torusguard 1.3.3 → 1.3.5

package/.torusguard/rules/cache/TG-CACHE-003-sensitive-data-in-url.md

@@ -1,37 +1,44 @@
-# TG-CACHE-003: Sensitive Data in URL
+# TG-CACHE-003: Sensitive Data in URL Query Parameters
 
 ## Severity
-High by default. Raise to Critical when applicable.
+Medium. Passing API keys, session tokens, passwords, or PII in URL query parameters causes secrets to be persisted in browser histories, web server access logs, and HTTP `Referer` headers.
 
 ## Applies To
-- Relevant endpoints and services
+- Authentication Flows, Invitation Links, Reset Handlers
+- Frontend JS, Express, Django, FastAPI, Go, PHP
 
 ## Why It Matters
-Explaining the risk of this vulnerability.
+URLs are routinely logged in plaintext by reverse proxies, load balancers, CDN providers, and browser histories. If tokens are in query strings (`/login?token=xyz`), any external asset loaded on the page receives the token in the `Referer` header.
 
 ## What TorusGuard Looks For
-- Specific code patterns or configurations
+- Query parameter patterns matching `api_key=`, `token=`, `secret=`, or `password=` in GET routes.
 
 ## Unsafe Example
 ```javascript
-// Unsafe code example
+// UNSAFE: Accepting credentials or tokens in URL query string
+app.get('/api/auth/callback', (req, res) => {
+  const { apiKey, password } = req.query;
+  authenticate(apiKey, password);
+});
 ```
 
 ## Safe Example
 ```javascript
-// Safe code example
+// SAFE: Passing credentials in Authorization header or POST request body
+app.post('/api/auth/token', (req, res) => {
+  const { apiKey, password } = req.body;
+  authenticate(apiKey, password);
+});
 ```
 
-## Remediation
-1. Step one
-2. Step two
-
-## Verification
-- Test case 1
-- Test case 2
+## Ponytail Remediation Budget
+- Additions: <= 6 lines
+- Deletions: <= 3 lines
 
-## False Positives and Exceptions
-An exception requires documented review.
+## Remediation
+1. Migrate authentication parameters to `Authorization: Bearer` headers or JSON request bodies via POST.
+2. Strip sensitive query parameters from URLs using history replace state before page render.
 
 ## Related Rules
-- TG-OTHER-001
+- `TG-SEC-001`: Hardcoded Secret or API Key in Tracked Source
+- `TG-SEC-004`: Sensitive Information in Logs

package/.torusguard/rules/csrf/TG-CSRF-001-missing-csrf-protection.md

@@ -1,37 +1,50 @@
 # TG-CSRF-001: Missing CSRF Protection
 
 ## Severity
-High by default. Raise to Critical when applicable.
+Critical. State-changing endpoints (POST, PUT, DELETE, PATCH) that rely on ambient credentials (cookies, basic auth) without CSRF tokens or SameSite cookie protection allow malicious third-party websites to execute actions on behalf of authenticated users.
 
 ## Applies To
-- Relevant endpoints and services
+- Traditional Form Submissions, Cookie-Authenticated REST APIs
+- Express (csurf), Django, Flask (Flask-WTF), Rails, Spring Security, ASP.NET Core
 
 ## Why It Matters
-Explaining the risk of this vulnerability.
+If a banking or SaaS application authenticates requests solely via browser cookies, a user visiting a malicious site can be tricked into submitting unauthorized form requests that the browser will automatically authenticate with the user's cookies.
 
 ## What TorusGuard Looks For
-- Specific code patterns or configurations
+- State-changing route handlers lacking CSRF middleware, CSRF tokens in headers, or explicit SameSite cookie configurations.
+- Explicit disabling of CSRF protection (e.g. `@csrf_exempt`, `csrf().disable()`).
 
 ## Unsafe Example
-```javascript
-// Unsafe code example
+```python
+# UNSAFE: Disabling CSRF protection on state-changing endpoint
+from django.views.decorators.csrf import csrf_exempt
+
+@csrf_exempt
+def update_email(request):
+    request.user.email = request.POST.get("email")
+    request.user.save()
 ```
 
 ## Safe Example
-```javascript
-// Safe code example
+```python
+# SAFE: Enforcing CSRF token verification
+from django.views.decorators.csrf import csrf_protect
+
+@csrf_protect
+def update_email(request):
+    request.user.email = request.POST.get("email")
+    request.user.save()
 ```
 
-## Remediation
-1. Step one
-2. Step two
-
-## Verification
-- Test case 1
-- Test case 2
+## Ponytail Remediation Budget
+- Additions: <= 4 lines
+- Deletions: <= 2 lines
 
-## False Positives and Exceptions
-An exception requires documented review.
+## Remediation
+1. Never disable framework CSRF protection with `@csrf_exempt` or `csrf().disable()`.
+2. Configure session cookies with `SameSite: 'Lax'` or `'Strict'`.
+3. For single-page applications, validate custom headers (e.g. `X-Requested-With`, `X-CSRF-Token`).
 
