Cursor rule

1---
2description: Detect and prevent software and data integrity failures in Drupal as defined in OWASP Top 10:2021-A08
3globs: *.php, *.install, *.module, *.inc, *.theme, *.yml, *.json
4alwaysApply: false
5---
6# Drupal Software and Data Integrity Failures Standards (OWASP A08:2021)
7 
8This rule enforces security best practices to prevent software and data integrity failures in Drupal applications, as defined in OWASP Top 10:2021-A08.
9 
10## Rule Details
11 
12- **Name:** drupal_integrity_failures
13 
14- **Description:** Detect and prevent software and data integrity failures in Drupal as defined in OWASP Top 10:2021-A08
15 
16## Filters
17- file extension pattern: `\\.(php|inc|module|install|theme|yml|json)$`
18- file path pattern: `.*`
19 
20## Enforcement Checks
21- Conditions:
22  - pattern `unserialize\\(\\$|unserialize\\([^,]+\\$|php_unserialize\\(\\$` – Insecure PHP deserialization detected. Use safer alternatives like JSON for data interchange or implement proper validation before deserialization.
23    - Pattern 1: Insecure deserialization
24  - pattern `eval\\(|assert\\(|create_function\\(` – Potentially dangerous code execution function detected. Avoid dynamic code execution whenever possible.
25    - Pattern 2: Unsafe use of eval or similar functions
26  - pattern `module_load_include\\(\\$|require(_once)?\\s*\\(\\s*\\$|include(_once)?\\s*\\(\\s*\\$` – Dynamic inclusion of files based on user input is dangerous. Use validated, allowlisted paths only.
27    - Pattern 3: Insecure plugin/module loading
28  - pattern `update\\.settings\\.yml|function [a-zA-Z0-9_]+_update_[0-9]+\\(\\)` – Ensure update hooks validate the integrity of updates and data transformations to prevent unauthorized modifications.
29    - Pattern 4: Missing update verification
30  - pattern `ConfigImporter|\\$config_importer|config_import|cmci` – Validate configuration before import to ensure integrity and detect potentially malicious changes.
31    - Pattern 5: Unsafe configuration imports
32  - pattern `drupal_http_request\\(|\\\\Drupal::httpClient\\(\\)->get\\(|curl_exec\\(` – Always validate data from remote sources before processing or storing it. Implement integrity checks for remote content.
33    - Pattern 6: Unchecked remote data
34  - pattern `composer\\.json` – Verify you're using secure Composer practices: validate package signatures, pin dependencies, and use composer.lock.
35    - Pattern 7: Insecure Composer usage
36  - pattern `INSERT\\s+INTO|UPDATE\\s+[a-zA-Z0-9_]+\\s+SET|db_update\\(|->update\\(|->insert\\(` – Direct database modifications should implement validation to preserve data integrity. Prefer using entity API.
37    - Pattern 8: Direct database modifications
38  - pattern `file_save_data\\(|file_save_upload\\(|file_copy\\(|file_move\\(` – Implement file integrity checking for uploaded or manipulated files to prevent malicious content.
39    - Pattern 9: Missing file integrity verification
40  - pattern `\\$entity\\s*=\\s*new\\s+[A-Za-z]+\\(|::create\\(\\$` – Validate all input used to create entity objects to maintain data integrity and prevent creating malicious entities.
41    - Pattern 10: Unsafe entity creation
42 
43## Suggestions
44- Guidance:
45**Drupal Data & Software Integrity Best Practices:**
46 
471. **Secure Deserialization:**
48   - Avoid PHP's unserialize() with untrusted data entirely
49   - Use JSON or other structured formats for data interchange
50   - When deserialization is necessary, implement allowlists and validation
51   - Consider using Drupal's typed data API for structured data handling
52   - Avoid serializing sensitive data that could be tampered with
53 
542. **Update & Configuration Integrity:**
55   - Validate data before and after migrations/updates
56   - Implement checksums/hashing for critical configuration
57   - Use Drupal's Configuration Management system properly
58   - Monitor configuration changes for unauthorized modifications
59   - Implement proper workflow for configuration management
60 
613. **Dependency & Plugin Security:**
62   - Verify the integrity of downloaded modules and themes
63   - Use Composer with package signature verification
64   - Pin dependencies to specific versions in production
65   - Maintain awareness of security advisories
66   - Implement proper validation for plugin/module loading
67 
684. **CI/CD Pipeline Security:**
69   - Sign build artifacts
70   - Verify signatures during deployment
71   - Implement proper secrets management
72   - Control access to build and deployment systems
73   - Validate code changes through code reviews
74 
755. **Data Integrity Validation:**
76   - Use database constraints to enforce data integrity
77   - Implement validation at every layer of the application
78   - Add integrity checks for critical data flows
79   - Maintain audit logs for data modifications
80   - Regularly verify data consistency
81 
82## Validation Checks
83- Conditions:
84  - pattern `json_encode|json_decode|\\\\Drupal::service\\('serialization\\.|->toArray\\(\\)` – Using safer serialization alternatives.
85    - Check 1: Secure serialization alternatives
86  - pattern `\\$entity->validate\\(\\)|\\$violations\\s*=\\s*\\$entity->validate\\(\\)` – Properly validating entity data.
87    - Check 2: Proper entity validation
88  - pattern `::validateSyncedConfig\\(|ConfigImporter::validate|->getUnprocessedConfiguration\\(\\)` – Implementing configuration validation.
89    - Check 3: Config verification
90  - pattern `file_validate_|FileValidatorInterface|\\$validators` – Using file validation mechanisms.
91    - Check 4: Safe file handling
92 
93## Metadata
94- Priority: high
95- Version: 1.1
96- Tags: security, drupal, integrity, deserialization, owasp, language:php, framework:drupal, category:security, subcategory:integrity, standard:owasp-top10, risk:a08-integrity-failures
97## References
98- https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures/
99- https://www.drupal.org/docs/develop/security-in-drupal/drupal-8-sanitizing-output
100- https://www.drupal.org/docs/8/api/configuration-api/configuration-api-overview
101- https://www.drupal.org/docs/develop/using-composer
102 
103