torusguard 2.1.0 → 2.1.2

package/.torusguard/core/taint_graph.py

@@ -0,0 +1,235 @@
+"""
+TorusGuard Taint Engine — Directed Taint Flow Graph
+Builds Def->Use chains, walks reachability paths, detects sanitization points,
+and enumerates source-to-sink vulnerability paths.
+"""
+
+from collections import deque
+from typing import List, Dict, Set, Optional, Any, Tuple
+from core.taint import TaintNode, TaintEdge, TaintPath, TaintPropagator
+from core.taint_rules import get_sources_for_language, get_sinks_for_language, get_sanitizers_for_language
+
+
+class TaintGraph:
+    """Directed graph tracking taint flow from sources to sinks."""
+
+    def __init__(self):
+        self.nodes: Dict[str, TaintNode] = {}
+        self.edges: List[TaintEdge] = []
+        self.adjacency: Dict[str, List[TaintEdge]] = {}
+        self.reverse_adjacency: Dict[str, List[TaintEdge]] = {}
+
+    def add_node(self, node: TaintNode) -> TaintNode:
+        nid = node.node_id()
+        if nid not in self.nodes:
+            self.nodes[nid] = node
+            self.adjacency[nid] = []
+            self.reverse_adjacency[nid] = []
+        return self.nodes[nid]
+
+    def add_edge(self, from_node: TaintNode, to_node: TaintNode, edge_type: str = "assignment", line_number: int = 0) -> TaintEdge:
+        fn = self.add_node(from_node)
+        tn = self.add_node(to_node)
+        edge = TaintEdge(from_node=fn, to_node=tn, edge_type=edge_type, line_number=line_number)
+        self.edges.append(edge)
+        self.adjacency[fn.node_id()].append(edge)
+        self.reverse_adjacency[tn.node_id()].append(edge)
+        return edge
+
+    def find_tainted_paths(self, source: TaintNode, sink: TaintNode, max_depth: int = 8) -> List[List[TaintNode]]:
+        """
+        BFS/DFS to find all paths from source to sink.
+        Returns a list of node paths.
+        """
+        source_id = source.node_id()
+        sink_id = sink.node_id()
+
+        if source_id not in self.nodes or sink_id not in self.nodes:
+            return []
+
+        paths: List[List[TaintNode]] = []
+        # Queue contains: (current_node_id, [current_path])
+        queue = deque([(source_id, [self.nodes[source_id]])])
+
+        while queue:
+            curr_id, current_path = queue.popleft()
+
+            if len(current_path) > max_depth:
+                continue
+
+            if curr_id == sink_id:
+                paths.append(current_path)
+                continue
+
+            visited_ids = {n.node_id() for n in current_path}
+
+            for edge in self.adjacency.get(curr_id, []):
+                next_id = edge.to_node.node_id()
+                if next_id not in visited_ids:
+                    queue.append((next_id, current_path + [edge.to_node]))
+
+        return paths
+
+    def is_path_sanitized(self, path: List[TaintNode], sink_category: str, language: str) -> Tuple[bool, List[TaintNode]]:
+        """
+        Check if any node in the path acts as a sanitizer for the target sink category.
+        """
+        sanitizers = get_sanitizers_for_language(language)
+        sanitizers_found = []
+
+        for node in path:
+            if node.node_type == "sanitizer":
+                sanitizers_found.append(node)
+                continue
+
+            # Check if node expression or pattern contains a sanitizer
+            for s in sanitizers:
+                if s["pattern"] in node.expression or s["pattern"] in node.pattern:
+                    if not sink_category or sink_category in s.get("cleans", []):
+                        sanitizers_found.append(node)
+                        break
+
+        return len(sanitizers_found) > 0, sanitizers_found
+
+    def analyze_file_code(
+        self,
+        file_path: str,
+        code_content: str,
+        language: str = "python"
+    ) -> List[TaintPath]:
+        """
+        Parses source lines into Def-Use taint graph and discovers source->sink flows.
+        Supports variable re-assignments, transformations, and sanitizers.