 ## Related Rules
-- TG-OTHER-001
+- `TG-AUTH-004`: Insecure Session Cookie Configuration
+- `TG-PLATFORM-001`: Wildcard CORS With Credentials

package/.torusguard/rules/csrf/TG-CSRF-002-unsafe-credentialed-cross-origin-request.md

@@ -1,37 +1,48 @@
-# TG-CSRF-002: Unsafe Credentialed Cross-Origin Request
+# TG-CSRF-002: Unsafe Credentialed Cross-Origin Requests
 
 ## Severity
-High by default. Raise to Critical when applicable.
+Critical. Enabling credentialed cross-origin access (`credentials: true` / `Access-Control-Allow-Credentials: true`) combined with dynamic reflection of incoming `Origin` headers allows any untrusted domain to read authenticated responses.
 
 ## Applies To
-- Relevant endpoints and services
+- CORS Middleware Configurations
+- Express (cors), FastAPI, Flask-CORS, Django-cors-headers, Spring Security
 
 ## Why It Matters
-Explaining the risk of this vulnerability.
+When a server blindly reflects the `Origin` header while allowing credentials, any malicious site visited by an authenticated user can make cross-origin requests and read private user data, completely circumventing the Same-Origin Policy.
 
 ## What TorusGuard Looks For
-- Specific code patterns or configurations
+- CORS configurations reflecting `req.headers.origin` directly when `credentials: true` is enabled.
 
 ## Unsafe Example
 ```javascript
-// Unsafe code example
+// UNSAFE: Blindly reflecting any origin with credentials enabled
+app.use(cors({
+  origin: (origin, callback) => callback(null, true),
+  credentials: true
+}));
 ```
 
 ## Safe Example
 ```javascript
-// Safe code example
+// SAFE: Strictly validating origin against an explicit environment allowlist
+const allowedOrigins = (process.env.ALLOWED_ORIGINS || 'https://app.example.com').split(',');
+app.use(cors({
+  origin: (origin, callback) => {
+    if (!origin || allowedOrigins.includes(origin)) return callback(null, true);
+    callback(new Error('Blocked by CORS'));
+  },
+  credentials: true
+}));
 ```
 
-## Remediation
-1. Step one
-2. Step two
-
-## Verification
-- Test case 1
-- Test case 2
+## Ponytail Remediation Budget
+- Additions: <= 8 lines
+- Deletions: <= 4 lines
 
-## False Positives and Exceptions
-An exception requires documented review.
+## Remediation
+1. Restrict CORS origins to a static, verified allowlist stored in environment variables.
+2. Never reflect untrusted `req.headers.origin` when credentials are permitted.
 
 ## Related Rules
-- TG-OTHER-001
+- `TG-PLATFORM-001`: Wildcard CORS With Credentials
+- `TG-CSRF-001`: Missing CSRF Protection

package/.torusguard/rules/graphql/TG-GQL-002-resolver-missing-authorization.md

@@ -1,37 +1,53 @@
-# TG-GQL-002: Resolver Missing Authorization
+# TG-GQL-002: GraphQL Resolver Missing Authorization
 
 ## Severity
-High by default. Raise to Critical when applicable.
+High. Exposing GraphQL mutation or query resolvers without granular user ownership or role authorization checks allows authenticated users to query or mutate records belonging to other tenants.
 
 ## Applies To
-- Relevant endpoints and services
+- GraphQL Servers (Apollo Server, Yoga, Pothos, Graphene)
+- Node.js, Python, Go, Java
 
 ## Why It Matters
-Explaining the risk of this vulnerability.
+In GraphQL, nested queries allow clients to traverse relationships (e.g. `user { organization { members { invoices } } }`). If individual field resolvers fail to assert ownership, users can traverse schema graphs to access unauthorized tenant resources.
 
 ## What TorusGuard Looks For
-- Specific code patterns or configurations
+- GraphQL resolver functions querying database entities directly by `args.id` without checking `context.user` or filtering by `context.tenantId`.
 
