Cursor rule

1---
2description: Detect and prevent broken access control vulnerabilities in Drupal as defined in OWASP Top 10:2021-A01
3globs: *.php, *.install, *.module, *.inc, *.theme
4alwaysApply: false
5---
6# Drupal Broken Access Control Security Standards (OWASP A01:2021)
7 
8This rule enforces security best practices to prevent broken access control vulnerabilities in Drupal applications, as defined in OWASP Top 10:2021-A01.
9 
10## Rule Details
11 
12- **Name:** drupal_broken_access_control
13 
14- **Description:** Detect and prevent broken access control vulnerabilities in Drupal as defined in OWASP Top 10:2021-A01
15 
16## Filters
17- file extension pattern: `\\.(php|inc|module|install|theme)$`
18- file path pattern: `(modules|themes|profiles)/custom`
19 
20## Enforcement Checks
21- Conditions:
22  - pattern `\\s*\\$routes\\['[^']*'\\]\\s*=\\s*.*(?!_access|access_callback|requirements)` – Route definition is missing access control. Add '_permission', '_role', '_access', or custom access check in requirements.
23    - Pattern 1: Missing access checks in routes
24  - pattern `user_access\\(` – user_access() is deprecated. Use $account->hasPermission() or proper dependency injection with AccessResult methods.
25    - Pattern 2: Using user_access() instead of more secure methods
26  - pattern `(\\$user->id\\(\\)|\\$user->uid)\\s*===?\\s*1` – Avoid hardcoded checks against user ID 1. Use role-based permissions or proper access control services.
27    - Pattern 3: Hard-coded user ID checks
28  - pattern `\\$entity->(?!access)(save|delete|update)\\(\\)` – Entity operation without prior access check. Use \$entity->access('operation') before performing operations.
29    - Pattern 4: Missing access check on entity operations
30  - pattern `\\\\Drupal::currentUser\\(\\)` – Avoid using \\Drupal::currentUser() directly. Inject the current_user service for better testability and security.
31    - Pattern 5: Using Drupal::currentUser() directly in services
32  - pattern `class [A-Za-z0-9_]+Controller.+extends ControllerBase[^}]+public function [a-zA-Z0-9_]+\\([^{]*\\)\\s*\\{(?![^}]*access)` – Controller method lacks explicit access checking. Add checks via route requirements or within the controller method.
33    - Pattern 6: Missing access checks in controllers
34  - pattern `\\$entity->set\\([^)]+\\)\\s*;(?![^;]*access)` – Direct field value manipulation without access check. Verify entity field access before manipulation.
35    - Pattern 7: Direct field value manipulation without access check
36  - pattern `@RestResource\\([^)]*\\)(?![^{]*_access|access_callback)` – REST resource lacks access controls. Add access checks via annotations or in methods.
37    - Pattern 8: Unprotected REST endpoints
38  - pattern `\\$_SERVER\\['REMOTE_ADDR'\\]\\s*===?\\s*` – IP-based access control is insufficient. Use proper Drupal permission system instead.
39    - Pattern 9: Insecure access check by client IP
40  - pattern `#cache\\['contexts'\\]\\s*=\\s*\\[[^\\]]*'user'[^\\]]*\\]` – Using 'user' cache context without proper access checks may expose content to unauthorized users.
41    - Pattern 10: Allow bypassing cache for authenticated users without proper checks
42 
43## Suggestions
44- Guidance:
45**Drupal Access Control Best Practices:**
46 
471. **Route Access Controls:**
48   - Always define access requirements in route definitions
49   - Use permission-based access checks: '_permission', '_role', '_entity_access'
50   - Implement custom access checkers implementing AccessInterface
51 
522. **Entity Access Controls:**
53   - Always check entity access: $entity->access('view'|'update'|'delete') 
54   - Use EntityAccessControlHandler for consistent access control
55   - Respect entity field access with $entity->get('field')->access('view'|'edit')
56 
573. **Controller Security:**
58   - Inject and use proper services rather than \Drupal static calls
59   - Add explicit access checks within controller methods
60   - Use AccessResult methods (allowed, forbidden, neutral) with proper caching metadata
61 
624. **Service Security:**
63   - Inject AccountProxyInterface rather than calling currentUser() directly
64   - Use dependency injection for access-related services
65   - Implement session-based CSRF protection with form tokens
66 
675. **REST/API Security:**
68   - Implement OAuth or proper authentication
69   - Define specific permissions for REST operations
70   - Never rely solely on client-side access control
71 
72## Validation Checks
73- Conditions:
74  - pattern `AccessResult::(allowed|forbidden|neutral)\\(\\)(?=.*addCacheContexts)` – Access check is properly implemented with cache metadata.
75    - Check 1: Ensuring proper access check implementation
76  - pattern `function hook_entity_access\\([^)]*\\)\\s*\\{[^}]*return AccessResult` – Entity access hook is correctly returning AccessResult.
77    - Check 2: Proper hook_entity_access implementation
78  - pattern `_permission|_role|_access|_entity_access|_custom_access` – Route has proper access controls defined.
79    - Check 3: Properly secured route access
80  - pattern `@RestResource\\(.*,\\s*authentication\\s*=\\s*\\{[^}]+\\}` – REST Resource has authentication configured.
81    - Check 4: Secure REST implementation
82 
83## Metadata
84- Priority: high
85- Version: 1.1
86- Tags: security, drupal, access-control, permissions, owasp, language:php, framework:drupal, category:security, subcategory:access-control, standard:owasp-top10, risk:a01-broken-access-control
87## References
88- https://owasp.org/Top10/A01_2021-Broken_Access_Control/
89- https://www.drupal.org/docs/8/api/routing-system/access-checking-on-routes
90- https://www.drupal.org/docs/8/api/entity-api/entity-access-api
91