Cursor rule

1---
2description: Detect and prevent insecure design patterns in JavaScript applications as defined in OWASP Top 10:2021-A04
3globs: **/*.js, **/*.jsx, **/*.ts, **/*.tsx, !**/node_modules/**, !**/dist/**, !**/build/**, !**/coverage/**
4---
5# JavaScript Insecure Design (OWASP A04:2021)
6 
7<rule>
8name: javascript_insecure_design
9description: Detect and prevent insecure design patterns in JavaScript applications as defined in OWASP Top 10:2021-A04
10 
11actions:
12  - type: enforce
13    conditions:
14      # Pattern 1: Lack of Rate Limiting
15      - pattern: "app\\.(?:get|post|put|delete|patch)\\([^)]*?\\)\\s*(?!.*(?:rateLimiter|limiter|throttle|rateLimit))"
16        location: "(?:routes|api|controllers)"
17        message: "Potential lack of rate limiting in API endpoint. Consider implementing rate limiting to prevent abuse."
18        
19      # Pattern 2: Insecure Direct Object Reference (IDOR)
20      - pattern: "(?:findById|getById|findOne)\\([^)]*?(?:req\\.|request\\.|params\\.|query\\.|body\\.|user\\.|input\\.|form\\.)[^)]*?\\)\\s*(?!.*(?:authorization|permission|access|canAccess|isAuthorized|checkPermission))"
21        location: "(?:routes|api|controllers)"
22        message: "Potential Insecure Direct Object Reference (IDOR) vulnerability. Implement proper authorization checks before accessing objects by ID."
23        
24      # Pattern 3: Lack of Input Validation
25      - pattern: "(?:req\\.|request\\.|params\\.|query\\.|body\\.|user\\.|input\\.|form\\.)[a-zA-Z0-9_]+\\s*(?!.*(?:validate|sanitize|check|schema|joi|yup|zod|validator|isValid))"
26        location: "(?:routes|api|controllers)"
27        message: "Potential lack of input validation. Implement proper validation for all user inputs."
28        
29      # Pattern 4: Hardcoded Business Logic
30      - pattern: "if\\s*\\([^)]*?(?:role\\s*===\\s*['\"]admin['\"]|isAdmin\\s*===\\s*true|user\\.role\\s*===\\s*['\"]admin['\"])\\s*\\)"
31        message: "Hardcoded business logic for authorization. Consider using a more flexible role-based access control system."
32        
33      # Pattern 5: Lack of Proper Error Handling
34      - pattern: "catch\\s*\\([^)]*?\\)\\s*\\{[^}]*?(?:console\\.(?:log|error))[^}]*?\\}"
35        negative_pattern: "(?:res\\.status|next\\(err|next\\(error|errorHandler)"
36        message: "Improper error handling. Avoid only logging errors without proper handling or user feedback."
37        
38      # Pattern 6: Insecure Authentication Design
39      - pattern: "(?:password|token|secret|key)\\s*===\\s*(?:req\\.|request\\.|params\\.|query\\.|body\\.|user\\.|input\\.|form\\.)"
40        message: "Insecure authentication design. Avoid direct string comparison for passwords or tokens."
41        
42      # Pattern 7: Lack of Proper Logging
43      - pattern: "app\\.(?:get|post|put|delete|patch)\\([^)]*?\\)\\s*(?!.*(?:log|logger|winston|bunyan|morgan|audit))"
44        location: "(?:routes|api|controllers)"
45        message: "Lack of proper logging in API endpoint. Implement logging for security-relevant events."
46        
47      # Pattern 8: Insecure Defaults
48      - pattern: "new\\s+(?:Session|Cookie|JWT)\\([^)]*?\\{[^}]*?(?:secure\\s*:\\s*false|httpOnly\\s*:\\s*false|sameSite\\s*:\\s*['\"]none['\"])"
49        message: "Insecure default configuration. Avoid setting secure:false, httpOnly:false, or sameSite:'none' for cookies or sessions."
