torusguard 1.3.4 → 1.3.5

package/.torusguard/runs/run-20260912-215555-audit/bundles/bnd-tg-rate-001-26-affcfa/minimal_patch_plan.md

@@ -0,0 +1,21 @@
+# Remediation Plan: bnd-tg-rate-001-26-affcfa
+- **Rule ID:** `TG-RATE-001`
+- **Target File:** `examples/vulnerable-react-express/server/index.js:26`
+- **Ponytail Churn:** `+1 / -1` (Compliant <=35/<=25)
+
+## Proposed Change
+Injected authLimiter rate-limiting middleware to protect authentication endpoint from brute force
+
+## Unified Diff Preview
+```diff
+--- a/examples/vulnerable-react-express/server/index.js
++++ b/examples/vulnerable-react-express/server/index.js
+@@ -24,5 +24,5 @@
+ // TG-SEC-004: Logs sensitive data
+ // TG-AUTH-004: Insecure cookie (no httpOnly/Secure/SameSite)
+-app.post('/api/login', (req, res) => {
++app.post('/api/login', authLimiter, (req, res) => {
+   const { email, password } = req.body;
+   console.log('Login attempt:', { email, password }); // TG-SEC-004
+
+```

package/.torusguard/runs/run-20260912-215555-audit/bundles/bnd-tg-rate-001-26-affcfa/patch.diff

@@ -0,0 +1,9 @@
+--- a/examples/vulnerable-react-express/server/index.js
++++ b/examples/vulnerable-react-express/server/index.js
+@@ -24,5 +24,5 @@
+ // TG-SEC-004: Logs sensitive data
+ // TG-AUTH-004: Insecure cookie (no httpOnly/Secure/SameSite)
+-app.post('/api/login', (req, res) => {
++app.post('/api/login', authLimiter, (req, res) => {
+   const { email, password } = req.body;
+   console.log('Login attempt:', { email, password }); // TG-SEC-004

package/.torusguard/runs/run-20260912-215555-audit/bundles/bnd-tg-sec-001-9-e22e50/metadata.json

