Cursor rule

1---
2description: Detect and prevent insecure design patterns in Drupal as defined in OWASP Top 10:2021-A04
3globs: *.php, *.install, *.module, *.inc, *.theme, *.yml, *.info
4alwaysApply: false
5---
6# Drupal Insecure Design Security Standards (OWASP A04:2021)
7 
8This rule enforces security best practices to prevent insecure design vulnerabilities in Drupal applications, as defined in OWASP Top 10:2021-A04.
9 
10## Rule Details
11 
12- **Name:** drupal_insecure_design
13 
14- **Description:** Detect and prevent insecure design patterns in Drupal as defined in OWASP Top 10:2021-A04
15 
16## Filters
17- file extension pattern: `\\.(php|inc|module|install|theme|info\\.yml)$`
18- file path pattern: `(modules|themes|profiles)/custom`
19 
20## Enforcement Checks
21- Conditions:
22  - pattern `\\$permissions\\[['\"][^'\"]+['\"]\\]\\s*=\\s*array\\((?![^)]*(administer|manage|edit|delete)[^)]*(content|configuration|users)).*?\\);` – Permissions should follow Drupal naming patterns (verb + object) and be specific. Avoid overly broad permissions.
23    - Pattern 1: Insecure permission design
24  - pattern `if\\s*\\([^\\)]*===?\\s*['\"][a-zA-Z0-9_]+['\"]\\s*\\)` – Consider moving business logic rules to configuration to allow for proper adjustment without code changes.
25    - Pattern 2: Hard-coded business logic values
26  - pattern `preg_replace|str_replace|strip_tags` – Avoid ad hoc sanitization. Use Drupal's built-in sanitization tools: t(), Xss::filter(), etc.
27    - Pattern 3: Ad hoc input sanitization
28  - pattern `class\\s+[a-zA-Z0-9_]+Controller.+\\{[^}]*->query\\(` – Follow separation of concerns. Move database logic to services or repositories, not in controllers.
29    - Pattern 4: Database logic in controllers
30  - pattern `function\\s+[a-zA-Z0-9_]+_entity_access\\([^)]*\\)\\s*\\{[^}]*return\\s+AccessResult::allowed\\(\\);` – Avoid unconditional access grants. Implement proper conditional checks based on roles, permissions, or entity ownership.
31    - Pattern 5: Weak entity access policy
32  - pattern `session_start|session_set_cookie_params` – Avoid custom session management. Use Drupal's session handling system and services.
33    - Pattern 6: Custom session management
34  - pattern `(?:\\\\Drupal::[a-zA-Z_]+\\(\\).*){3,}` – Excessive static service calls indicate poor dependency injection. Use proper service injection.
35    - Pattern 7: Excessive global state dependency
36  - pattern `password_verify\\(|password_hash\\(` – Avoid custom authentication. Use Drupal's built-in authentication system and services.
37    - Pattern 8: Custom user authentication
38  - pattern `function\\s+[a-zA-Z0-9_]+_schema\\(\\)[^{]*\\{[^}]*return\\s+\\$schema;(?![^}]*validate_utf8|[^}]*'not null')` – Database schemas should enforce data integrity with proper constraints (NOT NULL, length, etc.).
39    - Pattern 9: Missing schema definitions
40  - pattern `\\$config\\[['\"](mdc:?!secure_|security_|private_)[^'\"]+['\"]\\]\\s*=\\s*(?:FALSE|0|'0'|\"0\");` – Security-related configuration should default to secure settings (opt-in for potentially insecure features).
41    - Pattern 10: Insecure defaults
42 
43## Suggestions
44- Guidance:
45**Drupal Secure Design Best Practices:**
46 
471. **Secure Architecture Principles:**
48   - Follow the principle of least privilege for all user roles and permissions
49   - Implement defense in depth with multiple security layers
50   - Use Drupal's entity/field API for structured data instead of custom tables
51   - Employ service-oriented architecture with proper dependency injection
52   - Follow Drupal coding standards to leverage community security expertise
53 
542. **Permission System Design:**
55   - Design granular permissions following the verb+object pattern
56   - Avoid creating omnipotent permissions that grant excessive access
57   - Use context-aware access systems like Entity Access or Node Grants
58   - Consider record-based and field-based access for better control
59   - Document permission architecture and security implications
60 
613. **Module Architecture:**
62   - Separate concerns into appropriate services
63   - Use hooks judiciously and document security implications
64   - Implement proper validation and sanitization layers
65   - Design APIs with security in mind from the start
66   - Provide secure default configurations
67 
684. **Data Modeling Security:**
69   - Implement appropriate validation constraints on entity fields
70   - Design schema definitions with integrity constraints
71   - Use appropriate field types for sensitive data
72   - Implement field-level access control when needed
73   - Consider encryption for sensitive stored data
74 
755. **Error Handling and Logging:**
76   - Design contextual error messages (detailed for admins, general for users)
77   - Implement appropriate logging for security events
78   - Avoid exposing sensitive data in error messages
79   - Design fault-tolerant systems that fail securely
80   - Include appropriate transaction management
81 
82## Validation Checks
83- Conditions:
84  - pattern `protected\\s+\\$[a-zA-Z0-9_]+;[^}]*public\\s+function\\s+__construct\\([^\\)]*\\)` – Using proper dependency injection pattern.
85    - Check 1: Proper dependency injection
86  - pattern `config\\/schema\\/[a-zA-Z0-9_]+\\.schema\\.yml` – Providing configuration schema for validation.
87    - Check 2: Configuration schema usage
88  - pattern `\\$permissions\\[['\"][a-z\\s]+[a-z0-9\\s]+['\"]\\]\\s*=\\s*\\[` – Following permission naming conventions.
89    - Check 3: Proper permission definition
90  - pattern `@EntityAccessControl\\(|class\\s+[a-zA-Z0-9_]+AccessControlHandler\\s+extends\\s+` – Using dedicated access control handlers for entities.
91    - Check 4: Entity access handlers
92 
93## Metadata
94- Priority: high
95- Version: 1.1
96- Tags: security, drupal, design, architecture, owasp, language:php, framework:drupal, category:security, subcategory:design, standard:owasp-top10, risk:a04-insecure-design
97## References
98- https://owasp.org/Top10/A04_2021-Insecure_Design/
99- https://www.drupal.org/docs/develop/security-in-drupal
100- https://www.drupal.org/docs/8/api/entity-api/access-control-for-entities
101- https://www.drupal.org/docs/8/api/configuration-api/configuration-schemametadata
102 
103