Cursor rule

1---
2description: Detect and prevent cryptographic failures in JavaScript applications as defined in OWASP Top 10:2021-A02
3globs: **/*.js, **/*.jsx, **/*.ts, **/*.tsx, !**/node_modules/**, !**/dist/**, !**/build/**, !**/coverage/**
4---
5# JavaScript Cryptographic Failures (OWASP A02:2021)
6 
7<rule>
8name: javascript_cryptographic_failures
9description: Detect and prevent cryptographic failures in JavaScript applications as defined in OWASP Top 10:2021-A02
10 
11actions:
12  - type: enforce
13    conditions:
14      # Pattern 1: Weak or insecure cryptographic algorithms
15      - pattern: "(?:createHash|crypto\\.createHash)\\(['\"](?:md5|sha1)['\"]\\)|(?:crypto|require\\(['\"]crypto['\"]\\))\\.(?:createHash|Hash)\\(['\"](?:md5|sha1)['\"]\\)|new (?:MD5|SHA1)\\(|CryptoJS\\.(?:MD5|SHA1)\\("
16        message: "Using weak hashing algorithms (MD5/SHA1). Use SHA-256 or stronger algorithms."
17        
18      # Pattern 2: Hardcoded secrets/credentials
19      - pattern: "(?:const|let|var)\\s+(?:password|secret|key|token|auth|apiKey|api_key)\\s*=\\s*['\"][^'\"]+['\"]"
20        message: "Potential hardcoded credentials detected. Store secrets in environment variables or a secure vault."
21        
22      # Pattern 3: Insecure random number generation
23      - pattern: "Math\\.random\\(\\)|Math\\.floor\\(\\s*Math\\.random\\(\\)\\s*\\*"
24        message: "Using Math.random() for security purposes. Use crypto.randomBytes() or Web Crypto API for cryptographic operations."
25        
26      # Pattern 4: Weak SSL/TLS configuration
27      - pattern: "(?:tls|https|require\\(['\"]https['\"]\\)|require\\(['\"]tls['\"]\\))\\.(?:createServer|request|get)\\([^\\)]*?{[^}]*?secureProtocol\\s*:\\s*['\"](?:SSLv2_method|SSLv3_method|TLSv1_method|TLSv1_1_method)['\"]"
28        message: "Using deprecated/insecure SSL/TLS protocol versions. Use TLS 1.2+ for secure communications."
29        
30      # Pattern 5: Missing certificate validation
31      - pattern: "(?:rejectUnauthorized|strictSSL)\\s*:\\s*false"
32        message: "SSL certificate validation is disabled. Always validate certificates in production environments."
33        
34      # Pattern 6: Insecure cipher usage
35      - pattern: "(?:createCipheriv|crypto\\.createCipheriv)\\(['\"](?:des|des3|rc4|bf|blowfish|aes-\\d+-ecb)['\"]"
36        message: "Using insecure encryption cipher or mode. Use AES with GCM or CBC mode with proper padding."
37        
38      # Pattern 7: Insufficient key length
39      - pattern: "(?:generateKeyPair|generateKeyPairSync)\\([^,]*?['\"]rsa['\"][^,]*?{[^}]*?modulusLength\\s*:\\s*(\\d{1,3}|1[0-9]{3}|20[0-3][0-9]|204[0-7])\\s*}"
40        message: "Using insufficient key length for asymmetric encryption. RSA keys should be at least 2048 bits, preferably 4096 bits."
41        
42      # Pattern 8: Insecure password hashing
43      - pattern: "(?:createHash|crypto\\.createHash)\\([^)]*?\\)\\.(?:update|digest)\\([^)]*?\\)|CryptoJS\\.(?:SHA256|SHA512|SHA3)\\([^)]*?\\)"
44        negative_pattern: "(?:bcrypt|scrypt|pbkdf2|argon2)"
45        message: "Using plain hashing for passwords. Use dedicated password hashing functions like bcrypt, scrypt, or PBKDF2."
46        
47      # Pattern 9: Missing salt in password hashing
48      - pattern: "(?:pbkdf2|pbkdf2Sync)\\([^,]+,[^,]+,[^,]+,\\s*\\d+\\s*,[^,]+\\)"
49        negative_pattern: "(?:salt|crypto\\.randomBytes)"
50        message: "Ensure you're using a proper random salt with password hashing functions."
51        
52      # Pattern 10: Insecure cookie settings
53      - pattern: "(?:document\\.cookie|cookies\\.set|res\\.cookie|cookie\\.serialize)\\([^)]*?\\)"
54        negative_pattern: "(?:secure\\s*:|httpOnly\\s*:|sameSite\\s*:)"
55        message: "Cookies with sensitive data should have secure and httpOnly flags enabled."