+        """
+        import re
+
+        sources_catalog = get_sources_for_language(language)
+        sinks_catalog = get_sinks_for_language(language)
+        sanitizers_catalog = get_sanitizers_for_language(language)
+
+        lines = code_content.splitlines()
+        detected_sources: List[TaintNode] = []
+        detected_sinks: List[Tuple[TaintNode, Dict[str, Any]]] = []
+
+        # Current tainted variables mapping: var_name -> latest TaintNode
+        tainted_vars: Dict[str, TaintNode] = {}
+
+        # 1. First pass: Scan line-by-line for source introductions, assignments, and sink invocations
+        for idx, line in enumerate(lines):
+            line_num = idx + 1
+            stripped = line.strip()
+            if not stripped or stripped.startswith(("#", "//", "/*", "*")):
+                continue
+
+            # Check for direct sources
+            # Example: user_input = request.GET["id"] or data = req.body
+            for src_spec in sources_catalog:
+                src_pat = src_spec["pattern"]
+                if src_pat in stripped:
+                    # Look for assignment LHS
+                    var_name = ""
+                    # Handle assignment `x = ...` or `const x = ...` or `let x = ...` or `x := ...`
+                    assign_match = re.match(r"^(?:const|let|var)?\s*([a-zA-Z_][a-zA-Z0-9_]*)\s*(?::=[=]?|=)\s*(.+)$", stripped)
+                    if assign_match:
+                        var_name = assign_match.group(1).strip()
+                    else:
+                        var_name = f"anon_src_{line_num}"
+
+                    src_node = TaintNode(
+                        variable_name=var_name,
+                        file_path=file_path,
+                        line_number=line_num,
+                        node_type="source",
+                        expression=stripped,
+                        pattern=src_pat,
+                        category=src_spec.get("category", "user_input"),
+                        metadata={"framework": src_spec.get("framework", ""), "label": src_spec.get("label", "")}
+                    )
+                    self.add_node(src_node)
+                    detected_sources.append(src_node)
+                    if var_name:
+                        tainted_vars[var_name] = src_node
+
+            # Check for propagation via assignments: LHS = RHS where RHS contains a tainted variable
+            assign_match = re.match(r"^(?:const|let|var)?\s*([a-zA-Z_][a-zA-Z0-9_]*)\s*(?::=[=]?|=)\s*(.+)$", stripped)
+            if assign_match:
+                lhs_var = assign_match.group(1).strip()
+                rhs_expr = assign_match.group(2).strip()
+
+                # Check if RHS applies a sanitizer
+                is_sanitized = False
+                for san_spec in sanitizers_catalog:
+                    if san_spec["pattern"] in rhs_expr:
+                        # Sanitized assignment!
+                        san_node = TaintNode(
+                            variable_name=lhs_var,
+                            file_path=file_path,
+                            line_number=line_num,
+                            node_type="sanitizer",
+                            expression=rhs_expr,
+                            pattern=san_spec["pattern"],
+                            metadata={"cleans": san_spec.get("cleans", [])}
+                        )
+                        self.add_node(san_node)
+                        # Link if any tainted var was input to sanitizer
+                        for tv_name, tv_node in list(tainted_vars.items()):
+                            if re.search(r"\b" + re.escape(tv_name) + r"\b", rhs_expr):
+                                self.add_edge(tv_node, san_node, edge_type="argument", line_number=line_num)
+                        tainted_vars[lhs_var] = san_node
+                        is_sanitized = True
+                        break
+
+                if not is_sanitized:
+                    # Check if RHS mentions any known tainted variable
+                    for tv_name, tv_node in list(tainted_vars.items()):
+                        if re.search(r"\b" + re.escape(tv_name) + r"\b", rhs_expr):
+                            transform_node = TaintNode(
+                                variable_name=lhs_var,
+                                file_path=file_path,
+                                line_number=line_num,
+                                node_type="transform",
+                                expression=rhs_expr
+                            )
+                            self.add_node(transform_node)
+                            self.add_edge(tv_node, transform_node, edge_type="assignment", line_number=line_num)
+                            tainted_vars[lhs_var] = transform_node
+
+            # Check for Sinks
+            for sink_spec in sinks_catalog:
+                sink_pat = sink_spec["pattern"]
+                if sink_pat in stripped:
+                    sink_node = TaintNode(
+                        variable_name="",
+                        file_path=file_path,
+                        line_number=line_num,
+                        node_type="sink",
+                        expression=stripped,
+                        pattern=sink_pat,
+                        category=sink_spec.get("category", ""),
+                        metadata=sink_spec
+                    )
+                    self.add_node(sink_node)
+                    detected_sinks.append((sink_node, sink_spec))
+
+                    # Check which tainted variables are passed into or present in the sink line
+                    for tv_name, tv_node in list(tainted_vars.items()):
+                        if re.search(r"\b" + re.escape(tv_name) + r"\b", stripped):
+                            self.add_edge(tv_node, sink_node, edge_type="call", line_number=line_num)
+
+        # 2. Path Finding & Resolution
+        results: List[TaintPath] = []
+        for sink_node, sink_spec in detected_sinks:
+            for src_node in detected_sources:
+                paths = self.find_tainted_paths(src_node, sink_node)
+                for node_path in paths:
+                    is_sanitized, sanitizers = self.is_path_sanitized(node_path, sink_spec.get("category", ""), language)
+                    results.append(TaintPath(
+                        source=src_node,
+                        sink=sink_node,
+                        path=node_path,
+                        is_sanitized=is_sanitized,
+                        sanitizers_found=sanitizers,
+                        confidence_penalty=-40 if is_sanitized else 0
+                    ))
+
+        return results

package/.torusguard/core/taint_rules.py

@@ -0,0 +1,268 @@
+"""
+TorusGuard Taint Engine — Polyglot Source, Sink, and Sanitizer Catalogs
+Covers Python, JavaScript/TypeScript, Go, Rust, Java, Ruby, PHP, and C#.