 ## Unsafe Example
 ```javascript
-// Unsafe code example
+// UNSAFE: Querying invoice directly by ID without checking user or tenant
+const resolvers = {
+  Query: {
+    invoice: async (_, { id }) => {
+      return await db.invoice.findUnique({ where: { id } });
+    }
+  }
+};
 ```
 
 ## Safe Example
 ```javascript
-// Safe code example
+// SAFE: Scoping query by tenant and authenticated user context
+const resolvers = {
+  Query: {
+    invoice: async (_, { id }, context) => {
+      if (!context.user) throw new Error('Unauthorized');
+      return await db.invoice.findFirst({
+        where: { id, tenantId: context.user.tenantId }
+      });
+    }
+  }
+};
 ```
 
-## Remediation
-1. Step one
-2. Step two
-
-## Verification
-- Test case 1
-- Test case 2
+## Ponytail Remediation Budget
+- Additions: <= 8 lines
+- Deletions: <= 2 lines
 
-## False Positives and Exceptions
-An exception requires documented review.
+## Remediation
+1. Enforce shield/guard middleware or resolver-level ownership checks on all query and mutation fields.
+2. Pass authenticated `context` to all database queries and enforce `tenantId` constraints.
 
 ## Related Rules
-- TG-OTHER-001
+- `TG-DB-004`: Missing Multi-Tenant Query Isolation
+- `TG-AUTH-003`: Missing Object-Level Authorization (IDOR)

package/.torusguard/rules/graphql/TG-GQL-003-unbounded-graphql-pagination-or-batching.md

@@ -1,37 +1,52 @@
 # TG-GQL-003: Unbounded GraphQL Pagination or Batching
 
 ## Severity
-High by default. Raise to Critical when applicable.
+Medium. Permitting unbounded `first`, `limit`, or batching queries in GraphQL enables resource exhaustion and Denial of Service (DoS).
 
 ## Applies To
-- Relevant endpoints and services
+- Apollo Server, GraphQL Yoga, Graphene
+- Node.js, Python, Go
 
 ## Why It Matters
-Explaining the risk of this vulnerability.
+Clients can request `users(first: 1000000)` or send a batched array of 500 queries in a single HTTP request, forcing the server to exhaust memory and database connection pools.
 
 ## What TorusGuard Looks For
-- Specific code patterns or configurations
+- Resolvers accepting integer `first` / `limit` arguments without enforcing a maximum cap (e.g. `Math.min(limit, 100)`).
 
 ## Unsafe Example
 ```javascript
-// Unsafe code example
+// UNSAFE: Directly passing client-controlled limit to database
+const resolvers = {
+  Query: {
+    users: async (_, { limit = 50 }) => {
+      return await db.user.findMany({ take: limit }); // Attacker passes limit: 500000
+    }
+  }
+};
 ```
 
 ## Safe Example
 ```javascript
-// Safe code example
+// SAFE: Enforcing strict maximum upper bound on pagination
+const MAX_LIMIT = 100;
+const resolvers = {
+  Query: {
+    users: async (_, { limit = 20 }) => {
+      const safeLimit = Math.min(Math.max(1, limit), MAX_LIMIT);
+      return await db.user.findMany({ take: safeLimit });
+    }
+  }
+};
 ```
 
-## Remediation
-1. Step one
-2. Step two
-
-## Verification
-- Test case 1
-- Test case 2
+## Ponytail Remediation Budget
+- Additions: <= 5 lines
+- Deletions: <= 2 lines
 
-## False Positives and Exceptions
-An exception requires documented review.
+## Remediation
+1. Enforce maximum limit boundaries on all pagination arguments.
+2. Disable batched HTTP query execution unless explicitly required.
 
 ## Related Rules
-- TG-OTHER-001
+- `TG-RATE-003`: Unbounded Resource Consumption
+- `TG-GQL-001`: Missing Query Depth Limits

package/.torusguard/rules/graphql/TG-GQL-004-unnecessary-production-introspection.md

@@ -1,37 +1,46 @@
 # TG-GQL-004: Unnecessary Production Introspection
 
 ## Severity
-High by default. Raise to Critical when applicable.
+Medium. Enabling GraphQL schema introspection in production environments reveals full schema types, queries, mutations, and deprecated fields to external attackers.
 