56        
57      # Pattern 11: Client-side encryption
58      - pattern: "(?:encrypt|decrypt|createCipher|createDecipher)\\([^)]*?\\)"
59        location: "(?:frontend|client|browser|react|vue|angular)"
60        message: "Performing sensitive cryptographic operations on the client side. Move encryption/decryption logic to the server."
61        
62      # Pattern 12: Insecure JWT implementation
63      - pattern: "(?:jwt\\.sign|jsonwebtoken\\.sign)\\([^,]*?,[^,]*?,[^\\)]*?\\)"
64        negative_pattern: "(?:expiresIn|algorithm\\s*:\\s*['\"](?:HS256|HS384|HS512|RS256|RS384|RS512|ES256|ES384|ES512)['\"])"
65        message: "JWT implementation missing expiration or using weak algorithm. Set expiresIn and use a strong algorithm."
66        
67      # Pattern 13: Weak PRNG in Node.js
68      - pattern: "(?:crypto\\.pseudoRandomBytes|crypto\\.rng|crypto\\.randomInt)\\("
69        message: "Using potentially weak pseudorandom number generator. Use crypto.randomBytes() for cryptographic security."
70        
71      # Pattern 14: Insecure local storage usage for sensitive data
72      - pattern: "(?:localStorage\\.setItem|sessionStorage\\.setItem)\\(['\"](?:token|auth|jwt|password|secret|key|credential)['\"]"
73        message: "Storing sensitive data in browser storage. Use secure HttpOnly cookies for authentication tokens."
74        
75      # Pattern 15: Weak password validation
76      - pattern: "(?:password\\.length\\s*>=?\\s*\\d|password\\.match\\(['\"][^'\"]+['\"]\\))"
77        negative_pattern: "(?:password\\.length\\s*>=?\\s*(?:8|9|10|11|12)|[A-Z]|[a-z]|[0-9]|[^A-Za-z0-9])"
78        message: "Weak password validation. Require at least 12 characters with a mix of uppercase, lowercase, numbers, and special characters."
79 
80  - type: suggest
81    message: |
82      **JavaScript Cryptography Best Practices:**
83      
84      1. **Secure Password Storage:**
85         - Use dedicated password hashing algorithms:
86```javascript
87           // Node.js with bcrypt
88           const bcrypt = require('bcrypt');
89           const saltRounds = 12;
90           const hashedPassword = await bcrypt.hash(password, saltRounds);
91           
92           // Verify password
93           const match = await bcrypt.compare(password, hashedPassword);
94```
95         - Or use Argon2 (preferred) or PBKDF2 with sufficient iterations:
96```javascript
97           // Node.js with crypto
98           const crypto = require('crypto');
99           
100           function hashPassword(password) {
101             const salt = crypto.randomBytes(16);
102             const hash = crypto.pbkdf2Sync(password, salt, 310000, 32, 'sha256');
103             return { salt: salt.toString('hex'), hash: hash.toString('hex') };
104           }
105```
106      
107      2. **Secure Random Number Generation:**
108         - In Node.js:
109```javascript
110           const crypto = require('crypto');
111           const randomBytes = crypto.randomBytes(32); // 256 bits of randomness
112```
113         - In browsers:
114```javascript
115           const array = new Uint8Array(32);
116           window.crypto.getRandomValues(array);
117```
118      
119      3. **Secure Communications:**
120         - Use TLS 1.2+ for all communications:
121```javascript
122           // Node.js HTTPS server
123           const https = require('https');
124           const fs = require('fs');
125           
126           const options = {
127             key: fs.readFileSync('private-key.pem'),
128             cert: fs.readFileSync('certificate.pem'),
129             minVersion: 'TLSv1.2'
130           };
131           
132           https.createServer(options, (req, res) => {
133             res.writeHead(200);
134             res.end('Hello, world!');
135           }).listen(443);
136```
137         - Always validate certificates:
138```javascript
139           // Node.js HTTPS request
140           const https = require('https');
141           
142           const options = {
143             hostname: 'example.com',
144             port: 443,
145             path: '/',
146             method: 'GET',
147             rejectUnauthorized: true // Default, but explicitly set for clarity
148           };
149           
150           const req = https.request(options, (res) => {
151             // Handle response
152           });
153```
154      
155      4. **Proper Key Management:**
156         - Never hardcode secrets in source code
157         - Use environment variables or secure vaults:
158```javascript
159           // Node.js with dotenv
160           require('dotenv').config();
161           const apiKey = process.env.API_KEY;
162```
163         - Consider using dedicated key management services
164      
165      5. **Secure Encryption:**