+"""
+
+from typing import Dict, List, Any, Optional
+
+TAINT_SOURCES: Dict[str, List[Dict[str, Any]]] = {
+    "python": [
+        {"pattern": "request.GET", "framework": "Django", "label": "HTTP Query Param", "category": "user_input"},
+        {"pattern": "request.POST", "framework": "Django", "label": "HTTP POST Body", "category": "user_input"},
+        {"pattern": "request.data", "framework": "DRF", "label": "DRF Request Data", "category": "user_input"},
+        {"pattern": "request.query_params", "framework": "DRF", "label": "DRF Query Params", "category": "user_input"},
+        {"pattern": "request.json", "framework": "Flask", "label": "Flask JSON Body", "category": "user_input"},
+        {"pattern": "request.args", "framework": "Flask", "label": "Flask Query Param", "category": "user_input"},
+        {"pattern": "request.form", "framework": "Flask", "label": "Flask Form Data", "category": "user_input"},
+        {"pattern": "request.values", "framework": "Flask", "label": "Flask Form/Args Data", "category": "user_input"},
+        {"pattern": "request.headers", "framework": "Flask/Django", "label": "HTTP Headers", "category": "header"},
+        {"pattern": "sys.argv", "framework": "stdlib", "label": "CLI Argument", "category": "cli"},
+        {"pattern": "os.environ", "framework": "stdlib", "label": "Environment Variable", "category": "env"},
+        {"pattern": "os.getenv", "framework": "stdlib", "label": "Environment Variable", "category": "env"},
+        {"pattern": "input(", "framework": "stdlib", "label": "User Console Input", "category": "user_input"},
+        {"pattern": "Body(", "framework": "FastAPI", "label": "FastAPI Body Param", "category": "user_input"},
+        {"pattern": "Query(", "framework": "FastAPI", "label": "FastAPI Query Param", "category": "user_input"},
+        {"pattern": "Header(", "framework": "FastAPI", "label": "FastAPI Header Param", "category": "header"},
+        {"pattern": "Path(", "framework": "FastAPI", "label": "FastAPI Path Param", "category": "user_input"},
+    ],
+    "javascript": [
+        {"pattern": "req.body", "framework": "Express", "label": "Express Request Body", "category": "user_input"},
+        {"pattern": "req.query", "framework": "Express", "label": "Express Query Params", "category": "user_input"},
+        {"pattern": "req.params", "framework": "Express", "label": "Express Route Params", "category": "user_input"},
+        {"pattern": "req.headers", "framework": "Express", "label": "Express Headers", "category": "header"},
+        {"pattern": "request.json()", "framework": "Next.js", "label": "Next.js Request JSON", "category": "user_input"},
+        {"pattern": "request.formData()", "framework": "Next.js", "label": "Next.js FormData", "category": "user_input"},
+        {"pattern": "formData", "framework": "Next.js", "label": "Server Action FormData", "category": "user_input"},
+        {"pattern": "cookies()", "framework": "Next.js", "label": "Next.js Cookies", "category": "user_input"},
+        {"pattern": "searchParams", "framework": "Web API", "label": "URL Search Params", "category": "user_input"},
+        {"pattern": "event.body", "framework": "Lambda", "label": "AWS Lambda Event Body", "category": "user_input"},
+        {"pattern": "event.queryStringParameters", "framework": "Lambda", "label": "Lambda Query Params", "category": "user_input"},
+        {"pattern": "process.argv", "framework": "Node stdlib", "label": "CLI Arguments", "category": "cli"},
+        {"pattern": "process.env", "framework": "Node stdlib", "label": "Environment Variables", "category": "env"},
+        {"pattern": "location.search", "framework": "DOM", "label": "DOM Search Query", "category": "dom"},
+        {"pattern": "location.hash", "framework": "DOM", "label": "DOM Hash Fragment", "category": "dom"},
+        {"pattern": "window.name", "framework": "DOM", "label": "DOM Window Name", "category": "dom"},
+    ],
+    "go": [
+        {"pattern": "r.URL.Query()", "framework": "net/http", "label": "HTTP Query Params", "category": "user_input"},
+        {"pattern": "r.FormValue(", "framework": "net/http", "label": "HTTP Form Value", "category": "user_input"},
+        {"pattern": "r.PostFormValue(", "framework": "net/http", "label": "HTTP Post Form Value", "category": "user_input"},
+        {"pattern": "r.Body", "framework": "net/http", "label": "HTTP Request Body", "category": "user_input"},
