Cursor rule

1---
2description: Detect and prevent security misconfigurations in Drupal as defined in OWASP Top 10:2021-A05
3globs: *.php, *.install, *.module, *.inc, *.theme, *.yml, *.info
4alwaysApply: false
5---
6# Drupal Security Misconfiguration Standards (OWASP A05:2021)
7 
8This rule enforces security best practices to prevent misconfiguration vulnerabilities in Drupal applications, as defined in OWASP Top 10:2021-A05.
9 
10## Rule Details
11 
12- **Name:** drupal_security_misconfiguration
13 
14- **Description:** Detect and prevent security misconfigurations in Drupal as defined in OWASP Top 10:2021-A05
15 
16## Filters
17- file extension pattern: `\\.(php|inc|module|install|theme|yml|info\\.yml)$`
18- file path pattern: `.*`
19 
20## Enforcement Checks
21- Conditions:
22  - pattern `\\$settings\\['update_free_access'\\]\\s*=\\s*TRUE|\\$settings\\['cache'\\]\\s*=\\s*FALSE|\\$settings\\['rebuild_access'\\]\\s*=\\s*TRUE|\\$config\\['system\\.performance'\\]\\['cache'\\]\\s*=\\s*FALSE` – Development settings detected in production code. Ensure these settings are only enabled in development environments.
23    - Pattern 1: Development settings in production code
24  - pattern `settings\\.php|settings\\.local\\.php` – Verify that $settings['trusted_host_patterns'] is properly configured to prevent HTTP Host header attacks.
25    - Pattern 2: Missing or weak trusted host patterns
26  - pattern `\\$config\\['system\\.logging'\\]\\['error_level'\\]\\s*=\\s*'verbose'|ini_set\\('display_errors'\\s*,\\s*'1'\\)|error_reporting\\(E_ALL\\)` – Error display should be disabled in production. Use 'hide' for error_level in production.
27    - Pattern 3: Debugging/error display enabled
28  - pattern `\\$settings\\['file_chmod_directory'\\]\\s*=\\s*0777|\\$settings\\['file_chmod_file'\\]\\s*=\\s*0666` – Excessively permissive file permissions detected. Use more restrictive permissions.
29    - Pattern 4: Insecure file permissions settings
30  - pattern `\\.htaccess|sites/default/default\\.settings\\.php` – Ensure Content-Security-Policy headers are properly configured to prevent XSS attacks.
31    - Pattern 5: Disabled or misconfigured CSP headers
32  - pattern `session\\.cookie_secure\\s*=\\s*0|session\\.cookie_httponly\\s*=\\s*0|\\$settings\\['cookie_secure_only'\\]\\s*=\\s*FALSE` – Session cookies should be secure and HTTP-only in production environments.
33    - Pattern 6: Insecure session cookie settings
34  - pattern `settings\\.php` – Ensure $settings['file_private_path'] is properly configured for storing sensitive files.
35    - Pattern 7: Missing or misconfigured private file path
36  - pattern `core\\.extension\\.yml` – Check for development modules (devel, webprofiler, etc.) that should not be enabled in production.
37    - Pattern 8: Development modules enabled in production
38  - pattern `function\\s+[a-zA-Z0-9_]+_install\\(\\)` – Remove or secure default/demo content and users in production environments.
39    - Pattern 9: Default or demo content in production
40  - pattern `\\.htaccess|nginx\\.conf` – Verify X-Frame-Options, X-Content-Type-Options, X-XSS-Protection, and Referrer-Policy headers are properly configured.
41    - Pattern 10: Missing or misconfigured security headers
42 
43## Suggestions
44- Guidance:
45**Drupal Security Configuration Best Practices:**
46 
471. **Environment-Specific Configurations:**
48   - Use `settings.local.php` for environment-specific settings
49   - Maintain separate development, staging, and production configurations
50   - Never enable development settings in production: update_free_access, rebuild_access, etc.
51   - Use environment variables or secrets management for sensitive information
52 
532. **Essential Security Settings:**
54   - Configure trusted_host_patterns to prevent HTTP Host header attacks
55   - Set secure file permissions (e.g., 0755 for directories, 0644 for files)
56   - Configure private file path for sensitive uploads
57   - Set file_scan_ignore_directories to prevent public access to sensitive directories
58   - Implement secure session cookie settings (HTTPOnly, Secure, SameSite)
59 
603. **Error Handling:**
61   - Disable verbose error reporting in production with $config['system.logging']['error_level'] = 'hide'
62   - Configure custom error pages that don't leak system information
63   - Implement appropriate logging without exposing sensitive data
64 
654. **Security Headers:**
66   - Set Content-Security-Policy to restrict resource origins
67   - Configure X-Frame-Options to prevent clickjacking
68   - Enable X-Content-Type-Options to prevent MIME-type sniffing
69   - Set Referrer-Policy to control information in HTTP referers
70 
715. **Module & Extension Security:**
72   - Disable and uninstall unnecessary modules in production
73   - Keep core and contributed modules updated
74   - Remove development modules from production (devel, webprofiler, etc.)
75   - Implement proper configuration management workflows
76 
77## Validation Checks
78- Conditions:
79  - pattern `\\$settings\\['trusted_host_patterns'\\]\\s*=\\s*\\[\\s*['\"][^\"']+['\"]` – Trusted host patterns are properly configured.
80    - Check 1: Proper trusted host patterns
81  - pattern `\\$settings\\['cookie_secure_only'\\]\\s*=\\s*TRUE|session\\.cookie_secure\\s*=\\s*1` – Secure cookie settings are properly configured.
82    - Check 2: Secure session cookie settings
83  - pattern `\\$settings\\['file_private_path'\\]\\s*=\\s*(\"|')[^\"']+(\"|')` – Private file path is configured for sensitive files.
84    - Check 3: Private file path configuration
85  - pattern `\\$config\\['system\\.logging'\\]\\['error_level'\\]\\s*=\\s*'hide'` – Error reporting is properly configured for production.
86    - Check 4: Production error settings
87 
88## Metadata
89- Priority: high
90- Version: 1.1
91- Tags: security, drupal, configuration, misconfiguration, owasp, language:php, framework:drupal, category:security, subcategory:configuration, standard:owasp-top10, risk:a05-misconfiguration
92## References
93- https://owasp.org/Top10/A05_2021-Security_Misconfiguration/
94- https://www.drupal.org/docs/security-in-drupal/securing-your-site
95- https://www.drupal.org/docs/security-in-drupal/drupal-security-best-practices
96- https://www.drupal.org/docs/8/security/writing-secure-code-for-drupal-8
97 
98