166         - Use authenticated encryption (AES-GCM):
167```javascript
168           // Node.js crypto
169           const crypto = require('crypto');
170           
171           function encrypt(text, masterKey) {
172             const iv = crypto.randomBytes(12);
173             const cipher = crypto.createCipheriv('aes-256-gcm', masterKey, iv);
174             
175             let encrypted = cipher.update(text, 'utf8', 'hex');
176             encrypted += cipher.final('hex');
177             
178             const authTag = cipher.getAuthTag().toString('hex');
179             
180             return {
181               iv: iv.toString('hex'),
182               encrypted,
183               authTag
184             };
185           }
186           
187           function decrypt(encrypted, masterKey) {
188             const decipher = crypto.createDecipheriv(
189               'aes-256-gcm',
190               masterKey,
191               Buffer.from(encrypted.iv, 'hex')
192             );
193             
194             decipher.setAuthTag(Buffer.from(encrypted.authTag, 'hex'));
195             
196             let decrypted = decipher.update(encrypted.encrypted, 'hex', 'utf8');
197             decrypted += decipher.final('utf8');
198             
199             return decrypted;
200           }
201```
202      
203      6. **Secure Cookie Handling:**
204         - Set secure and httpOnly flags:
205```javascript
206           // Express.js
207           res.cookie('session', sessionId, {
208             httpOnly: true,
209             secure: true,
210             sameSite: 'strict',
211             maxAge: 3600000 // 1 hour
212           });
213```
214      
215      7. **JWT Security:**
216         - Use strong algorithms and set expiration:
217```javascript
218           // Node.js with jsonwebtoken
219           const jwt = require('jsonwebtoken');
220           
221           const token = jwt.sign(
222             { userId: user.id },
223             process.env.JWT_SECRET,
224             { 
225               expiresIn: '1h',
226               algorithm: 'HS256'
227             }
228           );
229```
230         - Validate tokens properly:
231```javascript
232           try {
233             const decoded = jwt.verify(token, process.env.JWT_SECRET);
234             // Process request with decoded data
235           } catch (err) {
236             // Handle invalid token
237           }
238```
239      
240      8. **Constant-Time Comparison:**
241         - Use crypto.timingSafeEqual for comparing secrets:
242```javascript
243           const crypto = require('crypto');
244           
245           function safeCompare(a, b) {
246             const bufA = Buffer.from(a);
247             const bufB = Buffer.from(b);
248             
249             // Ensure the buffers are the same length to avoid timing attacks
250             // based on length differences
251             if (bufA.length !== bufB.length) {
252               return false;
253             }
254             
255             return crypto.timingSafeEqual(bufA, bufB);
256           }
257```
258 
259  - type: validate
260    conditions:
261      # Check 1: Proper password hashing
262      - pattern: "bcrypt\\.hash|scrypt|pbkdf2|argon2"
263        message: "Using secure password hashing algorithm."
264      
265      # Check 2: Secure random generation
266      - pattern: "crypto\\.randomBytes|window\\.crypto\\.getRandomValues"
267        message: "Using cryptographically secure random number generation."
268      
269      # Check 3: Strong TLS configuration
270      - pattern: "minVersion\\s*:\\s*['\"]TLSv1_2['\"]|minVersion\\s*:\\s*['\"]TLSv1_3['\"]"
271        message: "Using secure TLS configuration."
272      
273      # Check 4: Proper certificate validation
274      - pattern: "rejectUnauthorized\\s*:\\s*true|strictSSL\\s*:\\s*true"
275        message: "Properly validating SSL certificates."
276 
277metadata:
278  priority: high
279  version: 1.0
280  tags:
281    - security
282    - javascript
283    - nodejs
284    - browser
285    - cryptography
286    - encryption
287    - owasp
288    - language:javascript
289    - framework:express
290    - framework:react
291    - framework:vue
292    - framework:angular
293    - category:security
294    - subcategory:cryptography
295    - standard:owasp-top10
296    - risk:a02-cryptographic-failures
297  references:
298    - "https://owasp.org/Top10/A02_2021-Cryptographic_Failures/"
299    - "https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html"
300    - "https://nodejs.org/api/crypto.html"
301    - "https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto"
302    - "https://www.npmjs.com/package/bcrypt"
303    - "https://www.npmjs.com/package/jsonwebtoken"
304</rule> 
305