+        {"pattern": "r.Header.Get(", "framework": "net/http", "label": "HTTP Header", "category": "header"},
+        {"pattern": "c.Param(", "framework": "Gin", "label": "Gin Route Param", "category": "user_input"},
+        {"pattern": "c.Query(", "framework": "Gin", "label": "Gin Query Param", "category": "user_input"},
+        {"pattern": "c.PostForm(", "framework": "Gin", "label": "Gin Form Param", "category": "user_input"},
+        {"pattern": "c.BindJSON(", "framework": "Gin", "label": "Gin JSON Binding", "category": "user_input"},
+        {"pattern": "os.Args", "framework": "stdlib", "label": "CLI Arguments", "category": "cli"},
+        {"pattern": "os.Getenv(", "framework": "stdlib", "label": "Environment Variable", "category": "env"},
+    ],
+    "rust": [
+        {"pattern": "web::Query", "framework": "actix-web", "label": "Actix Query Extractor", "category": "user_input"},
+        {"pattern": "web::Json", "framework": "actix-web", "label": "Actix JSON Extractor", "category": "user_input"},
+        {"pattern": "web::Path", "framework": "actix-web", "label": "Actix Path Extractor", "category": "user_input"},
+        {"pattern": "axum::extract::Query", "framework": "axum", "label": "Axum Query Extractor", "category": "user_input"},
+        {"pattern": "axum::extract::Json", "framework": "axum", "label": "Axum JSON Extractor", "category": "user_input"},
+        {"pattern": "std::env::args", "framework": "stdlib", "label": "CLI Arguments", "category": "cli"},
+        {"pattern": "std::env::var", "framework": "stdlib", "label": "Environment Variable", "category": "env"},
+    ],
+    "java": [
+        {"pattern": "@RequestParam", "framework": "Spring", "label": "Spring Request Param", "category": "user_input"},
+        {"pattern": "@RequestBody", "framework": "Spring", "label": "Spring Request Body", "category": "user_input"},
+        {"pattern": "@PathVariable", "framework": "Spring", "label": "Spring Path Variable", "category": "user_input"},
+        {"pattern": "@RequestHeader", "framework": "Spring", "label": "Spring Header", "category": "header"},
+        {"pattern": "request.getParameter(", "framework": "Servlet", "label": "Servlet Param", "category": "user_input"},
+        {"pattern": "request.getInputStream(", "framework": "Servlet", "label": "Servlet Stream", "category": "user_input"},
+        {"pattern": "System.getenv(", "framework": "stdlib", "label": "Environment Variable", "category": "env"},
+    ],
+    "ruby": [
+        {"pattern": "params[", "framework": "Rails", "label": "Rails Parameters", "category": "user_input"},
+        {"pattern": "request.body", "framework": "Rails", "label": "Rails Request Body", "category": "user_input"},
+        {"pattern": "request.headers", "framework": "Rails", "label": "Rails Headers", "category": "header"},
+        {"pattern": "ENV[", "framework": "stdlib", "label": "Environment Variable", "category": "env"},
+        {"pattern": "ARGV[", "framework": "stdlib", "label": "CLI Argument", "category": "cli"},
+    ],
+    "php": [
+        {"pattern": "$_GET", "framework": "PHP Superglobals", "label": "GET Parameters", "category": "user_input"},
+        {"pattern": "$_POST", "framework": "PHP Superglobals", "label": "POST Parameters", "category": "user_input"},
+        {"pattern": "$_REQUEST", "framework": "PHP Superglobals", "label": "REQUEST Parameters", "category": "user_input"},
+        {"pattern": "$_COOKIE", "framework": "PHP Superglobals", "label": "Cookie Parameters", "category": "user_input"},
+        {"pattern": "$_SERVER['HTTP_", "framework": "PHP Superglobals", "label": "HTTP Headers", "category": "header"},
+        {"pattern": "$request->input(", "framework": "Laravel", "label": "Laravel Input", "category": "user_input"},
+        {"pattern": "$request->query(", "framework": "Laravel", "label": "Laravel Query", "category": "user_input"},
+    ],
+    "csharp": [
+        {"pattern": "[FromQuery]", "framework": "ASP.NET Core", "label": "Query Parameter", "category": "user_input"},
+        {"pattern": "[FromBody]", "framework": "ASP.NET Core", "label": "Body Parameter", "category": "user_input"},
+        {"pattern": "[FromRoute]", "framework": "ASP.NET Core", "label": "Route Parameter", "category": "user_input"},
