torusguard 1.3.4 → 1.3.6

package/.torusguard/runs/run-20260912-215555-audit/findings.json

@@ -0,0 +1,530 @@
+[
+  {
+    "finding_id": "TG-SEC-001-bb5e4b77",
+    "rule_id": "TG-SEC-001",
+    "title": "Hardcoded Secret or API Key in Tracked Source",
+    "description": "Hardcoded JWT signing secret",
+    "severity": "Critical",
+    "category": "secrets",
+    "cluster": "cluster-credentials-exposure",
+    "file_path": "examples/vulnerable-react-express/server/index.js",
+    "line_number": 9,
+    "matched_text": "JWT_SECRET = 'FAKE_DEMO_JWT_SECRET_NOT_FOR_PRODUCTION'",
+    "snippet": "\n// TG-SEC-001: Hardcoded JWT secret\nconst JWT_SECRET = 'FAKE_DEMO_JWT_SECRET_NOT_FOR_PRODUCTION';\n\n// TG-PLATFORM-001: Wildcard CORS with credentials",
+    "is_test": false,
+    "target": {
+      "file_path": "examples/vulnerable-react-express/server/index.js",
+      "start_line": 9,
+      "end_line": 9
+    },
+    "confidence_score": 80,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 25,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 80,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-SEC-001-c393d596",
+    "rule_id": "TG-SEC-001",
+    "title": "Hardcoded Secret or API Key in Tracked Source",
+    "description": "Hardcoded credential or API secret string",
+    "severity": "Critical",
+    "category": "secrets",
+    "cluster": "cluster-credentials-exposure",
+    "file_path": "examples/vulnerable-react-express/server/index.js",
+    "line_number": 18,
+    "matched_text": "password: 'password123'",
+    "snippet": "\nconst users = [\n  { id: '1', email: 'alice@demo.local', password: 'password123', name: 'Alice' },\n  { id: '2', email: 'bob@demo.local', password: 'secret456', name: 'Bob' },\n];",
+    "is_test": false,
+    "target": {
+      "file_path": "examples/vulnerable-react-express/server/index.js",
+      "start_line": 18,
+      "end_line": 18
+    },
+    "confidence_score": 80,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 25,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 80,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-DB-002-d9bd69df",
+    "rule_id": "TG-DB-002",
+    "title": "Privileged Database Credential in Browser Context",
+    "description": "Service role key or raw database connection string reference in frontend code",
+    "severity": "Critical",
+    "category": "database",
+    "cluster": "cluster-client-leak",
+    "file_path": "demo/playground/vulnerable_nextjs/actions.ts",
+    "line_number": 9,
+    "matched_text": "SUPABASE_SERVICE_ROLE_KEY",
+    "snippet": "\n// Finding 1: TG-CLIENT-001 - Backend admin key exposed in client-accessible code\nexport const SUPABASE_SERVICE_ROLE_KEY = \"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.demo_secret_token_1234567890\";\n\ninterface UserRecord {",
+    "is_test": false,
+    "target": {
+      "file_path": "demo/playground/vulnerable_nextjs/actions.ts",
+      "start_line": 9,
+      "end_line": 9
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-SSRF-004-dcf3f71e",
+    "rule_id": "TG-SSRF-004",
+    "title": "Unbounded Outbound Request Without Timeout",
+    "description": "Python requests call without explicit timeout parameter",
+    "severity": "Critical",
+    "category": "ssrf",
+    "cluster": "cluster-ssrf",
+    "file_path": "examples/python/fastapi-hardened/main.py",
+    "line_number": 30,
+    "matched_text": "requests.get(url, timeout=5)",
+    "snippet": "    if not is_safe_url(url):\n        raise HTTPException(status_code=400, detail=\"Invalid destination address\")\n    response = requests.get(url, timeout=5)\n    return {\"status\": response.status_code, \"content\": response.text}\n",
+    "is_test": false,
+    "target": {
+      "file_path": "examples/python/fastapi-hardened/main.py",
+      "start_line": 30,
+      "end_line": 30
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-SSRF-004-d8472223",
+    "rule_id": "TG-SSRF-004",
+    "title": "Unbounded Outbound Request Without Timeout",
+    "description": "Python requests call without explicit timeout parameter",
+    "severity": "Critical",
+    "category": "ssrf",
+    "cluster": "cluster-ssrf",
+    "file_path": "examples/python/fastapi-vuln/main.py",
+    "line_number": 9,
+    "matched_text": "requests.get(url)",
+    "snippet": "@app.get(\"/fetch\")\ndef fetch_url(url: str):\n    response = requests.get(url)\n    return {\"status\": response.status_code, \"content\": response.text}\n",
+    "is_test": false,
+    "target": {
+      "file_path": "examples/python/fastapi-vuln/main.py",
+      "start_line": 9,
+      "end_line": 9
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-INPUT-003-fea9421e",
+    "rule_id": "TG-INPUT-003",
+    "title": "Unsafe Dynamic Code or HTML Execution",
+    "description": "React dangerouslySetInnerHTML rendering raw unescaped HTML",
+    "severity": "High",
+    "category": "injection",
