Cursor rule

1---
2description: Identifies and helps prevent injection vulnerabilities in JavaScript applications, as defined in OWASP Top 10:2021-A03.
3globs: **/*.js, **/*.jsx, **/*.ts, **/*.tsx, !**/node_modules/**, !**/dist/**, !**/build/**, !**/coverage/**
4---
5# JavaScript Injection Security Rule
6 
7<rule>
8name: javascript_injection
9description: Identifies and helps prevent injection vulnerabilities in JavaScript applications, as defined in OWASP Top 10:2021-A03.
10 
11actions:
12  - type: enforce
13    conditions:
14      - pattern: "eval\\(([^)]*(req|request|query|param|user|input)[^)]*)\\)"
15        severity: "critical"
16        message: |
17          🔴 CRITICAL: Potential code injection vulnerability detected.
18          
19          Impact: Attackers can execute arbitrary code in your application context.
20          CWE Reference: CWE-95 (Improper Neutralization of Directives in Dynamically Evaluated Code)
21          
22          ❌ Insecure:
23          eval(req.body.data)
24          
25          ✅ Secure Alternative:
26          // Use safer alternatives like JSON.parse for JSON data
27          try {
28            const data = JSON.parse(req.body.data);
29            // Process data safely
30          } catch (error) {
31            // Handle parsing errors
32          }
33        learn_more_url: "https://owasp.org/www-community/attacks/Direct_Dynamic_Code_Evaluation_Eval_Injection"
34      
35      - pattern: "\\$\\(\\s*(['\"])<[^>]+>\\1\\s*\\)"
36        severity: "high"
37        message: |
38          🟠 HIGH: jQuery HTML injection vulnerability detected.
39          
40          Impact: This can lead to Cross-Site Scripting (XSS) attacks.
41          CWE Reference: CWE-79 (Improper Neutralization of Input During Web Page Generation)
42          
43          ❌ Insecure:
44          $("<div>" + userProvidedData + "</div>")
45          
46          ✅ Secure Alternative:
47          // Create element safely, then set text content
48          const div = $("<div></div>");
49          div.text(userProvidedData);
50        learn_more_url: "https://cheatsheetseries.owasp.org/cheatsheets/jQuery_Security_Cheat_Sheet.html"
51      
52      - pattern: "document\\.write\\(|document\\.writeln\\("
53        severity: "high"
54        message: |
55          🟠 HIGH: Potential DOM-based XSS vulnerability.
56          
57          Impact: Attackers can inject malicious HTML/JavaScript into your page.
58          CWE Reference: CWE-79 (Improper Neutralization of Input During Web Page Generation)
59          
60          ❌ Insecure:
61          document.write("<h1>" + userGeneratedContent + "</h1>");
62          
63          ✅ Secure Alternative:
64          // Use safer DOM manipulation methods
65          const h1 = document.createElement("h1");
66          h1.textContent = userGeneratedContent;
67          document.body.appendChild(h1);
68        learn_more_url: "https://cheatsheetseries.owasp.org/cheatsheets/DOM_based_XSS_Prevention_Cheat_Sheet.html"
69      
70      - pattern: "innerHTML\\s*=|outerHTML\\s*="
71        pattern_negate: "sanitize|DOMPurify|escapeHTML"
72        severity: "high"
73        message: |
74          🟠 HIGH: Potential DOM-based XSS through innerHTML/outerHTML.
75          
76          Impact: Setting HTML content directly can allow script injection.
77          CWE Reference: CWE-79 (Improper Neutralization of Input During Web Page Generation)
78          
79          ❌ Insecure:
80          element.innerHTML = userProvidedData;
81          
82          ✅ Secure Alternative:
83          // Option 1: Use textContent instead for text
84          element.textContent = userProvidedData;
85          
86          // Option 2: Sanitize if HTML is required
87          import DOMPurify from 'dompurify';
88          element.innerHTML = DOMPurify.sanitize(userProvidedData);
89        learn_more_url: "https://cheatsheetseries.owasp.org/cheatsheets/DOM_based_XSS_Prevention_Cheat_Sheet.html"
90      
91      - pattern: "\\$\\(.*\\)\\.html\\("
92        pattern_negate: "sanitize|DOMPurify|escapeHTML"
93        severity: "high"
94        message: |
95          🟠 HIGH: jQuery HTML injection risk detected.