+        {"pattern": "[FromHeader]", "framework": "ASP.NET Core", "label": "Header Parameter", "category": "header"},
+        {"pattern": "Request.Query[", "framework": "ASP.NET Core", "label": "Request Query", "category": "user_input"},
+        {"pattern": "Request.Form[", "framework": "ASP.NET Core", "label": "Request Form", "category": "user_input"},
+        {"pattern": "Environment.GetEnvironmentVariable(", "framework": "stdlib", "label": "Environment Variable", "category": "env"},
+    ]
+}
+
+TAINT_SINKS: Dict[str, List[Dict[str, Any]]] = {
+    "python": [
+        {"pattern": "execute(", "category": "sql-injection", "rule": "TG-INPUT-002", "severity": "Critical"},
+        {"pattern": "raw(", "category": "sql-injection", "rule": "TG-INPUT-002", "severity": "Critical"},
+        {"pattern": "cursor.execute(", "category": "sql-injection", "rule": "TG-INPUT-002", "severity": "Critical"},
+        {"pattern": "os.system(", "category": "command-injection", "rule": "TG-INPUT-003", "severity": "Critical"},
+        {"pattern": "subprocess.call(", "category": "command-injection", "rule": "TG-INPUT-003", "severity": "Critical"},
+        {"pattern": "subprocess.Popen(", "category": "command-injection", "rule": "TG-INPUT-003", "severity": "Critical"},
+        {"pattern": "subprocess.run(", "category": "command-injection", "rule": "TG-INPUT-003", "severity": "Critical"},
+        {"pattern": "eval(", "category": "code-injection", "rule": "TG-INPUT-003", "severity": "Critical"},
+        {"pattern": "exec(", "category": "code-injection", "rule": "TG-INPUT-003", "severity": "Critical"},
+        {"pattern": "open(", "category": "path-traversal", "rule": "TG-INPUT-006", "severity": "High"},
+        {"pattern": "send_file(", "category": "path-traversal", "rule": "TG-INPUT-006", "severity": "High"},
+        {"pattern": "redirect(", "category": "open-redirect", "rule": "TG-INPUT-007", "severity": "Medium"},
+        {"pattern": "mark_safe(", "category": "xss", "rule": "TG-INPUT-005", "severity": "High"},
+        {"pattern": "render_template_string(", "category": "ssti", "rule": "TG-INPUT-005", "severity": "High"},
+        {"pattern": "pickle.loads(", "category": "deserialization", "rule": "TG-INPUT-008", "severity": "Critical"},
+        {"pattern": "yaml.load(", "category": "deserialization", "rule": "TG-INPUT-008", "severity": "High"},
+        {"pattern": "requests.get(", "category": "ssrf", "rule": "TG-SSRF-001", "severity": "High"},
+        {"pattern": "requests.post(", "category": "ssrf", "rule": "TG-SSRF-001", "severity": "High"},
+        {"pattern": "httpx.get(", "category": "ssrf", "rule": "TG-SSRF-001", "severity": "High"},
+        {"pattern": "urllib.request.urlopen(", "category": "ssrf", "rule": "TG-SSRF-001", "severity": "High"},
+        {"pattern": "jwt.decode(", "category": "jwt-integrity", "rule": "TG-AUTH-006", "severity": "High"},
+    ],
+    "javascript": [
+        {"pattern": "innerHTML", "category": "xss", "rule": "TG-INPUT-003", "severity": "High"},
+        {"pattern": "dangerouslySetInnerHTML", "category": "xss", "rule": "TG-INPUT-003", "severity": "High"},
+        {"pattern": "document.write(", "category": "xss", "rule": "TG-INPUT-003", "severity": "High"},
+        {"pattern": ".query(", "category": "sql-injection", "rule": "TG-INPUT-002", "severity": "Critical"},
+        {"pattern": "$queryRawUnsafe", "category": "sql-injection", "rule": "TG-INPUT-002", "severity": "Critical"},
+        {"pattern": "child_process.exec(", "category": "command-injection", "rule": "TG-INPUT-003", "severity": "Critical"},
+        {"pattern": "child_process.spawn(", "category": "command-injection", "rule": "TG-INPUT-003", "severity": "Critical"},
+        {"pattern": "eval(", "category": "code-injection", "rule": "TG-INPUT-003", "severity": "Critical"},
+        {"pattern": "new Function(", "category": "code-injection", "rule": "TG-INPUT-003", "severity": "Critical"},
+        {"pattern": "fetch(", "category": "ssrf", "rule": "TG-SSRF-001", "severity": "High"},
+        {"pattern": "axios.get(", "category": "ssrf", "rule": "TG-SSRF-001", "severity": "High"},
+        {"pattern": "axios.post(", "category": "ssrf", "rule": "TG-SSRF-001", "severity": "High"},
+        {"pattern": "res.redirect(", "category": "open-redirect", "rule": "TG-INPUT-007", "severity": "Medium"},
+        {"pattern": "fs.readFile(", "category": "path-traversal", "rule": "TG-INPUT-006", "severity": "High"},
