Cursor rule

1---
2description: Detect and prevent broken access control patterns in JavaScript applications as defined in OWASP Top 10:2021-A01
3globs: **/*.js, **/*.jsx, **/*.ts, **/*.tsx, !**/node_modules/**, !**/dist/**, !**/build/**, !**/coverage/**
4---
5# JavaScript Broken Access Control (OWASP A01:2021)
6 
7This rule identifies and prevents broken access control vulnerabilities in JavaScript applications, focusing on both browser and Node.js environments, as defined in OWASP Top 10:2021-A01.
8 
9<rule>
10name: javascript_broken_access_control
11description: Detect and prevent broken access control patterns in JavaScript applications as defined in OWASP Top 10:2021-A01
12 
13actions:
14  - type: enforce
15    conditions:
16      # Pattern 1: Detect Direct Reference to User-Supplied IDs (IDOR vulnerability)
17      - pattern: "(?:req|request)\\.(?:params|query|body)\\.(?:id|userId|recordId)[^\\n]*?(?:findById|getById|find\\(|get\\()"
18        message: "Potential Insecure Direct Object Reference (IDOR) vulnerability. User-supplied IDs should be validated against user permissions before database access."
19        
20      # Pattern 2: Detect Missing Authorization Checks in Route Handlers
21      - pattern: "(?:app|router)\\.(?:get|post|put|delete|patch)\\(['\"][^'\"]+['\"],\\s*(?:async)?\\s*\\(?(?:req|request),\\s*(?:res|response)(?:,[^\\)]+)?\\)?\\s*=>\\s*\\{[^\\}]*?\\}\\)"
22        negative_pattern: "(?:isAuthenticated|isAuthorized|checkPermission|verifyAccess|auth\\.check|authenticate|authorize|userHasAccess|checkAuth|permissions\\.|requireAuth|requiresAuth|ensureAuth|\\bauth\\b|\\broles?\\b|\\bpermission\\b|\\baccess\\b)"
23        message: "Route handler appears to be missing authorization checks. Implement proper access control to verify user permissions before processing requests."
24        
25      # Pattern 3: Detect JWT Token Validation Issues
26      - pattern: "(?:jwt|jsonwebtoken)\\.verify\\((?:[^,]+),\\s*['\"]((?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?)['\"]"
27        message: "Hardcoded JWT secret detected. Store JWT secrets securely in environment variables or a configuration manager."
28        
29      # Pattern 4: Detect Client-Side Authorization Checks
30      - pattern: "if\\s*\\((?:user|currentUser)\\.(?:role|isAdmin|hasPermission|can[A-Z][a-zA-Z]+|is[A-Z][a-zA-Z]+)\\)\\s*\\{[^\\}]*?(?:fetch|axios|\\$\\.ajax|http\\.get|http\\.post)\\([^\\)]*?\\)"
31        message: "Authorization logic implemented on client-side. Client-side authorization checks can be bypassed. Always enforce authorization on the server."
32        
33      # Pattern 5: Detect Improper CORS Configuration
34      - pattern: "(?:app\\.use\\(cors\\(\\{[^\\}]*?origin:\\s*['\"]\\*['\"])|Access-Control-Allow-Origin:\\s*['\"]\\*['\"]"
35        message: "Wildcard CORS policy detected. This allows any domain to make cross-origin requests. Restrict CORS to specific trusted domains."
36        
37      # Pattern 6: Detect Lack of Role Checks in Admin Functions
38      - pattern: "(?:function|const)\\s+(?:admin|updateUser|deleteUser|createUser|updateRole|manageUsers|setPermission)[^\\{]*?\\{[^\\}]*?\\}"
39        negative_pattern: "(?:role|permission|isAdmin|hasAccess|authorize|authenticate|auth\\.check|checkPermission|checkRole|verifyRole|ensureAdmin|adminOnly|adminRequired|requirePermission)"
40        message: "Administrative function appears to be missing role or permission checks. Implement proper authorization checks to restrict access to administrative functions."
41        
42      # Pattern 7: Detect Missing Login Rate Limiting
43      - pattern: "(?:function|const)\\s+(?:login|signin|authenticate|auth)[^\\{]*?\\{[^\\}]*?(?:compare(?:Sync)?|check(?:Password)?|match(?:Password)?|verify(?:Password)?)[^\\}]*?\\}"
44        negative_pattern: "(?:rate(?:Limit)?|throttle|limit|delay|cooldown|attempt|counter|maxTries|maxAttempts|lockout|timeout)"
45        message: "Login function appears to be missing rate limiting. Implement rate limiting to prevent brute force attacks."
