Cursor rule

1---
2description: Detect and prevent cryptographic failures in Drupal as defined in OWASP Top 10:2021-A02
3globs: *.php, *.install, *.module, *.inc, *.theme
4alwaysApply: false
5---
6# Drupal Cryptographic Failures Security Standards (OWASP A02:2021)
7 
8This rule enforces security best practices to prevent cryptographic failures in Drupal applications, as defined in OWASP Top 10:2021-A02.
9 
10## Rule Details
11 
12- **Name:** drupal_cryptographic_failures
13 
14- **Description:** Detect and prevent cryptographic failures in Drupal as defined in OWASP Top 10:2021-A02
15 
16## Filters
17- file extension pattern: `\\.(php|inc|module|install|theme)$`
18- file path pattern: `(modules|themes|profiles|core)/.*`
19 
20## Enforcement Checks
21- Conditions:
22  - pattern `(md5|sha1)\\([^)]*\\)` – Weak hash algorithm detected. Use password_hash() for passwords or hash('sha256'/'sha512') for other data.
23    - Pattern 1: Use of weak hash algorithms
24  - pattern `(password|key|token|secret|credentials|pwd)\\s*=\\s*['\"][^'\"]+['\"]` – Hardcoded credentials or sensitive keys detected. Use Drupal's State API, key module, or environment variables.
25    - Pattern 2: Hardcoded credentials or keys
26  - pattern `\\$user->setPassword\\((?!password_hash|\\$hash)[^)]+\\)` – Never store plaintext passwords. Drupal handles password hashing internally.
27    - Pattern 3: Plaintext password storage
28  - pattern `file_(get|put)_contents\\([^,]+,\\s*[^,]+\\)` – Consider encrypting sensitive file contents using Drupal's encryption API or PHP's openssl functions.
29    - Pattern 4: Improper file encryption
30  - pattern `\\$settings\\[['\"](mdc:?!hash_salt|update_free_access)[^]]+\\]\\s*=\\s*['\"][^\"']+['\"]` – Sensitive data in settings.php should be moved to environment variables or settings.local.php.
31    - Pattern 5: Unprotected sensitive data in settings
32  - pattern `(rand|mt_rand|array_rand)\\(` – Insecure random number generation. Use random_bytes() or random_int() for cryptographic purposes.
33    - Pattern 6: Insecure random number generation
34  - pattern `'#cache'|'cache'` – Ensure HTTPS is enforced for cached pages containing sensitive information.
35    - Pattern 7: Missing HTTPS enforcement
36  - pattern `(->set|->get)\\('field_[^']*(?:password|ssn|credit|card|secret|key|token|credentials|pwd)[^']*'\\)` – Consider using field encryption for sensitive data fields.
37    - Pattern 8: Missing encryption for content with private information
38  - pattern `session_(start|regenerate_id)` – Avoid custom session handling. Use Drupal's session management services.
39    - Pattern 9: Custom session handling without proper security
40  - pattern `\\$token\\s*=\\s*.*?\\$[^;]+;(?![^;]*expir|[^;]*valid)` – API tokens should include expiration time or rotation mechanism.
41    - Pattern 10: API tokens without expiration or rotation
42 
43## Suggestions
44- Guidance:
45**Drupal Cryptographic Security Best Practices:**
46 
471. **Secure Data Storage:**
48   - Use Drupal's Key module for storing encryption keys
49   - Store sensitive configuration in environment variables or settings.local.php
50   - Use Drupal's State API for non-configuration sensitive data
51   - Never store plaintext sensitive information in the database
52 
532. **Encryption and Hashing:**
54   - Use Drupal's password hashing system, which uses password_hash() internally
55   - For non-password data hashing, use SHA-256 or SHA-512
56   - Use the Encrypt module or PHP's openssl_encrypt() with proper algorithms (AES-256-GCM)
57   - Always use proper salting techniques
58 
593. **Communication Security:**
60   - Enforce HTTPS site-wide using settings.php configuration
61   - Use secure cookies (secure, HttpOnly, SameSite)
62   - Implement proper Content-Security-Policy headers
63   - Use TLS 1.2+ for all connections
64 
654. **API Security:**
66   - Use OAuth or JWT with proper signature verification
67   - Implement token expiration and rotation
68   - Use HMAC for API request signatures when appropriate
69   - Never expose internal encryption keys through APIs
70 
715. **Configuration Best Practices:**
72   - Regularly rotate encryption keys and credentials
73   - Implement secure key storage using key management services
74   - Monitor and log cryptographic operations 
75   - Maintain an inventory of cryptographic algorithms in use
76 
77## Validation Checks
78- Conditions:
79  - pattern `UserInterface::PASSWORD_|password_hash\\(` – Using Drupal's password system correctly.
80    - Check 1: Proper password handling
81  - pattern `random_bytes|random_int|\\\\Drupal::service\\('random'\\)` – Using secure random generation methods.
82    - Check 2: Proper random generation
83  - pattern `getenv\\('|\\$_ENV\\['|\\$_SERVER\\['|settings\\.local\\.php` – Using environment variables or local settings correctly.
84    - Check 3: Secure settings
85  - pattern `openssl_encrypt\\(|\\\\Drupal::service\\('encryption'\\)` – Using proper encryption methods.
86    - Check 4: Proper encryption usage
87 
88## Metadata
89- Priority: high
90- Version: 1.1
91- Tags: security, drupal, cryptography, encryption, owasp, language:php, framework:drupal, category:security, subcategory:cryptography, standard:owasp-top10, risk:a02-cryptographic-failures
92## References
93- https://owasp.org/Top10/A02_2021-Cryptographic_Failures/
94- https://www.drupal.org/docs/security-in-drupal
95- https://www.drupal.org/project/key
96- https://www.drupal.org/project/encrypt
97 
98