+        {"pattern": "fs.createReadStream(", "category": "path-traversal", "rule": "TG-INPUT-006", "severity": "High"},
+    ],
+    "go": [
+        {"pattern": "db.Query(", "category": "sql-injection", "rule": "TG-INPUT-002", "severity": "Critical"},
+        {"pattern": "db.Exec(", "category": "sql-injection", "rule": "TG-INPUT-002", "severity": "Critical"},
+        {"pattern": "exec.Command(", "category": "command-injection", "rule": "TG-INPUT-003", "severity": "Critical"},
+        {"pattern": "http.Get(", "category": "ssrf", "rule": "TG-SSRF-001", "severity": "High"},
+        {"pattern": "http.Post(", "category": "ssrf", "rule": "TG-SSRF-001", "severity": "High"},
+        {"pattern": "os.Open(", "category": "path-traversal", "rule": "TG-INPUT-006", "severity": "High"},
+        {"pattern": "os.ReadFile(", "category": "path-traversal", "rule": "TG-INPUT-006", "severity": "High"},
+        {"pattern": "template.HTML(", "category": "xss", "rule": "TG-INPUT-005", "severity": "High"},
+        {"pattern": "http.Redirect(", "category": "open-redirect", "rule": "TG-INPUT-007", "severity": "Medium"},
+    ],
+    "rust": [
+        {"pattern": "sqlx::query(", "category": "sql-injection", "rule": "TG-INPUT-002", "severity": "Critical"},
+        {"pattern": "Command::new(", "category": "command-injection", "rule": "TG-INPUT-003", "severity": "Critical"},
+        {"pattern": "reqwest::get(", "category": "ssrf", "rule": "TG-SSRF-001", "severity": "High"},
+        {"pattern": "std::fs::read(", "category": "path-traversal", "rule": "TG-INPUT-006", "severity": "High"},
+    ],
+    "java": [
+        {"pattern": "statement.executeQuery(", "category": "sql-injection", "rule": "TG-INPUT-002", "severity": "Critical"},
+        {"pattern": "Runtime.getRuntime().exec(", "category": "command-injection", "rule": "TG-INPUT-003", "severity": "Critical"},
+        {"pattern": "new ProcessBuilder(", "category": "command-injection", "rule": "TG-INPUT-003", "severity": "Critical"},
+        {"pattern": "new URL(", "category": "ssrf", "rule": "TG-SSRF-001", "severity": "High"},
+        {"pattern": "new FileInputStream(", "category": "path-traversal", "rule": "TG-INPUT-006", "severity": "High"},
+    ],
+    "ruby": [
+        {"pattern": "ActiveRecord::Base.connection.execute(", "category": "sql-injection", "rule": "TG-INPUT-002", "severity": "Critical"},
+        {"pattern": "system(", "category": "command-injection", "rule": "TG-INPUT-003", "severity": "Critical"},
+        {"pattern": "send_file ", "category": "path-traversal", "rule": "TG-INPUT-006", "severity": "High"},
+        {"pattern": "redirect_to ", "category": "open-redirect", "rule": "TG-INPUT-007", "severity": "Medium"},
+    ],
+    "php": [
+        {"pattern": "mysqli_query(", "category": "sql-injection", "rule": "TG-INPUT-002", "severity": "Critical"},
+        {"pattern": "PDO::query(", "category": "sql-injection", "rule": "TG-INPUT-002", "severity": "Critical"},
+        {"pattern": "system(", "category": "command-injection", "rule": "TG-INPUT-003", "severity": "Critical"},
+        {"pattern": "shell_exec(", "category": "command-injection", "rule": "TG-INPUT-003", "severity": "Critical"},
+        {"pattern": "include(", "category": "path-traversal", "rule": "TG-INPUT-006", "severity": "High"},
+        {"pattern": "header('Location:", "category": "open-redirect", "rule": "TG-INPUT-007", "severity": "Medium"},
+    ],
+    "csharp": [
+        {"pattern": "SqlCommand(", "category": "sql-injection", "rule": "TG-INPUT-002", "severity": "Critical"},
+        {"pattern": "Process.Start(", "category": "command-injection", "rule": "TG-INPUT-003", "severity": "Critical"},
+        {"pattern": "File.OpenRead(", "category": "path-traversal", "rule": "TG-INPUT-006", "severity": "High"},
+        {"pattern": "Redirect(", "category": "open-redirect", "rule": "TG-INPUT-007", "severity": "Medium"},
+    ]
+}
+
+TAINT_SANITIZERS: Dict[str, List[Dict[str, Any]]] = {
+    "python": [
+        {"pattern": "int(", "cleans": ["sql-injection", "command-injection", "path-traversal", "ssrf"]},
+        {"pattern": "float(", "cleans": ["sql-injection", "command-injection"]},
+        {"pattern": "escape(", "cleans": ["xss", "ssti"]},
+        {"pattern": "html.escape(", "cleans": ["xss", "ssti"]},
+        {"pattern": "bleach.clean(", "cleans": ["xss"]},