 ## Applies To
-- Relevant endpoints and services
+- GraphQL Servers (Apollo, Yoga, Mercurius, Helix)
+- Production Node.js, Python, Go deployments
 
 ## Why It Matters
-Explaining the risk of this vulnerability.
+While introspection powers developer tools like Apollo Studio and GraphiQL, in production it provides attackers with an automated blueprint of the internal API surface, administrative fields, and hidden parameters.
 
 ## What TorusGuard Looks For
-- Specific code patterns or configurations
+- GraphQL server initialization setting `introspection: true` or failing to disable introspection when `NODE_ENV === 'production'`.
 
 ## Unsafe Example
 ```javascript
-// Unsafe code example
+// UNSAFE: Introspection unconditionally enabled
+const server = new ApolloServer({
+  typeDefs,
+  resolvers,
+  introspection: true
+});
 ```
 
 ## Safe Example
 ```javascript
-// Safe code example
+// SAFE: Introspection restricted to non-production environments
+const server = new ApolloServer({
+  typeDefs,
+  resolvers,
+  introspection: process.env.NODE_ENV !== 'production'
+});
 ```
 
-## Remediation
-1. Step one
-2. Step two
-
-## Verification
-- Test case 1
-- Test case 2
+## Ponytail Remediation Budget
+- Additions: <= 2 lines
+- Deletions: <= 2 lines
 
-## False Positives and Exceptions
-An exception requires documented review.
+## Remediation
+1. Bind `introspection` to environment checks (`process.env.NODE_ENV !== 'production'`).
+2. Disable GraphQL Playground and Apollo Sandbox in production.
 
 ## Related Rules
-- TG-OTHER-001
+- `TG-PLATFORM-003`: Production Stack Trace Exposure
+- `TG-CLIENT-001`: Public Production Source Maps

package/.torusguard/rules/secrets/TG-SEC-005-secret-in-git-history.md

@@ -1,37 +1,42 @@
-# TG-SEC-005: Secret in Git History
+# TG-SEC-005: Secret or Private Key in Git History
 
 ## Severity
-High by default. Raise to Critical when applicable.
+Critical. Committing private API keys, credentials, or private certificates into git history persists them permanently across all cloned repositories, even if deleted in subsequent commits.
 
 ## Applies To
-- Relevant endpoints and services
+- Git Repositories, Public and Private Remotes
+- All Languages & Frameworks
 
 ## Why It Matters
-Explaining the risk of this vulnerability.
+Deleting a secret file in a follow-up commit (`git rm .env`) does NOT remove it from git history. Attackers clone public repositories and run scanners (`git log -p`) to extract historical secrets within seconds.
 
 ## What TorusGuard Looks For
-- Specific code patterns or configurations
+- Git commit objects or patch diffs containing private keys, AWS access keys, or JWT secret strings.
 
 ## Unsafe Example
-```javascript
-// Unsafe code example
+```bash
+# UNSAFE: Adding .env with live credentials directly to git tracking
+git add .env
+git commit -m "Add production database credentials"
 ```
 
 ## Safe Example
-```javascript
-// Safe code example
+```bash
+# SAFE: Keeping .env in .gitignore; using .env.example with placeholder tokens
+echo ".env" >> .gitignore
+git add .gitignore .env.example
+git commit -m "Add environment configuration baseline"
 ```
 
-## Remediation
-1. Step one
-2. Step two
-
-## Verification
-- Test case 1
-- Test case 2
+## Ponytail Remediation Budget
+- Additions: <= 2 lines
+- Deletions: <= 2 lines
 
-## False Positives and Exceptions
-An exception requires documented review.
+## Remediation
+1. Immediately rotate any secret that was committed to git history.
+2. Use tools like `git-filter-repo` or BFG Repo-Cleaner to purge the commit blob from repository history.
+3. Add `.env` and `*.pem` to `.gitignore`.
 
 ## Related Rules
-- TG-OTHER-001
+- `TG-SEC-001`: Hardcoded Secret or API Key in Tracked Source
+- `TG-SEC-003`: Unencrypted Secret in Tracked Config File

package/.torusguard/rules/secrets/TG-SEC-006-secret-in-build-artifact.md

@@ -1,37 +1,54 @@
-# TG-SEC-006: Secret in Build Artifact
+# TG-SEC-006: Secret in Build Artifact or Container Image
 
 ## Severity
-High by default. Raise to Critical when applicable.
+Critical. Copying `.env` files, build-time secrets, or SSH keys into Docker build layers persists secrets in image layers, allowing anyone with pull access to extract credentials via `docker history` or container inspection.
 