46        
47      # Pattern 8: Detect Horizontal Privilege Escalation Vulnerability
48      - pattern: "(?:findById|findOne|findByPk|get)\\((?:req|request)\\.(?:params|query|body)\\.(?:id|userId|accountId)\\)"
49        negative_pattern: "(?:!=|!==|===|==)\\s*(?:req\\.user\\.id|req\\.userId|currentUser\\.id|user\\.id|session\\.userId)"
50        message: "Potential horizontal privilege escalation vulnerability. Ensure the requested resource belongs to the authenticated user."
51        
52      # Pattern 9: Detect Missing CSRF Protection
53      - pattern: "(?:app|router)\\.(?:post|put|delete|patch)\\(['\"][^'\"]+['\"]"
54        negative_pattern: "(?:csrf|xsrf|csurf|csrfProtection|antiForgery|csrfToken|csrfMiddleware)"
55        message: "Route may be missing CSRF protection. Implement CSRF tokens for state-changing operations to prevent cross-site request forgery attacks."
56        
57      # Pattern 10: Detect Bypassing Access Control with Path Traversal
58      - pattern: "(?:fs|require)(?:\\.promises)?\\.(read|open|access|stat)(?:File|Sync)?\\([^\\)]*?(?:req|request)\\.(?:params|query|body|path)\\.[^\\)]*?\\)"
59        negative_pattern: "(?:normalize|resolve|sanitize|validate|pathValidation|checkPath)"
60        message: "Potential path traversal vulnerability in file access. Validate and sanitize user-supplied paths to prevent directory traversal attacks."
61        
62      # Pattern 11: Detect Missing Authentication Middleware
63      - pattern: "(?:new\\s+)?express\\(\\)|(?:import|require)\\(['\"]express['\"]\\)"
64        negative_pattern: "(?:app\\.use\\((?:passport|auth|jwt|session|authenticate)|passport\\.authenticate|express-session|express-jwt|jsonwebtoken|requiresAuth|\\bauth\\b)"
65        message: "Express application may be missing authentication middleware. Implement proper authentication to secure your application."
66        
67      # Pattern 12: Detect Insecure Cookie Settings
68      - pattern: "(?:res\\.cookie|cookie\\.set|cookies\\.set|document\\.cookie)\\([^\\)]*?\\)"
69        negative_pattern: "(?:secure:\\s*true|httpOnly:\\s*true|sameSite|expires|maxAge)"
70        message: "Cookies appear to be set without security attributes. Set the secure, httpOnly, and sameSite attributes for sensitive cookies."
71      
72      # Pattern 13: Detect Hidden Form Fields for Access Control
73      - pattern: "<input[^>]*?type=['\"]hidden['\"][^>]*?(?:(?:name|id)=['\"](?:admin|role|isAdmin|access|permission|privilege)['\"])"
74        message: "Hidden form fields used for access control. Never rely on hidden form fields for access control decisions as they can be easily manipulated."
75        
76      # Pattern 14: Detect Client-Side Access Control Routing
77      - pattern: "(?:isAdmin|hasRole|hasPermission|userCan|canAccess)\\s*\\?\\s*<(?:Route|Navigate|Link|Redirect)"
78        message: "Client-side conditional routing based on user roles detected. Always enforce access control on the server side as client-side checks can be bypassed."
79        
80      # Pattern 15: Detect Access Control based on URL Parameters
81      - pattern: "if\\s*\\((?:req|request)\\.(?:query|params)\\.(?:admin|mode|access|role|type)\\s*===?\\s*['\"](?:admin|true|1|superuser|manager)['\"]\\)"
82        message: "Access control based on URL parameters detected. Never use request parameters for access control decisions as they can be easily manipulated."