+        {"pattern": "shlex.quote(", "cleans": ["command-injection"]},
+        {"pattern": "secure_filename(", "cleans": ["path-traversal"]},
+        {"pattern": "os.path.basename(", "cleans": ["path-traversal"]},
+        {"pattern": "Path.resolve()", "cleans": ["path-traversal"]},
+        {"pattern": "validators.url(", "cleans": ["ssrf", "open-redirect"]},
+        {"pattern": "Depends(", "cleans": ["auth-bypass"]},
+        {"pattern": "SafeLoader", "cleans": ["deserialization"]},
+        {"pattern": ".safeParse(", "cleans": ["sql-injection", "xss", "command-injection"]},
+    ],
+    "javascript": [
+        {"pattern": "parseInt(", "cleans": ["sql-injection", "command-injection", "path-traversal", "ssrf"]},
+        {"pattern": "Number(", "cleans": ["sql-injection", "command-injection", "path-traversal"]},
+        {"pattern": "encodeURIComponent(", "cleans": ["xss", "open-redirect"]},
+        {"pattern": "DOMPurify.sanitize(", "cleans": ["xss"]},
+        {"pattern": "z.string().parse(", "cleans": ["sql-injection", "xss"]},
+        {"pattern": "z.number()", "cleans": ["sql-injection", "command-injection"]},
+        {"pattern": "path.basename(", "cleans": ["path-traversal"]},
+        {"pattern": "path.normalize(", "cleans": ["path-traversal"]},
+        {"pattern": "escapeHtml(", "cleans": ["xss"]},
+        {"pattern": "validator.isURL(", "cleans": ["ssrf", "open-redirect"]},
+    ],
+    "go": [
+        {"pattern": "strconv.Atoi(", "cleans": ["sql-injection", "command-injection", "path-traversal"]},
+        {"pattern": "strconv.ParseInt(", "cleans": ["sql-injection", "command-injection"]},
+        {"pattern": "filepath.Base(", "cleans": ["path-traversal"]},
+        {"pattern": "filepath.Clean(", "cleans": ["path-traversal"]},
+        {"pattern": "html.EscapeString(", "cleans": ["xss"]},
+        {"pattern": "url.Parse(", "cleans": ["open-redirect", "ssrf"]},
+    ],
+    "rust": [
+        {"pattern": "parse::<i32>", "cleans": ["sql-injection", "command-injection"]},
+        {"pattern": "parse::<u32>", "cleans": ["sql-injection", "command-injection"]},
+        {"pattern": "Path::new(", "cleans": ["path-traversal"]},
+    ],
+    "java": [
+        {"pattern": "Integer.parseInt(", "cleans": ["sql-injection", "command-injection"]},
+        {"pattern": "Long.parseLong(", "cleans": ["sql-injection", "command-injection"]},
+        {"pattern": "Paths.get(", "cleans": ["path-traversal"]},
+        {"pattern": "ESAPI.encoder()", "cleans": ["xss", "sql-injection"]},
+    ],
+    "ruby": [
+        {"pattern": ".to_i", "cleans": ["sql-injection", "command-injection"]},
+        {"pattern": "File.basename(", "cleans": ["path-traversal"]},
+        {"pattern": "CGI.escapeHTML(", "cleans": ["xss"]},
+    ],
+    "php": [
+        {"pattern": "intval(", "cleans": ["sql-injection", "command-injection"]},
+        {"pattern": "(int)", "cleans": ["sql-injection", "command-injection"]},
+        {"pattern": "htmlspecialchars(", "cleans": ["xss"]},
+        {"pattern": "basename(", "cleans": ["path-traversal"]},
+        {"pattern": "filter_var(", "cleans": ["ssrf", "xss", "sql-injection"]},
+    ],
+    "csharp": [
+        {"pattern": "int.Parse(", "cleans": ["sql-injection", "command-injection"]},
+        {"pattern": "int.TryParse(", "cleans": ["sql-injection", "command-injection"]},
+        {"pattern": "Path.GetFileName(", "cleans": ["path-traversal"]},
+        {"pattern": "HttpUtility.HtmlEncode(", "cleans": ["xss"]},
+    ]
+}
+
+
+def get_sources_for_language(lang: str) -> List[Dict[str, Any]]:
+    return TAINT_SOURCES.get(lang.lower(), [])
+
+
+def get_sinks_for_language(lang: str) -> List[Dict[str, Any]]:
+    return TAINT_SINKS.get(lang.lower(), [])
+
+
+def get_sanitizers_for_language(lang: str) -> List[Dict[str, Any]]:
+    return TAINT_SANITIZERS.get(lang.lower(), [])

package/.torusguard/core/v070_reporter.py

@@ -0,0 +1,102 @@
+"""
+TorusGuard v0.7.0 Unified Reporting Engine
+Combines static code analysis with runtime validation evidence, exploitability confidence,
+affected routes, remediation updates, and residual risk assessments into actionable Markdown.
+"""
+
+from typing import List, Dict, Any, Optional
+from datetime import datetime, timezone
+from pathlib import Path
+
+
+class V070Reporter:
+    """
+    Renders combined static + runtime validation reports for TorusGuard v0.7.0.
