Cursor rule

1---
2description: Detect and prevent Server-Side Request Forgery (SSRF) vulnerabilities in Drupal applications as defined in OWASP Top 10:2021-A10
3globs: *.php, *.inc, *.module, *.install, *.theme
4alwaysApply: false
5---
6# Drupal Server-Side Request Forgery Standards (OWASP A10:2021)
7 
8This rule enforces security best practices to prevent Server-Side Request Forgery (SSRF) vulnerabilities in Drupal applications, as defined in OWASP Top 10:2021-A10.
9 
10## Rule Details
11 
12- **Name:** drupal_ssrf
13 
14- **Description:** Detect and prevent Server-Side Request Forgery (SSRF) vulnerabilities in Drupal applications as defined in OWASP Top 10:2021-A10
15 
16## Filters
17- file extension pattern: `\\.(php|inc|module|install|theme)$`
18- file path pattern: `.*`
19 
20## Enforcement Checks
21- Conditions:
22  - pattern `(file_get_contents|fopen|curl_exec|drupal_http_request|\\$client->request|\\$client->get|Drupal::httpClient\\(\\)->get)\\s*\\([^)]*\\$_(GET|POST|REQUEST|COOKIE|SERVER|FILES)[^)]*\\)` – Potential SSRF vulnerability: URL constructed with user input. Validate and sanitize user-supplied URL parameters before making requests.
23    - Pattern 1: Unsafe URL construction with user input
24  - pattern `GuzzleHttp\\\\Client[^;]*;[^;]*->request\\s*\\([^;]*\\$[^;]*` – Validate and restrict URLs before making HTTP requests with Guzzle to prevent SSRF attacks.
25    - Pattern 2: Unsafe Guzzle HTTP client usage
26  - pattern `(Http(Client|Request)|curl_exec|file_get_contents)\\s*\\([^)]*(http|\\$[a-zA-Z0-9_]+)[^)]*\\)[^;]*;(?![^;]*(valid|check|sanitize|UrlHelper))` – HTTP requests should validate URLs with \\Drupal\\Component\\Utility\\UrlHelper::isValid() before execution to prevent SSRF.
27    - Pattern 3: Missing URL validation before making HTTP requests
28  - pattern `(https?:?//|www\\.)\\s*\\.\\s*\\$[a-zA-Z0-9_]+` – Potential SSRF vulnerability: URL being constructed with variable concatenation. Use URL validation and allowlisting.
29    - Pattern 4: Unsafe URL construction with variable input
30  - pattern `file_get_contents\\([\"'](mdc:?:http|https|ftp|php|data|expect|zip|phar)://` – Avoid using PHP wrappers with file operations that could lead to SSRF vulnerabilities.
31    - Pattern 5: Using file system wrappers which can lead to SSRF
32  - pattern `CURLOPT_PROXY[^;]*none|CURLOPT_PROXY[^;]*null` – Bypassing proxy settings can lead to SSRF vulnerabilities. Maintain proper proxy configurations.
33    - Pattern 6: Bypassing local proxy settings
34  - pattern `simplexml_load_|DOMDocument|SimpleXMLElement|xml_parse` – XML processing without disabling external entities can lead to XXE and SSRF. Use libxml_disable_entity_loader(true).
35    - Pattern 7: Unsafe processing of XML with external entities
36  - pattern `(127\\.0\\.0\\.1|10\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}|172\\.(1[6-9]|2[0-9]|3[0-1])\\.[0-9]{1,3}\\.[0-9]{1,3}|192\\.168\\.[0-9]{1,3}\\.[0-9]{1,3}|169\\.254\\.[0-9]{1,3}\\.[0-9]{1,3}|localhost)` – Hardcoded internal IP addresses or localhost may facilitate SSRF attacks if exposed to user manipulation.
37    - Pattern 8: Accessing or using internal network IPs
38  - pattern `\\\\Drupal::httpClient\\(\\)(?!.*[^;]*UrlHelper::isValid)` – Always validate URLs with UrlHelper::isValid() before making HTTP requests with Drupal's HTTP client.
39    - Pattern 9: Custom Drupal HTTP client usage without validation
40  - pattern `curl_setopt\\([^,]+,\\s*CURLOPT_PORT,\\s*\\$[a-zA-Z0-9_]+` – Potential SSRF vulnerability: Restrict allowed ports for outbound HTTP requests to prevent service probing.
41    - Pattern 10: Allowing unrestricted ports in HTTP requests
42 
43## Suggestions
44- Guidance:
45**Drupal SSRF Prevention Best Practices:**
46 
471. **Input Validation for URLs:**
48   - Always validate any user-supplied URL or URL components
49   - Use `\Drupal\Component\Utility\UrlHelper::isValid()` to validate URLs
50   - Implement allowlists rather than blocklists for domains/IPs
51   - Parse URLs and validate each component (protocol, domain, port, path)
52 
532. **Network-Level Controls:**
54   - Implement network-level access controls for internal services
55   - Use application firewalls to restrict outbound connections
56   - Configure proxies to control and monitor outbound requests
57   - Segment sensitive internal services from public-facing applications
58 
593. **Request Handling:**
60   - Avoid passing raw user input to HTTP clients
61   - Set reasonable timeouts for all HTTP requests
62   - Disable HTTP redirects or limit redirect chains
63   - Validate response types match expected formats
64   - Use dedicated service accounts with minimal privileges for API calls
65 
664. **Drupal-Specific Controls:**
67   - Utilize Drupal's built-in UrlHelper class for URL validation
68   - Configure Guzzle HTTP client with appropriate security options
69   - Consider using middleware to enforce URL validation
70   - Use Drupal's logging system to record suspicious outbound requests
71   - Implement specific content security policies
72 
735. **Authentication and Access Controls:**
74   - Implement proper authentication for internal service calls
75   - Use context-specific API tokens with limited privileges
76   - Avoid exposing service credentials in code or configurations
77   - Implement rate limiting for outbound requests
78 
79## Validation Checks
80- Conditions:
81  - pattern `UrlHelper::isValid\\([^)]+\\)` – Using proper URL validation with UrlHelper.
82    - Check 1: Proper URL validation
83  - pattern `array_intersect|in_array|allowlist|whitelist` – Implementing domain/URL allowlisting for outbound requests.
84    - Check 2: Allowlisting domains
85  - pattern `libxml_disable_entity_loader\\(true\\)` – Properly disabling XML external entities.
86    - Check 3: Safe XML processing
87  - pattern `\\\\Drupal::httpClient\\(\\)[^;]*\\$options` – Using Drupal's HTTP client with explicit options.
88    - Check 4: Using Drupal's HTTP client safely
89 
90## Metadata
91- Priority: high
92- Version: 1.1
93- Tags: security, drupal, ssrf, owasp, language:php, framework:drupal, category:security, subcategory:ssrf, standard:owasp-top10, risk:a10-ssrf
94## References
95- https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/
96- https://cwe.mitre.org/data/definitions/918.html
97- https://www.drupal.org/docs/develop/security-in-drupal/writing-secure-code-for-drupal
98- https://portswigger.net/web-security/ssrf
99- https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html
100 
101 
102