83 
84  - type: suggest
85    message: |
86      **JavaScript Access Control Best Practices:**
87      
88      1. **Implement Server-Side Access Control**
89         - Never rely solely on client-side access control
90         - Use middleware to enforce authorization
91         - Example Express.js middleware:
92```javascript
93           // Role-based access control middleware
94           function requireRole(role) {
95             return (req, res, next) => {
96               if (!req.user) {
97                 return res.status(401).json({ error: 'Authentication required' });
98               }
99               
100               if (!req.user.roles.includes(role)) {
101                 return res.status(403).json({ error: 'Insufficient permissions' });
102               }
103               
104               next();
105             };
106           }
107           
108           // Usage in routes
109           app.get('/admin/users', requireRole('admin'), (req, res) => {
110             // Handle admin-only route
111           });
112```
113      
114      2. **Implement Proper Authentication**
115         - Use established authentication libraries
116         - Implement multi-factor authentication for sensitive operations
117         - Example with Passport.js:
118```javascript
119           const passport = require('passport');
120           const JwtStrategy = require('passport-jwt').Strategy;
121           
122           passport.use(new JwtStrategy(jwtOptions, async (payload, done) => {
123             try {
124               const user = await User.findById(payload.sub);
125               if (!user) {
126                 return done(null, false);
127               }
128               return done(null, user);
129             } catch (error) {
130               return done(error, false);
131             }
132           }));
133           
134           // Protect routes
135           app.get('/protected', 
136             passport.authenticate('jwt', { session: false }),
137             (req, res) => {
138               res.json({ success: true });
139             }
140           );
141```
142      
143      3. **Implement Proper Authorization**
144         - Use attribute or role-based access control
145         - Check permissions for each protected resource
146         - Example:
147```javascript
148           // Permission-based middleware
149           function checkPermission(permission) {
150             return async (req, res, next) => {
151               try {
152                 // Get user permissions from database
153                 const userPermissions = await getUserPermissions(req.user.id);
154                 
155                 if (!userPermissions.includes(permission)) {
156                   return res.status(403).json({ error: 'Permission denied' });
157                 }
158                 
159                 next();
160               } catch (error) {
161                 next(error);
162               }
163             };
164           }
165           
166           // Usage
167           app.post('/articles', 
168             authenticate,
169             checkPermission('article:create'), 
170             (req, res) => {
171               // Create article
172             }
173           );
174```
175      
176      4. **Protect Against Insecure Direct Object References (IDOR)**
177         - Validate that the requested resource belongs to the user
178         - Use indirect references or access control lists
179         - Example:
180```javascript
181           app.get('/documents/:id', authenticate, async (req, res) => {
182             try {
183               const document = await Document.findById(req.params.id);
184               
185               // Check if document exists
186               if (!document) {
187                 return res.status(404).json({ error: 'Document not found' });
188               }
189               
190               // Check if user owns the document or has access
191               if (document.userId !== req.user.id && 
192                   !(await userHasAccess(req.user.id, document.id))) {
193                 return res.status(403).json({ error: 'Access denied' });
194               }
195               
196               res.json(document);
197             } catch (error) {
198               res.status(500).json({ error: error.message });
199             }
200           });
201```
202      
203      5. **Implement Proper CORS Configuration**
204         - Never use wildcard (*) in production
205         - Whitelist specific trusted origins
206         - Example:
207```javascript
208           const cors = require('cors');
209           
210           const corsOptions = {
211             origin: ['https://trusted-app.com', 'https://admin.trusted-app.com'],
212             methods: ['GET', 'POST', 'PUT', 'DELETE'],
213             allowedHeaders: ['Content-Type', 'Authorization'],
214             credentials: true,
215             maxAge: 86400 // 24 hours
216           };
217           
218           app.use(cors(corsOptions));
219```
220      
221      6. **Implement CSRF Protection**
222         - Use anti-CSRF tokens for state-changing operations
223         - Validate the token on the server
224         - Example with csurf:
225```javascript
226           const csrf = require('csurf');
227           
228           // Setup CSRF protection
229           const csrfProtection = csrf({ cookie: true });
230           
231           // Generate CSRF token
232           app.get('/form', csrfProtection, (req, res) => {
233             res.render('form', { csrfToken: req.csrfToken() });
234           });
235           
236           // Validate CSRF token
237           app.post('/process', csrfProtection, (req, res) => {
238             // Process the request
239           });
240```
241      
242      7. **Implement Secure Cookie Settings**
243         - Set secure, httpOnly, and sameSite attributes
244         - Use appropriate expiration times