96          
97          Impact: Setting HTML content can lead to XSS vulnerabilities.
98          CWE Reference: CWE-79 (Improper Neutralization of Input During Web Page Generation)
99          
100          ❌ Insecure:
101          $("#element").html(userProvidedData);
102          
103          ✅ Secure Alternative:
104          // Option 1: Use text() instead for text
105          $("#element").text(userProvidedData);
106          
107          // Option 2: Sanitize if HTML is required
108          import DOMPurify from 'dompurify';
109          $("#element").html(DOMPurify.sanitize(userProvidedData));
110        learn_more_url: "https://cheatsheetseries.owasp.org/cheatsheets/jQuery_Security_Cheat_Sheet.html"
111      
112      - pattern: "require\\(([^)]*(req|request|query|param|user|input)[^)]*)\\)"
113        severity: "critical"
114        message: |
115          🔴 CRITICAL: Dynamic require() can lead to remote code execution.
116          
117          Impact: Attackers can load arbitrary modules or access sensitive files.
118          CWE Reference: CWE-95 (Improper Neutralization of Directives in Dynamically Evaluated Code)
119          
120          ❌ Insecure:
121          const module = require(req.query.module);
122          
123          ✅ Secure Alternative:
124          // Use a whitelisproach
125          const allowedModules = {
126            'user': './modules/user',
127            'product': './modules/product'
128          };
129          
130          const moduleName = req.query.module;
131          if (allowedModules[moduleName]) {
132            const module = require(allowedModules[moduleName]);
133            // Use module safely
134          } else {
135            // Handle invalid module request
136          }
137        learn_more_url: "https://owasp.org/www-project-top-ten/2017/A1_2017-Injection"
138      
139      - pattern: "exec\\(([^)]*(req|request|query|param|user|input)[^)]*)\\)"
140        severity: "critical"
141        message: |
142          🔴 CRITICAL: Command injection vulnerability detected.
143          
144          Impact: Attackers can execute arbitrary system commands.
145          CWE Reference: CWE-78 (Improper Neutralization of Special Elements used in an OS Command)
146          
147          ❌ Insecure:
148          exec('ls ' + userInput, (error, stdout, stderr) => {
149            // Process output
150          });
151          
152          ✅ Secure Alternative:
153          // Use child_process.execFile with separate arguments
154          import { execFile } from 'child_process';
155          
156          execFile('ls', [safeDirectory], (error, stdout, stderr) => {
157            // Process output safely
158          });
159          
160          // Or use a validation library to sanitize inputs
161          import validator from 'validator';
162          if (validator.isAlphanumeric(userInput)) {
163            exec('ls ' + userInput, (error, stdout, stderr) => {
164              // Process output
165            });
166          }
167        learn_more_url: "https://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html"
168 
169  - type: suggest
170    message: |
171      **JavaScript Injection Prevention Best Practices:**
172      
173      1. **Input Validation:**
174         - Validate all user inputs both client-side and server-side
175         - Use allowlists instead of blocklists
176         - Apply strict type checking and schema validation
177      
178      2. **Output Encoding:**
179         - Always encode/escape output in the correct context (HTML, JavaScript, CSS, URL)
180         - Use libraries like DOMPurify for HTML sanitization
181         - Avoid building HTML, JavaScript, SQL dynamically from user inputs
182      
183      3. **Content Security Policy (CSP):**
184         - Implement a strict CSP to prevent execution of malicious scripts
185         - Use nonce-based or hash-based CSP to allow only specific scripts
186      
187      4. **Structured Data Formats:**
188         - Use structured data formats like JSON, XML with proper parsers
189         - Avoid manually parsing or constructing these formats
190      
191      5. **Parameterized APIs:**
192         - Use parameterized APIs for database queries, OS commands
193         - Separate code from data to prevent injection
194      
195      6. **DOM Manipulation:**
196         - Prefer .textContent over .innerHTML when displaying user content
197         - Use document.createElement() and node methods instead of directly setting HTML
198      
199      7. **Frameworks and Libraries:**
200         - Keep frameworks and libraries updated to latest secure versions
201         - Many modern frameworks offer built-in protections against common injection attacks
202 
203metadata:
204  priority: critical
205  version: 1.1
206  tags: 
207    - language:javascript
208    - category:security
209    - standard:owasp-top10
210    - risk:a03-injection
211  references:
212    - "https://owasp.org/Top10/A03_2021-Injection/"
213    - "https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html"
214    - "https://nodegoat.herokuapp.com/tutorial/a1"
215    - "https://github.com/OWASP/NodeGoat"
216</rule>
217