+    "cluster": "cluster-injection",
+    "file_path": "examples/vulnerable-react-express/client/src/App.jsx",
+    "line_number": 53,
+    "matched_text": "dangerouslySetInnerHTML=",
+    "snippet": "\n      {/* TG-INPUT-003: Unsafe HTML rendering */}\n      <div dangerouslySetInnerHTML={{ __html: bio }} />\n\n      <button onClick={fetchUser}>Fetch user (IDOR demo)</button>",
+    "is_test": false,
+    "target": {
+      "file_path": "examples/vulnerable-react-express/client/src/App.jsx",
+      "start_line": 53,
+      "end_line": 53
+    },
+    "confidence_score": 80,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 25,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 80,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-PLATFORM-001-7dd35cb4",
+    "rule_id": "TG-PLATFORM-001",
+    "title": "Wildcard CORS With Credentials",
+    "description": "Wildcard CORS origin configured in Express middleware",
+    "severity": "High",
+    "category": "platform",
+    "cluster": "cluster-auth-bypass",
+    "file_path": "examples/vulnerable-react-express/server/index.js",
+    "line_number": 12,
+    "matched_text": "cors({ origin: '*'",
+    "snippet": "\n// TG-PLATFORM-001: Wildcard CORS with credentials\napp.use(cors({ origin: '*', credentials: true }));\n\n// TG-PLATFORM-004: No explicit JSON body size limit",
+    "is_test": false,
+    "target": {
+      "file_path": "examples/vulnerable-react-express/server/index.js",
+      "start_line": 12,
+      "end_line": 12
+    },
+    "confidence_score": 80,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 25,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 80,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-AUTH-003-6a05e509",
+    "rule_id": "TG-AUTH-003",
+    "title": "Missing Object-Level Authorization (IDOR)",
+    "description": "JWT verification missing explicit algorithms restriction parameter",
+    "severity": "High",
+    "category": "auth",
+    "cluster": "cluster-auth-bypass",
+    "file_path": "examples/hardened-react-express/server/index.js",
+    "line_number": 49,
+    "matched_text": "jwt.verify(token, process.env.JWT_SECRET)",
+    "snippet": "  if (!token) return res.status(401).json({ error: 'Unauthorized' });\n  try {\n    req.user = jwt.verify(token, process.env.JWT_SECRET);\n    next();\n  } catch {",
+    "is_test": false,
+    "target": {
+      "file_path": "examples/hardened-react-express/server/index.js",
+      "start_line": 49,
+      "end_line": 49
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-INPUT-001-c7457f38",
+    "rule_id": "TG-INPUT-001",
+    "title": "Missing Server-Side Request Validation",
+    "description": "Destructuring unvalidated req.body without schema validation",
+    "severity": "High",
+    "category": "injection",
+    "cluster": "cluster-injection",
+    "file_path": "examples/vulnerable-react-express/server/index.js",
+    "line_number": 27,
+    "matched_text": "const { email, password } = req.body;",
+    "snippet": "// TG-AUTH-004: Insecure cookie (no httpOnly/Secure/SameSite)\napp.post('/api/login', (req, res) => {\n  const { email, password } = req.body;\n  console.log('Login attempt:', { email, password }); // TG-SEC-004\n  const user = users.find((u) => u.email === email && u.password === password);",
+    "is_test": false,
+    "target": {
+      "file_path": "examples/vulnerable-react-express/server/index.js",
+      "start_line": 27,
+      "end_line": 27
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-RATE-001-dcd0a3c7",
+    "rule_id": "TG-RATE-001",
+    "title": "Unlimited Authentication Endpoint",
+    "description": "Authentication POST endpoint defined without rate-limiting middleware",
+    "severity": "High",
+    "category": "rate",
+    "cluster": "cluster-rate-limiting",
+    "file_path": "examples/vulnerable-react-express/server/index.js",
+    "line_number": 26,
+    "matched_text": "app.post('/api/login', (",
+    "snippet": "// TG-SEC-004: Logs sensitive data\n// TG-AUTH-004: Insecure cookie (no httpOnly/Secure/SameSite)\napp.post('/api/login', (req, res) => {\n  const { email, password } = req.body;\n  console.log('Login attempt:', { email, password }); // TG-SEC-004",
+    "is_test": false,
+    "target": {
+      "file_path": "examples/vulnerable-react-express/server/index.js",
+      "start_line": 26,
+      "end_line": 26
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-PLATFORM-002-1f383dcf",
+    "rule_id": "TG-PLATFORM-002",
+    "title": "Missing Security Headers",
+    "description": "Express application initialized without helmet security headers middleware",
+    "severity": "Medium",
+    "category": "platform",
+    "cluster": "cluster-platform",
+    "file_path": "examples/hardened-react-express/server/index.js",
+    "line_number": 17,
+    "matched_text": "const app = express();",
+    "snippet": "}\n\nconst app = express();\nconst PORT = 3001;\nconst isProd = process.env.NODE_ENV === 'production';",
