
+- **Strategy:** Replaced hardcoded credential with os.environ.get('MASKED_PWD')
+- **Ponytail Churn:** `+1 / -1`
+```diff
+--- a/harness/master_validation.py
++++ b/harness/master_validation.py
+@@ -255,5 +255,5 @@
+         self.log("Redaction", "JWT Token Redaction", "Bearer ***REDACTED_JWT***" in masked_jwt and "doNotLeakSignature" not in masked_jwt)
+ 
+-        masked_pwd = mask_sensitive_data("DB_PASSWORD = 'super_secret_database_password_123'")
++        masked_pwd = os.environ.get("MASKED_PWD", "")
+         self.log("Redaction", "Password Variable Redaction", "***REDACTED***" in masked_pwd and "super_secret_database_password_123" not in masked_pwd)
+```
+
+### [TG-SEC-001] Hardcoded Secret or API Key in Tracked Source
+- **Target:** `harness/runner.py:209` | **Bundle ID:** `bnd-tg-sec-001-209-4f6424`
+- **Strategy:** Replaced hardcoded credential with os.environ.get('RAW_SNIPPET')
+- **Ponytail Churn:** `+1 / -1`
+```diff
+--- a/harness/runner.py
++++ b/harness/runner.py
+@@ -207,5 +207,5 @@
+             type=EvidenceType.SOURCE,
+             location="server/auth.py:42",
+-            raw_snippet="SECRET_KEY = 'super_secret_jwt_key'",
++            raw_snippet = os.environ.get("RAW_SNIPPET", "")
+             rationale="Hardcoded secret credential.",
+             confidence_level=ConfidenceBand.CONFIRMED,
+```
+
+### [TG-DB-004] Missing Multi-Tenant Isolation in Scoped Query
+- **Target:** `harness/runner.py:503` | **Bundle ID:** `bnd-tg-db-004-503-d11cf8`
+- **Strategy:** Added explicit organization_id tenant boundary filter to ORM query
+- **Ponytail Churn:** `+1 / -1`
+```diff
+--- a/harness/runner.py
++++ b/harness/runner.py
+@@ -501,5 +501,5 @@
+ 
+             # 2. Stable Finding Identity
+-            code_a = "def view():\n    return Item.objects.get(id=id)"
++            code_a = "def view():\n    return Item.objects.get(organization_id=request.user.organization_id, id=id)"
+             code_b = "# Shifted comment\ndef view():\n    return Item.objects.get(id=id)"
+             fp1 = IdentityEngine.generate_identity("TG-DB-004", "views.py", code_a, sink_signature="Item.objects.get")
+```
+
+### [TG-INPUT-002] Unescaped Raw SQL Query Concatenation
+- **Target:** `harness/runner.py:256` | **Bundle ID:** `bnd-tg-input-002-256-c8a22e`
+- **Strategy:** Replaced unsafe Python SQL f-string interpolation with parameterized SQL query placeholder
+- **Ponytail Churn:** `+1 / -1`
+```diff
+--- a/harness/runner.py
++++ b/harness/runner.py
+@@ -254,5 +254,5 @@
+             framework_pattern=FrameworkPattern(
+                 framework="Django",
+-                unsafe_snippet="User.objects.raw(f'SELECT * FROM users WHERE name = {name}')",
++                unsafe_snippet="User.objects.raw('SELECT * FROM users WHERE name = %s')",
+                 safe_snippet="User.objects.raw('SELECT * FROM users WHERE name = %s', [name])",
+             ),
+```
+
+### [TG-SEC-001] Hardcoded Secret or API Key in Tracked Source
+- **Target:** `harness/validate_e2e.py:355` | **Bundle ID:** `bnd-tg-sec-001-355-7b190b`
+- **Strategy:** Replaced hardcoded credential with os.environ.get('RAW_CODE')
+- **Ponytail Churn:** `+1 / -1`
+```diff
+--- a/harness/validate_e2e.py
++++ b/harness/validate_e2e.py
+@@ -353,5 +353,5 @@
+ 
+     def _create_sample_finding(self, rule_id: str, target_path: str, secret_test: bool = False) -> Finding:
+-        raw_code = "API_KEY = 'sk_live_998877665544332211'\nAuthorization = 'Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.doNotLeakSignature'" if secret_test else f"# Unsafe logic for {rule_id}\nrole = request.headers.get('X-User-Role')"
++        raw_code = os.environ.get("RAW_CODE", "")
+         
+         ev = Evidence(
+```
+
+### [TG-SEC-001] Hardcoded Secret or API Key in Tracked Source
+- **Target:** `harness/validate_qa_v0_6_0.py:64` | **Bundle ID:** `bnd-tg-sec-001-64-5af31a`
+- **Strategy:** Replaced hardcoded credential with os.environ.get('DEBUG')
+- **Ponytail Churn:** `+1 / -1`
+```diff
+--- a/harness/validate_qa_v0_6_0.py
++++ b/harness/validate_qa_v0_6_0.py
+@@ -62,5 +62,5 @@
+             "tiny-repo": {
+                 "vulnerable": {
+-                    "app.py": 'DEBUG = True\nSECRET_KEY = "sk_live_1234567890"\n\ndef index():\n    return "Welcome"\n'
++                    DEBUG = os.environ.get("DEBUG", "")
+                 },
+                 "hardened": {
+```
+
+### [TG-DB-004] Missing Multi-Tenant Isolation in Scoped Query
+- **Target:** `harness/validate_v0_6_1_scale.py:115` | **Bundle ID:** `bnd-tg-db-004-115-9a059e`
+- **Strategy:** Added explicit organization_id tenant boundary filter to ORM query
+- **Ponytail Churn:** `+1 / -1`
+```diff
+--- a/harness/validate_v0_6_1_scale.py
++++ b/harness/validate_v0_6_1_scale.py
+@@ -113,5 +113,5 @@
+                 "severity": "High",
+                 "target": {"file_path": "apps/django_core/billing/views.py", "line_start": 42, "line_end": 42},
+-                "evidence": {"code_snippet": "Invoice.objects.get(id=inv_id)"},
++                "evidence": {"code_snippet": "Invoice.objects.get(organization_id=request.user.organization_id, id=inv_id)"},
+             },
+             # FastAPI Microservice
+```
+
+### [TG-SEC-001] Hardcoded Secret or API Key in Tracked Source
+- **Target:** `harness/validate_v0_6_2_modern_stacks.py:341` | **Bundle ID:** `bnd-tg-sec-001-341-ce228c`
+- **Strategy:** Replaced hardcoded credential with os.environ.get('DATABASE_PASSWORD')
+- **Ponytail Churn:** `+1 / -1`
+```diff
+--- a/harness/validate_v0_6_2_modern_stacks.py
++++ b/harness/validate_v0_6_2_modern_stacks.py
+@@ -339,5 +339,5 @@
+ COPY . .
+ # Running as root user & hardcoding secrets
+-ENV DATABASE_PASSWORD="secret_in_docker"
++DATABASE_PASSWORD = os.environ.get("DATABASE_PASSWORD", "")
+ CMD ["python", "main.py"]
+ """, encoding="utf-8")
+```
+
+### [TG-DB-004] Missing Multi-Tenant Isolation in Scoped Query
+- **Target:** `harness/validate_v0_6_3_hardening.py:119` | **Bundle ID:** `bnd-tg-db-004-119-61557c`
+- **Strategy:** Added explicit organization_id tenant boundary filter to ORM query
+- **Ponytail Churn:** `+1 / -1`
+```diff
+--- a/harness/validate_v0_6_3_hardening.py
++++ b/harness/validate_v0_6_3_hardening.py
+@@ -117,5 +117,5 @@
+         snippet_v1 = """def process_invoice(req, inv_id):
+     # Retrieve invoice
+-    inv = Invoice.objects.get(id=inv_id)
++    inv = Invoice.objects.get(organization_id=request.user.organization_id, id=inv_id)
+     return inv
+ """
+```
+
+### [TG-DB-004] Missing Multi-Tenant Isolation in Scoped Query
+- **Target:** `harness/validate_v1_0_0_memory.py:265` | **Bundle ID:** `bnd-tg-db-004-265-996ca3`
+- **Strategy:** Added explicit organization_id tenant boundary filter to ORM query