+    """
+
+    @classmethod
+    def render_combined_summary(
+        cls,
+        target_name: str,
+        run_id: str,
+        auth_id: str,
+        static_findings: List[Dict[str, Any]],
+        runtime_results: List[Dict[str, Any]],
+        clusters: List[Any],
+        manual_review_items: Optional[List[Dict[str, Any]]] = None
+    ) -> str:
+        now = datetime.now(timezone.utc).strftime("%B %d, %Y")
+        confirmed_count = sum(1 for r in runtime_results if r.get("status") == "Runtime Confirmed")
+        likely_count = sum(1 for r in runtime_results if r.get("status") == "Runtime Likely")
+        not_repro_count = sum(1 for r in runtime_results if r.get("status") == "Not Reproducible in Scope")
+        blocked_count = sum(1 for r in runtime_results if r.get("status") == "Blocked by Environment / Controls")
+
+        lines = [
+            f"# TorusGuard v0.7.0 Unified Security & Runtime Exploitability Report",
+            f"\n**Target Application:** `{target_name}`",
+            f"**Run Identifier:** `{run_id}`",
+            f"**Authorization Reference:** `{auth_id}`",
+            f"**Execution Date:** {now}",
+            f"**Static Findings Detected:** `{len(static_findings)}`",
+            f"**Runtime Confirmed Exploitable:** `{confirmed_count}`",
+            f"**Runtime Likely Exploitable:** `{likely_count}`",
+            f"**Not Reproducible at Runtime:** `{not_repro_count}`",
+            f"**Blocked by Controls/Safety:** `{blocked_count}`",
+            "\n---",
+            "\n## 🎯 Executive Summary & Exploitability Breakdown",
+            "\nThis report pairs static source-code analysis with authorized, bounded runtime validation to distinguish theoretical risks from practically reachable and exploitable vulnerabilities.",
+            "\n| Metric | Count | Governance Status |",
+            "|---|:---:|---|",
+            f"| **Runtime Confirmed Exploitable** | `{confirmed_count}` | 🔴 **Immediate Remediation Required** (Reproducible in live scope) |",
+            f"| **Runtime Likely** | `{likely_count}` | 🟠 High Priority (Strong behavioral indicators observed) |",
+            f"| **Needs Manual Review** | `{len(manual_review_items or [])}` | 🟡 Engineer Sign-Off Required (Ambiguous boundary) |",
+            f"| **Not Reproducible in Scope** | `{not_repro_count}` | 🟢 Mitigated at Runtime (Gateway / Middleware active) |",
+            f"| **Blocked by Environment / Controls** | `{blocked_count}` | ⚪ Safety Gate Halted Active Probing |",
+            "\n---",
+            "\n## 🌐 Endpoint & Route Exploitability Matrix\n",
+            "| Finding ID | Rule ID | Target Endpoint | Static Severity | Runtime Exploitability | Reproducible? |",
+            "|---|---|---|:---:|:---:|:---:|",
+        ]
+
+        rt_map = {r.get("finding_id"): r for r in runtime_results}
+        for f in static_findings:
+            f_id = f.get("finding_id")
+            rt = rt_map.get(f_id, {})
+            probe_url = rt.get("probe_url", f.get("target", {}).get("file_path", "N/A"))
+            status = rt.get("status", "Not Evaluated")
+            repro = "✅ Yes" if rt.get("reproducible") else "❌ No"
+            lines.append(
+                f"| `{f_id}` | `{f.get('rule_id')}` | `{probe_url}` | {f.get('severity', 'Medium')} | **{status}** | {repro} |"
+            )
+
+        lines.extend([
+            "\n---",
+            "\n## 🛡️ Root-Cause Cluster Remediation Plans\n",
+        ])
+
+        for c in clusters:
+            c_id = getattr(c, "cluster_id", "cluster-general")
+            c_title = getattr(c, "title", "General Cluster")
+            c_findings = getattr(c, "finding_ids", [])
+            lines.extend([
+                f"### Root Cause: `{c_id}` — {c_title}",
+                f"- **Affected Finding Count:** `{len(c_findings)}` findings",
+                f"- **Systemic Fix Advice:** {getattr(c, 'remediation_advice', 'Follow minimal patch guidelines.')}",
+                ""
+            ])
+
+        if manual_review_items:
+            lines.extend([
+                "\n---",
+                "\n## ⚠️ Manual-Review Items & Residual Risk Queue\n",
+            ])
+            for item in manual_review_items:
+                lines.append(f"- **Finding `{item.get('finding_id')}`:** {item.get('reason', 'Requires human confirmation.')}")
+
+        lines.extend([
+            "\n---",
+            "\n## 🔒 Safety & Governance Audit Statement",
+            "All runtime probes documented in this report were executed under strict target authorization and non-destructive safety gates. No state-destroying actions, unauthorized hosts, or weaponized exploit chains were utilized.",
+        ])
+
+        return "\n".join(lines) + "\n"