+    "is_test": false,
+    "target": {
+      "file_path": "examples/hardened-react-express/server/index.js",
+      "start_line": 17,
+      "end_line": 17
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-SEC-004-dbbc17f7",
+    "rule_id": "TG-SEC-004",
+    "title": "Sensitive Information in Logs",
+    "description": "Plaintext credential or token logged to output sink",
+    "severity": "Medium",
+    "category": "secrets",
+    "cluster": "cluster-credentials-exposure",
+    "file_path": "examples/vulnerable-react-express/client/src/App.jsx",
+    "line_number": 30,
+    "matched_text": "console.log('Login token:', data.token, 'config:', clientConfig)",
+    "snippet": "    const data = await res.json();\n    // TG-CLIENT-002: Sensitive console logging\n    console.log('Login token:', data.token, 'config:', clientConfig);\n    setMessage(JSON.stringify(data));\n  }",
+    "is_test": false,
+    "target": {
+      "file_path": "examples/vulnerable-react-express/client/src/App.jsx",
+      "start_line": 30,
+      "end_line": 30
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-CLIENT-001-1ba4789e",
+    "rule_id": "TG-CLIENT-001",
+    "title": "Public Production Source Maps",
+    "description": "Build config emitting unminified source maps in production output",
+    "severity": "Medium",
+    "category": "client",
+    "cluster": "cluster-client-leak",
+    "file_path": "examples/vulnerable-react-express/client/vite.config.js",
+    "line_number": 7,
+    "matched_text": "sourcemap: true",
+    "snippet": "export default defineConfig({\n  plugins: [react()],\n  build: { sourcemap: true },\n  server: {\n    port: 5173,",
+    "is_test": false,
+    "target": {
+      "file_path": "examples/vulnerable-react-express/client/vite.config.js",
+      "start_line": 7,
+      "end_line": 7
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-SEC-004-08753da5",
+    "rule_id": "TG-SEC-004",
+    "title": "Sensitive Information in Logs",
+    "description": "Plaintext credential or token logged to output sink",
+    "severity": "Medium",
+    "category": "secrets",
+    "cluster": "cluster-credentials-exposure",
+    "file_path": "examples/vulnerable-react-express/server/index.js",
+    "line_number": 28,
+    "matched_text": "console.log('Login attempt:', { email, password })",
+    "snippet": "app.post('/api/login', (req, res) => {\n  const { email, password } = req.body;\n  console.log('Login attempt:', { email, password }); // TG-SEC-004\n  const user = users.find((u) => u.email === email && u.password === password);\n  if (!user) return res.status(401).json({ error: 'User not found' }); // enumeration",
+    "is_test": false,
+    "target": {
+      "file_path": "examples/vulnerable-react-express/server/index.js",
+      "start_line": 28,
+      "end_line": 28
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-RATE-002-d67d7c98",
+    "rule_id": "TG-RATE-002",
+    "title": "Unlimited Public Write Endpoint",
+    "description": "Public submission endpoint defined without rate-limiting or captcha defense",
+    "severity": "Medium",
+    "category": "rate",
+    "cluster": "cluster-rate-limiting",
+    "file_path": "examples/vulnerable-react-express/server/index.js",
+    "line_number": 54,
+    "matched_text": "app.post('/api/contact', (",
+    "snippet": "// TG-INPUT-001: No validation\n// TG-RATE-002: Unlimited contact endpoint\napp.post('/api/contact', (req, res) => {\n  res.json({ received: req.body });\n});",
+    "is_test": false,
+    "target": {
+      "file_path": "examples/vulnerable-react-express/server/index.js",
+      "start_line": 54,
+      "end_line": 54
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  },
+  {
+    "finding_id": "TG-PLATFORM-002-eef342ec",
+    "rule_id": "TG-PLATFORM-002",
+    "title": "Missing Security Headers",
+    "description": "Express application initialized without helmet security headers middleware",
+    "severity": "Medium",
+    "category": "platform",
+    "cluster": "cluster-platform",
+    "file_path": "examples/vulnerable-react-express/server/index.js",
+    "line_number": 5,
+    "matched_text": "const app = express();",
+    "snippet": "const jwt = require('jsonwebtoken');\n\nconst app = express();\nconst PORT = 3001;\n",
+    "is_test": false,
+    "target": {
+      "file_path": "examples/vulnerable-react-express/server/index.js",
+      "start_line": 5,
+      "end_line": 5
+    },
+    "confidence_score": 70,
+    "confidence_band": "High Confidence",
+    "confidence_factors": {
+      "evidence_quality": 35,
+      "reproduction_success": 0,
+      "independent_confirmations": 5,
+      "environmental_clarity": 15,
+      "manual_review_status": 0,
+      "memory_boost": 15,
+      "test_exemption": false,
+      "test_deduction": 0,
+      "total_score": 70,
+      "classification_band": "High Confidence"
+    }
+  }
+]