Cursor rule

1---
2description: Detect and prevent injection vulnerabilities in Drupal as defined in OWASP Top 10:2021-A03
3globs: *.php, *.inc, *.module, *.install, *.info.yml, *.theme, **/modules/**, **/themes/**, **/profiles/**
4alwaysApply: false
5---
6# Drupal Injection Security Standards (OWASP A03:2021)
7 
8This rule enforces security best practices to prevent injection vulnerabilities in Drupal applications, as defined in OWASP Top 10:2021-A03.
9 
10## Rule Details
11 
12- **Name:** drupal_injection
13 
14- **Description:** Detect and prevent injection vulnerabilities in Drupal as defined in OWASP Top 10:2021-A03
15 
16## Filters
17- file extension pattern: `\\.(php|inc|module|install|theme)$`
18- file path pattern: `(modules|themes|profiles|core)/.*`
19 
20## Enforcement Checks
21- Conditions:
22  - pattern `db_query\\(['\"][^'\"]*\\$[^'\"]*['\"]` – Direct variables in SQL queries are vulnerable to SQL injection. Use parameterized queries with placeholders.
23    - Pattern 1: Raw SQL queries without placeholders
24  - pattern `->query\\(['\"][^'\"]*\\$[^'\"]*['\"]` – Use parameterized queries with placeholders to prevent SQL injection: ->query($sql, [$param1, $param2]).
25    - Pattern 2: Modern DB API without placeholders
26  - pattern `<?=|<?php\\s+echo\\s+(?!(t|\\\\t|\\$this->t))[^;]*;` – Direct output may lead to XSS. Use t(), escaped variables with Html::escape(), or Twig templates.
27    - Pattern 3: Unescaped output
28  - pattern `[\"']#markup[\"']\\s*=>\\s*(?!t\\(|\\\\t\\(|Xss::filterAdmin|Html::escape)\\$` – Never use unfiltered variables in #markup. Use t(), Xss::filterAdmin(), or Html::escape().
29    - Pattern 4: Unfiltered user input in render arrays
30  - pattern `->addJsSettings\\(\\[(?![^\\]]*(Xss::filter|Json::encode))\\$` – Filter variables before adding to JavaScript settings using Xss::filter() or properly encode with Json::encode().
31    - Pattern 5: Unescaped variables in JavaScript settings
32  - pattern `exec\\(|shell_exec\\(|system\\(|passthru\\(|proc_open\\(|popen\\(|`` – Command execution functions can lead to command injection. Use Symfony\Component\Process\Process if necessary.
33    - Pattern 6: Direct command execution
34  - pattern `->redirect\\(\\s*\\$(?!(this->|allowed_destinations|config))` – Unvalidated redirects can lead to open redirect vulnerabilities. Whitelist allowed destinations.
35    - Pattern 7: Unvalidated redirect
36  - pattern `->condition\\([^,]*,\\s*\\$(?!(this->|config|entity|storage))[^,]*,` – Use proper input validation before using variables in database conditions to prevent SQL injection.
37    - Pattern 8: Raw user input in conditions
38  - pattern `(?<!buildForm|getFormId)\\s*function\\s+[a-zA-Z0-9_]+Form\\s*\\([^{]*\\{[^}]*return\\s+\\$form;(?![^}]*FormBuilderInterface|[^}]*::TOKEN|[^}]*#token)` – Form submissions must include CSRF protection with $form['#token'].
39    - Pattern 9: Missing CSRF protection in forms
40  - pattern `file_get_contents\\(\\s*\\$(?!(this->|allowed_paths|config))` – Validate file paths before operations to prevent path traversal attacks.
41    - Pattern 10: Unvalidated file operations
42 
43## Suggestions
44- Guidance:
45**Drupal Injection Prevention Best Practices:**
46 
471. **SQL Injection Prevention:**
48   - Always use parameterized queries with placeholders
49   - Use the Database API's condition methods: ->condition(), ->where()
50   - Properly escape table and field names with {}
51   - Consider using EntityQuery for entity operations
52 
532. **XSS Prevention:**
54   - Use Drupal's t() function for user-visible strings
55   - Apply appropriate filtering: Html::escape(), Xss::filter(), Xss::filterAdmin()
56   - Use #plain_text instead of #markup when displaying user input
57   - Utilize Twig's automatic escaping in templates
58   - For admin UIs, be careful with Xss::filterAdmin() as it allows some tags
59 
603. **CSRF Protection:**
61   - Always include form tokens with $form['#token']
62   - Validate form tokens with FormState->validateToken()
63   - For AJAX requests, utilize Drupal's ajax framework
64   - Use drupal_valid_token() for custom validation
65 
664. **Command Injection Prevention:**
67   - Avoid command execution functions entirely
68   - Use Symfony\Component\Process\Process with escaped arguments
69   - Validate and whitelist any input used in command contexts
70 
715. **Path Traversal Prevention:**
72   - Validate file paths with FileSystem::validatedLocalFileSystem()
73   - Use stream wrappers (public://, private://) instead of direct paths
74   - Implement strict input validation for any path components
75 
76## Validation Checks
77- Conditions:
78  - pattern `->query\\(['\"][^'\"]*\\?[^'\"]*['\"],\\s*\\[[^\\]]*\\]\\)` – Properly using parameterized queries with placeholders.
79    - Check 1: Proper SQL query usage
80  - pattern `(t\\(|Xss::filter|Html::escape|#plain_text)` – Using proper XSS prevention techniques.
81    - Check 2: Proper XSS prevention
82  - pattern `#token|FormBuilderInterface::TOKEN|drupal_valid_token` – Implementing CSRF protection correctly.
83    - Check 3: Proper CSRF protection
84  - pattern `FileSystem::validatedLocalFileSystem|file_exists\\(\\s*DRUPAL_ROOT` – Using safe file operation practices.
85    - Check 4: Safe file operations
86 
87## Metadata
88- Priority: high
89- Version: 1.1
90- Tags: security, drupal, injection, sql, xss, csrf, owasp, language:php, framework:drupal, category:security, subcategory:injection, standard:owasp-top10, risk:a03-injection
91## References
92- https://owasp.org/Top10/A03_2021-Injection/
93- https://www.drupal.org/docs/security-in-drupal/writing-secure-code-for-drupal
94- https://www.drupal.org/docs/8/security/drupal-8-sanitizing-output
95- https://api.drupal.org/api/drupal/core%21lib%21Drupal%21Component%21Utility%21Xss.php/class/Xss/9
96 
97