@@ -0,0 +1,17 @@
+{
+  "bundle_id": "bnd-tg-sec-001-9-e22e50",
+  "finding_id": "TG-SEC-001-bb5e4b77",
+  "rule_id": "TG-SEC-001",
+  "title": "Hardcoded Secret or API Key in Tracked Source",
+  "target_file": "examples/vulnerable-react-express/server/index.js",
+  "line_number": 9,
+  "target_line": "const JWT_SECRET = 'FAKE_DEMO_JWT_SECRET_NOT_FOR_PRODUCTION';",
+  "replacement_line": "const JWT_SECRET = process.env.JWT_SECRET || \"\";",
+  "what_is_wrong": "Hardcoded JWT signing secret",
+  "why_it_matters": "Security vulnerability violating TorusGuard strict production safety invariant.",
+  "what_should_change": "Migrated hardcoded JWT secret to environment variable process.env.JWT_SECRET",
+  "proposed_diff": "--- a/examples/vulnerable-react-express/server/index.js\n+++ b/examples/vulnerable-react-express/server/index.js\n@@ -7,5 +7,5 @@\n \n // TG-SEC-001: Hardcoded JWT secret\n-const JWT_SECRET = 'FAKE_DEMO_JWT_SECRET_NOT_FOR_PRODUCTION';\n+const JWT_SECRET = process.env.JWT_SECRET || \"\";\n \n // TG-PLATFORM-001: Wildcard CORS with credentials\n",
+  "additions": 1,
+  "deletions": 1,
+  "patched_content": "const express = require('express');\nconst cors = require('cors');\nconst jwt = require('jsonwebtoken');\n\nconst app = express();\nconst PORT = 3001;\n\n// TG-SEC-001: Hardcoded JWT secret\nconst JWT_SECRET = process.env.JWT_SECRET || \"\";\n\n// TG-PLATFORM-001: Wildcard CORS with credentials\napp.use(cors({ origin: '*', credentials: true }));\n\n// TG-PLATFORM-004: No explicit JSON body size limit\napp.use(express.json());\n\nconst users = [\n  { id: '1', email: 'alice@demo.local', password: 'password123', name: 'Alice' },\n  { id: '2', email: 'bob@demo.local', password: 'secret456', name: 'Bob' },\n];\n\n// TG-RATE-001: No rate limit on login\n// TG-AUTH-001: Plaintext password comparison\n// TG-SEC-004: Logs sensitive data\n// TG-AUTH-004: Insecure cookie (no httpOnly/Secure/SameSite)\napp.post('/api/login', (req, res) => {\n  const { email, password } = req.body;\n  console.log('Login attempt:', { email, password }); // TG-SEC-004\n  const user = users.find((u) => u.email === email && u.password === password);\n  if (!user) return res.status(401).json({ error: 'User not found' }); // enumeration\n  const token = jwt.sign({ id: user.id }, JWT_SECRET);\n  res.cookie('token', token);\n  res.json({ message: 'ok', token, user });\n});\n\n// TG-AUTH-003: IDOR \u2014 no ownership check\napp.get('/api/users/:id', (req, res) => {\n  const user = users.find((u) => u.id === req.params.id);\n  if (!user) return res.status(404).json({ error: 'Not found' });\n  res.json(user);\n});\n\n// TG-INPUT-002: SQL concatenation (simulated query string)\n// TG-RATE-003: Unbounded results\napp.get('/api/search', (req, res) => {\n  const q = req.query.q || '';\n  const fakeSql = `SELECT * FROM users WHERE email LIKE '%${q}%'`;\n  const results = users.filter((u) => u.email.includes(q));\n  res.json({ query: fakeSql, results });\n});\n\n// TG-INPUT-001: No validation\n// TG-RATE-002: Unlimited contact endpoint\napp.post('/api/contact', (req, res) => {\n  res.json({ received: req.body });\n});\n\n// TG-RATE-002: Unlimited AI endpoint\napp.post('/api/ai', (req, res) => {\n  res.json({ reply: 'demo', prompt: req.body.prompt });\n});\n\n// TG-INPUT-004: Unrestricted upload (stub)\napp.post('/api/upload', (req, res) => {\n  res.json({ saved: req.body.filename });\n});\n\n// TG-AUTH-005: Unsafe password reset\napp.post('/api/reset', (req, res) => {\n  const { email } = req.body;\n  const user = users.find((u) => u.email === email);\n  if (!user) return res.status(404).json({ error: 'Email not registered' }); // enumeration\n  const token = `reset-${user.id}-12345`; // predictable\n  res.json({ resetToken: token });\n});\n\napp.use((err, req, res, next) => {\n  // TG-PLATFORM-003: Stack trace exposed\n  res.status(500).json({ error: err.message, stack: err.stack });\n});\n\napp.listen(PORT, () => console.log(`Vulnerable demo server http://localhost:${PORT}`));"
+}

package/.torusguard/runs/run-20260912-215555-audit/bundles/bnd-tg-sec-001-9-e22e50/minimal_patch_plan.md

@@ -0,0 +1,21 @@
+# Remediation Plan: bnd-tg-sec-001-9-e22e50
+- **Rule ID:** `TG-SEC-001`
+- **Target File:** `examples/vulnerable-react-express/server/index.js:9`
+- **Ponytail Churn:** `+1 / -1` (Compliant <=35/<=25)
+
+## Proposed Change
+Migrated hardcoded JWT secret to environment variable process.env.JWT_SECRET
+
+## Unified Diff Preview
+```diff
+--- a/examples/vulnerable-react-express/server/index.js
++++ b/examples/vulnerable-react-express/server/index.js
+@@ -7,5 +7,5 @@
+ 
+ // TG-SEC-001: Hardcoded JWT secret
+-const JWT_SECRET = 'FAKE_DEMO_JWT_SECRET_NOT_FOR_PRODUCTION';
++const JWT_SECRET = process.env.JWT_SECRET || "";
+ 
+ // TG-PLATFORM-001: Wildcard CORS with credentials
+
+```

package/.torusguard/runs/run-20260912-215555-audit/bundles/bnd-tg-sec-001-9-e22e50/patch.diff

