Cursor rule

1---
2description: Detect and prevent security logging and monitoring failures in Drupal as defined in OWASP Top 10:2021-A09
3globs: *.php, *.install, *.module, *.inc, *.theme, *.yml
4alwaysApply: false
5---
6# Drupal Security Logging and Monitoring Failures Standards (OWASP A09:2021)
7 
8This rule enforces security best practices to prevent logging and monitoring failures in Drupal applications, as defined in OWASP Top 10:2021-A09.
9 
10## Rule Details
11 
12- **Name:** drupal_logging_failures
13 
14- **Description:** Detect and prevent security logging and monitoring failures in Drupal as defined in OWASP Top 10:2021-A09
15 
16## Filters
17- file extension pattern: `\\.(php|inc|module|install|theme|yml)$`
18- file path pattern: `.*`
19 
20## Enforcement Checks
21- Conditions:
22  - pattern `(delete|update|create|execute|grant|revoke|config|schema).*function[^}]*\\{(?![^}]*(log|watchdog|logger))` – Critical operations should include logging. Implement proper logging for security-relevant actions.
23    - Pattern 1: Missing critical event logging
24  - pattern `@include|@require|@eval|error_reporting\\(0\\)|ini_set\\(['\"](mdc:display_errors|log_errors)['\"],\\s*['\"]0['\"]\\)` – Avoid suppressing errors and warnings. Implement proper error handling and logging instead.
25    - Pattern 2: Suppressed error logging
26  - pattern `catch\\s*\\([^{]*\\)\\s*\\{(?![^}]*log|[^}]*watchdog|[^}]*logger)` – Exceptions should be properly logged, especially in security-critical sections.
27    - Pattern 3: Improper exception handling without logging
28  - pattern `dblog\\.settings\\.yml|syslog\\.settings\\.yml|logging\\.settings\\.yml` – Ensure logging is properly configured and not disabled. Verify log verbosity and retention policies.
29    - Pattern 4: Disabled watchdog
30  - pattern `(login|authenticate|logout|password).*function[^}]*\\{(?![^}]*(log|watchdog|logger))` – Authentication events should always be logged for security monitoring and auditing.
31    - Pattern 5: Missing authentication event logging
32  - pattern `AccessResult::(allowed|forbidden|neutral)\\([^)]*\\)(?![^;]*(log|watchdog|logger))` – Consider logging significant access control decisions, especially denials, for security monitoring.
33    - Pattern 6: Failure to log access control decisions
34  - pattern `(file_save|file_delete|file_move|file_copy)[^;]*;(?![^;]*(log|watchdog|logger))` – File operations should be logged, especially for security-sensitive files.
35    - Pattern 7: Missing logging in file operations
36  - pattern `(\\->log|watchdog)\\([^,)]*,[^,)]*\\)` – Log messages should include sufficient context and detail for effective security monitoring.
37    - Pattern 8: Insufficient detail in log messages
38  - pattern `\\$config->set\\([^;]*;(?![^;]*(log|watchdog|logger))` – Configuration changes should be logged to maintain an audit trail and detect unauthorized changes.
39    - Pattern 9: Failure to log configuration changes
40  - pattern `class\\s+[a-zA-Z0-9_]+Resource.+\\{[^}]*function\\s+[a-zA-Z0-9_]+\\([^{]*\\)\\s*\\{(?![^}]*(log|watchdog|logger))` – API endpoint access should be logged for security monitoring, especially for sensitive operations.
41    - Pattern 10: Missing logs for API access
42 
43## Suggestions
44- Guidance:
45**Drupal Security Logging & Monitoring Best Practices:**
46 
471. **Comprehensive Logging Implementation:**
48   - Use Drupal's Logger Factory service: `\Drupal::logger('module_name')`
49   - Implement proper log levels: emergency, alert, critical, error, warning, notice, info, debug
50   - Include context in log messages with relevant identifiers and information
51   - Log security-relevant events consistently across the application
52   - Structure log messages to facilitate automated analysis
53 
542. **Critical Events to Log:**
55   - Authentication events (login attempts, failures, logouts)
56   - Access control decisions (particularly denials)
57   - All administrative actions
58   - Data modification operations on sensitive information
59   - Configuration and settings changes
60   - File operations (uploads, downloads of sensitive content)
61   - API access and usage
62 
633. **Logging Configuration:**
64   - Configure appropriate log retention periods based on security requirements
65   - Implement log rotation to maintain performance
66   - Consider using syslog for centralized logging
67   - Protect log files from unauthorized access and modification
68   - Configure appropriate verbosity for different environments
69 
704. **Monitoring Implementation:**
71   - Define security-relevant log patterns to monitor
72   - Implement log aggregation and analysis
73   - Set up alerts for suspicious activity patterns
74   - Establish response procedures for security events
75   - Consider integration with SIEM solutions
76 
775. **Error Handling:**
78   - Log exceptions with appropriate error levels
79   - Include stack traces in development but not production
80   - Implement custom error handlers that ensure proper logging
81   - Avoid suppressing errors that might indicate security issues
82   - Monitor for patterns in error logs that could indicate attacks
83 
84## Validation Checks
85- Conditions:
86  - pattern `\\\\Drupal::logger\\([^)]+\\)->\\w+\\(|\\$this->logger->\\w+\\(` – Using Drupal's logger service correctly.
87    - Check 1: Proper logger usage
88  - pattern `->\\w+\\([^,]+,\\s*[^,]+,\\s*\\[` – Including context information in log messages.
89    - Check 2: Context in log messages
90  - pattern `dblog\\.settings|syslog\\.settings|logging\\.yml` – Configuring logging appropriately.
91    - Check 3: Logging configuration
92  - pattern `catch[^{]*\\{[^}]*logger|catch[^{]*\\{[^}]*watchdog|catch[^{]*\\{[^}]*log` – Properly logging exceptions.
93    - Check 4: Exception logging
94 
95## Metadata
96- Priority: high
97- Version: 1.1
98- Tags: security, drupal, logging, monitoring, owasp, language:php, framework:drupal, category:security, subcategory:logging, standard:owasp-top10, risk:a09-logging-monitoring
99## References
100- https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures/
101- https://www.drupal.org/docs/8/api/logging-api/overview
102- https://www.drupal.org/docs/develop/security-in-drupal/writing-secure-code-for-drupal
103- https://www.drupal.org/docs/8/modules/syslog
104 
105