 ## Applies To
-- Relevant endpoints and services
+- Dockerfiles, Container Builds, Serverless Bundle Artifacts
+- Docker, Containerd, Podman, Webpack, Vite
 
 ## Why It Matters
-Explaining the risk of this vulnerability.
+Docker image layers are cached and stored individually. Running `COPY .env .` followed by `RUN rm .env` still retains the `.env` file in the preceding layer blob, allowing trivial credential recovery.
 
 ## What TorusGuard Looks For
-- Specific code patterns or configurations
+- Dockerfile instructions containing `COPY .env` or `ARG SECRET_KEY` without BuildKit secret mount protection.
 
 ## Unsafe Example
-```javascript
-// Unsafe code example
+```dockerfile
+# UNSAFE: Copying local .env into container layer
+FROM node:20-alpine
+WORKDIR /app
+COPY package*.json ./
+RUN npm ci
+COPY .env .
+COPY . .
+RUN npm run build
 ```
 
 ## Safe Example
-```javascript
-// Safe code example
+```dockerfile
+# SAFE: Using BuildKit secret mounts or multi-stage build without persisting secrets
+# syntax=docker/dockerfile:1.4
+FROM node:20-alpine AS builder
+WORKDIR /app
+COPY package*.json ./
+RUN npm ci
+COPY . .
+RUN --mount=type=secret,id=build_secrets npm run build
+
+FROM node:20-alpine
+WORKDIR /app
+COPY --from=builder /app/dist ./dist
 ```
 
-## Remediation
-1. Step one
-2. Step two
-
-## Verification
-- Test case 1
-- Test case 2
+## Ponytail Remediation Budget
+- Additions: <= 5 lines
+- Deletions: <= 2 lines
 
-## False Positives and Exceptions
-An exception requires documented review.
+## Remediation
+1. Use Docker BuildKit secret mounts (`--mount=type=secret`) for credentials needed during build.
+2. Use multi-stage Docker builds to ensure final runtime images only contain compiled frontend assets.
 
 ## Related Rules
-- TG-OTHER-001
+- `TG-SUPPLY-006`: Container Build Secret Persistence
+- `TG-SEC-001`: Hardcoded Secret or API Key in Tracked Source

package/.torusguard/rules/secrets/TG-SEC-007-secret-in-test-or-example-fixture.md

@@ -1,37 +1,42 @@
 # TG-SEC-007: Secret in Test or Example Fixture
 
 ## Severity
-High by default. Raise to Critical when applicable.
+Medium. Committing real production or staging credentials into test fixtures, mocks, or example configuration files leaks secrets under the assumption that test directories are unmonitored.
 
 ## Applies To
-- Relevant endpoints and services
+- Test Suites, Mock Fixtures, Example Configs
+- All Languages & Frameworks
 
 ## Why It Matters
-Explaining the risk of this vulnerability.
+Developers often copy live payload captures from production to create integration tests or seed fixtures. If these fixtures contain real API keys or customer JWT tokens, they are exposed in source control.
 
 ## What TorusGuard Looks For
-- Specific code patterns or configurations
+- High-entropy tokens, Stripe live keys (`sk_live_`), or valid JWT signatures present in `tests/`, `fixtures/`, or `examples/` directories.
 
 ## Unsafe Example
 ```javascript
-// Unsafe code example
+// UNSAFE: Real active production API key used in test fixture
+const mockAuth = {
+  apiKey: "sk_live_51M0...REAL_STRIPE_LIVE_KEY_12345"
+};
 ```
 
 ## Safe Example
 ```javascript
-// Safe code example
+// SAFE: Explicit synthetic mock sentinel string
+const mockAuth = {
+  apiKey: "sk_test_fake_mock_token_for_unit_tests_only"
+};
 ```
 
-## Remediation
-1. Step one
-2. Step two
-
-## Verification
-- Test case 1
-- Test case 2
+## Ponytail Remediation Budget
+- Additions: <= 2 lines
+- Deletions: <= 2 lines
 
-## False Positives and Exceptions
-An exception requires documented review.
+## Remediation
+1. Replace all real credentials in test directories with synthetic, inert mock sentinels (`test_token_dummy`).
+2. Rotate any credentials that were copied from production to test files.
 
 ## Related Rules
-- TG-OTHER-001
+- `TG-SEC-001`: Hardcoded Secret or API Key in Tracked Source
+- `TG-SEC-004`: Sensitive Information in Logs