@@ -0,0 +1,9 @@
+--- a/examples/vulnerable-react-express/server/index.js
++++ b/examples/vulnerable-react-express/server/index.js
+@@ -7,5 +7,5 @@
+ 
+ // TG-SEC-001: Hardcoded JWT secret
+-const JWT_SECRET = 'FAKE_DEMO_JWT_SECRET_NOT_FOR_PRODUCTION';
++const JWT_SECRET = process.env.JWT_SECRET || "";
+ 
+ // TG-PLATFORM-001: Wildcard CORS with credentials

package/.torusguard/runs/run-20260912-215555-audit/bundles/bnd-tg-ssrf-004-9-9803ad/metadata.json

@@ -0,0 +1,17 @@
+{
+  "bundle_id": "bnd-tg-ssrf-004-9-9803ad",
+  "finding_id": "TG-SSRF-004-d8472223",
+  "rule_id": "TG-SSRF-004",
+  "title": "Unbounded Outbound Request Without Timeout",
+  "target_file": "examples/python/fastapi-vuln/main.py",
+  "line_number": 9,
+  "target_line": "    response = requests.get(url)",
+  "replacement_line": "    response = requests.get(url, timeout=10)",
+  "what_is_wrong": "Python requests call without explicit timeout parameter",
+  "why_it_matters": "Security vulnerability violating TorusGuard strict production safety invariant.",
+  "what_should_change": "Injected explicit 10-second request timeout to prevent resource exhaustion",
+  "proposed_diff": "--- a/examples/python/fastapi-vuln/main.py\n+++ b/examples/python/fastapi-vuln/main.py\n@@ -7,5 +7,5 @@\n @app.get(\"/fetch\")\n def fetch_url(url: str):\n-    response = requests.get(url)\n+    response = requests.get(url, timeout=10)\n     return {\"status\": response.status_code, \"content\": response.text}\n \n",
+  "additions": 1,
+  "deletions": 1,
+  "patched_content": "from fastapi import FastAPI\nimport requests\n\napp = FastAPI()\n\n# \u274c TG-SSRF-001: Unvalidated outbound URL fetching\n@app.get(\"/fetch\")\ndef fetch_url(url: str):\n    response = requests.get(url, timeout=10)\n    return {\"status\": response.status_code, \"content\": response.text}\n\n# \u274c TG-WEBHOOK-001: Unverified webhook payload\n@app.post(\"/webhook\")\ndef receive_webhook(payload: dict):\n    return {\"status\": \"success\", \"data\": payload}\n\n# \u274c TG-AUTH-006: Unfiltered dict mass assignment\n@app.post(\"/update_profile\")\ndef update_profile(user_id: int, updates: dict):\n    return {\"status\": \"updated\", \"user_id\": user_id, \"updates\": updates}"
+}

package/.torusguard/runs/run-20260912-215555-audit/bundles/bnd-tg-ssrf-004-9-9803ad/minimal_patch_plan.md

@@ -0,0 +1,21 @@
+# Remediation Plan: bnd-tg-ssrf-004-9-9803ad
+- **Rule ID:** `TG-SSRF-004`
+- **Target File:** `examples/python/fastapi-vuln/main.py:9`
+- **Ponytail Churn:** `+1 / -1` (Compliant <=35/<=25)
+
+## Proposed Change
+Injected explicit 10-second request timeout to prevent resource exhaustion
+
+## Unified Diff Preview
+```diff
+--- a/examples/python/fastapi-vuln/main.py
++++ b/examples/python/fastapi-vuln/main.py
+@@ -7,5 +7,5 @@
+ @app.get("/fetch")
+ def fetch_url(url: str):
+-    response = requests.get(url)
++    response = requests.get(url, timeout=10)
+     return {"status": response.status_code, "content": response.text}
+ 
+
+```

package/.torusguard/runs/run-20260912-215555-audit/bundles/bnd-tg-ssrf-004-9-9803ad/patch.diff

@@ -0,0 +1,9 @@
+--- a/examples/python/fastapi-vuln/main.py
++++ b/examples/python/fastapi-vuln/main.py
+@@ -7,5 +7,5 @@
+ @app.get("/fetch")
+ def fetch_url(url: str):
+-    response = requests.get(url)
++    response = requests.get(url, timeout=10)
+     return {"status": response.status_code, "content": response.text}
+