245         - Example:
246```javascript
247           res.cookie('sessionId', sessionId, {
248             httpOnly: true,  // Prevents JavaScript access
249             secure: true,    // Only sent over HTTPS
250             sameSite: 'strict', // Prevents CSRF attacks
251             maxAge: 3600000, // 1 hour
252             path: '/',
253             domain: 'yourdomain.com'
254           });
255```
256      
257      8. **Implement Rate Limiting**
258         - Apply rate limiting to authentication endpoints
259         - Prevent brute force attacks
260         - Example with express-rate-limit:
261```javascript
262           const rateLimit = require('express-rate-limit');
263           
264           const loginLimiter = rateLimit({
265             windowMs: 15 * 60 * 1000, // 15 minutes
266             max: 5, // 5 attempts per window
267             standardHeaders: true,
268             legacyHeaders: false,
269             message: {
270               error: 'Too many login attempts, please try again after 15 minutes'
271             }
272           });
273           
274           app.post('/login', loginLimiter, (req, res) => {
275             // Handle login
276           });
277```
278      
279      9. **Implement Proper Session Management**
280         - Use secure session management libraries
281         - Rotate session IDs after login
282         - Example:
283```javascript
284           const session = require('express-session');
285           
286           app.use(session({
287             secret: process.env.SESSION_SECRET,
288             resave: false,
289             saveUninitialized: false,
290             cookie: {
291               secure: true,
292               httpOnly: true,
293               sameSite: 'strict',
294               maxAge: 3600000 // 1 hour
295             }
296           }));
297           
298           app.post('/login', (req, res) => {
299             // Authenticate user
300             
301             // Regenerate session to prevent session fixation
302             req.session.regenerate((err) => {
303               if (err) {
304                 return res.status(500).json({ error: 'Failed to create session' });
305               }
306               
307               // Set authenticated user in session
308               req.session.userId = user.id;
309               req.session.authenticated = true;
310               
311               res.json({ success: true });
312             });
313           });
314```
315      
316      10. **Implement Proper Access Control for APIs**
317          - Use OAuth 2.0 or JWT for API authentication
318          - Implement proper scope checking
319          - Example with JWT:
320```javascript
321            const jwt = require('jsonwebtoken');
322            
323            function verifyToken(req, res, next) {
324              const token = req.headers.authorization?.split(' ')[1];
325              
326              if (!token) {
327                return res.status(401).json({ error: 'No token provided' });
328              }
329              
330              try {
331                const decoded = jwt.verify(token, process.env.JWT_SECRET);
332                req.user = decoded;
333                
334                // Check if token has required scope
335                if (req.route.path === '/api/admin' && !decoded.scopes.includes('admin')) {
336                  return res.status(403).json({ error: 'Insufficient scope' });
337                }
338                
339                next();
340              } catch (error) {
341                return res.status(401).json({ error: 'Invalid token' });
342              }
343            }
344            
345            // Protect API routes
346            app.get('/api/users', verifyToken, (req, res) => {
347              // Handle request
348            });
349```
350 
351  - type: validate
352    conditions:
353      # Check 1: Authentication middleware
354      - pattern: "(?:app\\.use\\((?:authenticate|auth\\.initialize|passport\\.initialize|express-session|jwt))|(?:passport\\.authenticate\\()|(?:auth\\.required)"
355        message: "Authentication middleware is implemented correctly."
356      
357      # Check 2: Authorization checks
358      - pattern: "(?:isAuthorized|checkPermission|hasRole|requireRole|checkAccess|canAccess|checkAuth|roleRequired|requireScope)"
359        message: "Authorization checks are implemented."
360      
361      # Check 3: CSRF protection
362      - pattern: "(?:csrf|csurf|csrfProtection|antiForgery|csrfToken)"
363        message: "CSRF protection is implemented."
364      
365      # Check 4: Secure cookies
366      - pattern: "(?:cookie|cookies).*(?:secure:\\s*true|httpOnly:\\s*true|sameSite)"
367        message: "Secure cookie settings are configured."
368      
369      # Check 5: CORS configuration
370      - pattern: "cors\\(\\{[^\\}]*?origin:\\s*\\[[^\\]]+\\]"
371        message: "CORS is configured with specific origins rather than wildcards."
372 
373metadata:
374  priority: high
375  version: 1.0
376  tags:
377    - security
378    - javascript
379    - access-control
380    - authorization
381    - authentication
382    - owasp
383    - language:javascript
384    - language:typescript
385    - framework:express
386    - framework:react
387    - framework:angular
388    - framework:vue
389    - category:security
390    - subcategory:access-control
391    - standard:owasp-top10
392    - risk:a01-broken-access-control
393  references:
394    - "https://owasp.org/Top10/A01_2021-Broken_Access_Control/"
395    - "https://cheatsheetseries.owasp.org/cheatsheets/Access_Control_Cheat_Sheet.html"
396    - "https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html"
397    - "https://nodejs.org/en/security/best-practices/"
398    - "https://expressjs.com/en/advanced/best-practice-security.html"
399    - "https://auth0.com/blog/node-js-and-express-tutorial-building-and-securing-restful-apis/"
400</rule> 
401