+- **Ponytail Churn:** `+1 / -1`
+```diff
+--- a/harness/validate_v1_0_0_memory.py
++++ b/harness/validate_v1_0_0_memory.py
+@@ -263,5 +263,5 @@
+ -    return Bill.objects.filter(id=id, tenant=tenant)
+ +def get_bill(id):
+-+    return Bill.objects.get(id=id)
+++    return Bill.objects.get(organization_id=request.user.organization_id, id=id)
+ """
+         res_reg = diff_guard.audit_diff(regression_diff, check_memory=True, root_dir=test_root)
+```
+
+### [TG-INPUT-002] Unescaped Raw SQL Query Concatenation
+- **Target:** `harness/validate_v1_1_0_advanced_memory.py:107` | **Bundle ID:** `bnd-tg-input-002-107-516a40`
+- **Strategy:** Replaced unsafe Python SQL f-string interpolation with parameterized SQL query placeholder
+- **Ponytail Churn:** `+1 / -1`
+```diff
+--- a/harness/validate_v1_1_0_advanced_memory.py
++++ b/harness/validate_v1_1_0_advanced_memory.py
+@@ -105,5 +105,5 @@
+         memory_engine.ensure_memory_structure(root_dir=test_root)
+ 
+-        valid_before = "cursor.execute(f'SELECT * FROM users WHERE id = {uid}')"
++        valid_before = "cursor.execute('SELECT * FROM users WHERE id = %s')"
+         valid_after = "cursor.execute('SELECT * FROM users WHERE id = %s', (uid,))"
+         valid_diff = "- cursor.execute(f'SELECT * FROM users WHERE id = {uid}')\n+ cursor.execute('SELECT * FROM users WHERE id = %s', (uid,))"
+```
+
+### [TG-PLATFORM-001] Wildcard Permissive CORS Configuration with Credentials
+- **Target:** `skills/torusguard/payload/scripts/harden_runner.py:183` | **Bundle ID:** `bnd-tg-platform-001-183-47fd5e`
+- **Strategy:** Replaced wildcard CORS configuration with strict origin whitelist environment variable
+- **Ponytail Churn:** `+1 / -1`
+```diff
+--- a/skills/torusguard/payload/scripts/harden_runner.py
++++ b/skills/torusguard/payload/scripts/harden_runner.py
+@@ -181,5 +181,5 @@
+     # Strategy 5: Permissive CORS with Credentials (TG-PLATFORM-001)
+     elif rule_id == "TG-PLATFORM-001":
+-        if "CORS_ALLOW_ALL_ORIGINS = True" in target_line:
++        CORS_ALLOWED_ORIGINS = [os.environ.get("ALLOWED_ORIGIN", "https://app.example.com")]
+             replacement = f'{indent}CORS_ALLOWED_ORIGINS = [os.environ.get("ALLOWED_ORIGIN", "https://app.example.com")]'
+             new_lines[line_number - 1] = replacement
+```
+
+### [TG-DB-004] Missing Multi-Tenant Isolation in Scoped Query
+- **Target:** `tests/test_v0_6_0_governed_remediation.py:79` | **Bundle ID:** `bnd-tg-db-004-79-91f41f`
+- **Strategy:** Added explicit organization_id tenant boundary filter to ORM query
+- **Ponytail Churn:** `+1 / -1`
+```diff
+--- a/tests/test_v0_6_0_governed_remediation.py
++++ b/tests/test_v0_6_0_governed_remediation.py
+@@ -77,5 +77,5 @@
+         def get_invoice(request, invoice_id):
+             # Fetch invoice directly without tenant filter
+-            invoice = Invoice.objects.get(id=invoice_id)
++            invoice = Invoice.objects.get(organization_id=request.user.organization_id, id=invoice_id)
+             return JsonResponse({"id": invoice.id})
+         """
+```

package/.torusguard/runs/run-20260910-120238-audit/summary.md

@@ -0,0 +1,5 @@
+# TorusGuard Audit Summary: run-20260910-120238-audit
+- Scanned Scope: C:\Users\Admin\Desktop\TorusGuard
+- Total Findings: 46
+- Root-Cause Clusters: 5
+- Generated: 2026-09-10 12:02:38 IST