Cursor rule

1---
2description: Detect and prevent vulnerabilities related to outdated or vulnerable components in Drupal as defined in OWASP Top 10:2021-A06
3globs: *.php, *.install, *.module, *.inc, *.theme, *.yml, *.info
4alwaysApply: false
5---
6# Drupal Vulnerable and Outdated Components Standards (OWASP A06:2021)
7 
8This rule enforces security best practices to prevent vulnerabilities related to outdated or vulnerable components in Drupal applications, as defined in OWASP Top 10:2021-A06.
9 
10## Rule Details
11 
12- **Name:** drupal_vulnerable_components
13 
14- **Description:** Detect and prevent vulnerabilities related to outdated or vulnerable components in Drupal as defined in OWASP Top 10:2021-A06
15 
16## Filters
17- file extension pattern: `\\.(php|inc|module|install|info\\.yml|json)$`
18- file path pattern: `.*`
19 
20## Enforcement Checks
21- Conditions:
22  - pattern `core:\\s*('|\")8\\.[0-6](mdc:'|\")|core_version_requirement:\\s*('|\")[^9].+('|\")` – Potentially outdated Drupal core version detected. Consider upgrading to the latest secure version of Drupal 9 or 10.
23    - Pattern 1: Outdated Drupal core version declaration
24  - pattern `drupal_set_message\\(|format_date\\(|drupal_render\\(|entity_load\\(|variable_get\\(|variable_set\\(` – Deprecated function detected. Use modern replacements to ensure compatibility and security updates.
25    - Pattern 2: Usage of deprecated functions
26  - pattern `jquery\\.min\\.js\\?v=1\\.|jquery-1\\.|jquery-2\\.|ckeditor/|tinymce/|angular\\.js@1\\.` – Potentially vulnerable JavaScript library version detected. Update to the latest secure version.
27    - Pattern 3: Known vulnerable libraries referenced
28  - pattern `<script\\s+src=['\"]http|<script\\s+src=['\"]//|<link\\s+[^>]*href=['\"]http` – External scripts or stylesheets without Subresource Integrity (SRI) checks detected. Add integrity and crossorigin attributes.
29    - Pattern 4: Direct inclusion of external scripts without SRI
30  - pattern `module:\\s*('[^']*captcha'|'recaptcha'|'xmlrpc'|'openid'|'php')` – Potentially vulnerable or deprecated module detected. Consider using more secure alternatives.
31    - Pattern 5: Use of obsolete or removed modules
32  - pattern `\"drupal/[^\"]+\":\\s*\"(~|\\^)?[0-9]\\.[0-9]\\.[0-9]\"` – Hard-coded specific version detected in composer.json. Consider using version ranges to receive security updates.
33    - Pattern 6: Hard-coded versions in composer.json
34  - pattern `mysql_|split\\(|ereg\\(|eregi\\(|create_function\\(|each\\(` – Deprecated or insecure PHP function detected. Use modern alternatives for better security.
35    - Pattern 7: Outdated or insecure PHP API usage
36  - pattern `type:\\s*module\\s*\\nname:` – Ensure your module specifies core_version_requirement to prevent installation on unsupported Drupal versions.
37    - Pattern 8: Usage of contrib modules without version constraints
38  - pattern `composer\\.json` – Consider adding drupal/core-security-advisories as a dev dependency to detect known vulnerable packages.
39    - Pattern 9: Missing security advisories handling in composer.json
40  - pattern `check_plain\\(|filter_xss\\(|filter_xss_admin\\(` – Legacy text sanitization function detected. Use Html::escape() or Xss::filter() instead.
41    - Pattern 10: Direct usage of vulnerable sanitization functions
42 
43## Suggestions
44- Guidance:
45**Drupal Component Security Best Practices:**
46 
471. **Update Management:**
48   - Keep Drupal core updated to the latest secure version
49   - Subscribe to the Drupal Security Newsletter
50   - Implement a regular update schedule (monthly at minimum)
51   - Use security advisories checking in your development workflow
52   - Implement Composer's security-advisories metadata
53 
542. **Dependency Management:**
55   - Use Composer for managing all dependencies
56   - Specify version constraints that allow security updates
57   - Add drupal/core-security-advisories as a dev dependency
58   - Regularly run `composer update --with-dependencies`
59   - Use `composer outdated` to identify outdated packages
60 
613. **API Usage:**
62   - Use modern Drupal APIs rather than deprecated functions
63   - Migrate away from jQuery to modern JavaScript where possible
64   - Implement Subresource Integrity (SRI) for external resources
65   - Update custom code to use current best practices
66   - Follow the Drupal API deprecation policies
67 
684. **Security Monitoring:**
69   - Implement automated vulnerability scanning in CI/CD
70   - Use tools like Drupal Check or Upgrade Status module
71   - Monitor the Drupal security advisories page
72   - Implement automated updates for non-critical dependencies
73   - Set up alerts for security issues in used components
74 
755. **Module Management:**
76   - Remove unused modules from your codebase
77   - Prefer well-maintained modules with security teams
78   - Implement proper version constraints in module info files
79   - Consider the security impact before adding new dependencies
80   - Document your dependency management practices
81 
82## Validation Checks
83- Conditions:
84  - pattern `core_version_requirement:\\s*[\"']\\^(8\\.8|8\\.9|9|10)\\.[0-9]+[\"']` – Using proper core version requirements.
85    - Check 1: Proper core version requirement
86  - pattern `\\\\Drupal::messenger\\(\\)|->messenger\\(\\)|\\\\Drupal::service\\('messenger'\\)` – Using modern message API instead of deprecated functions.
87    - Check 2: Use of modern APIs
88  - pattern `\"require\":\\s*\\{[^}]*\"drupal/core(-recommended)?\":\\s*\"\\^[0-9]+\\.[0-9]+\"` – Using proper version constraints in Composer.
89    - Check 3: Proper composer usage
90  - pattern `integrity=[\"'][a-zA-Z0-9\\+/=\\-_]+[\"']\\s+crossorigin=[\"']anonymous[\"']` – Properly implementing Subresource Integrity.
91    - Check 4: SRI implementation
92 
93## Metadata
94- Priority: high
95- Version: 1.1
96- Tags: security, drupal, dependencies, vulnerable-components, owasp, language:php, framework:drupal, category:security, subcategory:dependencies, standard:owasp-top10, risk:a06-vulnerable-components
97## References
98- https://owasp.org/Top10/A06_2021-Vulnerable_and_Outdated_Components/
99- https://www.drupal.org/docs/security-in-drupal/staying-up-to-date
100- https://www.drupal.org/docs/upgrading-drupal
101- https://www.drupal.org/docs/develop/using-composer/managing-dependencies-for-a-drupal-project
102 
103