50        
51      # Pattern 9: Lack of Proper Access Control
52      - pattern: "router\\.(?:get|post|put|delete|patch)\\([^)]*?\\)\\s*(?!.*(?:authenticate|authorize|requireAuth|isAuthenticated|checkAuth|verifyToken|passport\\.authenticate))"
53        location: "(?:routes|api|controllers)"
54        message: "Potential lack of access control in route definition. Implement proper authentication and authorization middleware."
55        
56      # Pattern 10: Insecure File Operations
57      - pattern: "(?:fs\\.(?:readFile|writeFile|appendFile|readdir|stat|access|open|unlink)|require)\\([^)]*?(?:(?:\\+|\\$\\{|\\`)[^)]*?(?:__dirname|__filename|process\\.cwd\\(\\)|path\\.(?:resolve|join)))"
58        negative_pattern: "path\\.normalize|path\\.resolve|path\\.join"
59        message: "Insecure file operations. Use path.normalize() and validate file paths to prevent directory traversal attacks."
60        
61      # Pattern 11: Lack of Proper Secrets Management
62      - pattern: "(?:apiKey|secret|password|token|credentials)\\s*=\\s*(?:process\\.env\\.[A-Z_]+|config\\.[a-zA-Z0-9_]+|['\"][^'\"]+['\"])"
63        negative_pattern: "(?:vault|secretsManager|keyVault|secretClient)"
64        message: "Insecure secrets management. Consider using a dedicated secrets management solution instead of environment variables or configuration files."
65        
66      # Pattern 12: Insecure Randomness
67      - pattern: "Math\\.random\\(\\)"
68        location: "(?:auth|security|token|password|key|iv|nonce|salt)"
69        message: "Insecure randomness. Use crypto.randomBytes() or a similar cryptographically secure random number generator for security-sensitive operations."
70        
71      # Pattern 13: Lack of Proper Input Sanitization for Templates
72      - pattern: "(?:template|render|compile|ejs\\.render|handlebars\\.compile|pug\\.render)\\([^)]*?(?:(?:\\+|\\$\\{|\\`)[^)]*?(?:req\\.|request\\.|params\\.|query\\.|body\\.|user\\.|input\\.|form\\.))"
73        message: "Potential template injection vulnerability. Sanitize user input before using in templates."
74        
75      # Pattern 14: Insecure WebSocket Implementation
76      - pattern: "new\\s+WebSocket\\([^)]*?\\)|io\\.on\\(['\"]connection['\"]"
77        negative_pattern: "(?:authenticate|authorize|verifyClient|beforeConnect)"
78        message: "Potentially insecure WebSocket implementation. Implement proper authentication and authorization for WebSocket connections."
79        
80      # Pattern 15: Insecure Cross-Origin Resource Sharing (CORS)
81      - pattern: "(?:cors\\(\\{[^}]*?origin\\s*:\\s*['\"]\\*['\"]|app\\.use\\(cors\\(\\{[^}]*?origin\\s*:\\s*['\"]\\*['\"])"
82        message: "Insecure CORS configuration. Avoid using wildcard (*) for CORS origin in production environments."
83 
84  - type: suggest
85    message: |
86      **JavaScript Secure Design Best Practices:**
87      
88      1. **Defense in Depth Strategy:**
89         - Implement multiple layers of security controls
90         - Don't rely on a single security mechanism
91         - Example:
92```javascript
93           // Multiple layers of protection
94           app.use(helmet()); // HTTP security headers
95           app.use(rateLimit()); // Rate limiting
96           app.use(cors({ origin: allowedOrigins })); // Restricted CORS
97           app.use(express.json({ limit: '10kb' })); // Request size limiting
98           app.use(sanitize()); // Input sanitization
99```
100      
101      2. **Proper Access Control:**
102         - Implement role-based access control (RBAC)
103         - Use middleware for authorization checks
104         - Example:
105```javascript
106           // Role-based middleware
107           const requireRole = (role) => {
108             return (req, res, next) => {
109               if (!req.user) {
110                 return res.status(401).json({ error: 'Unauthorized' });
111               }
112               
113               if (req.user.role !== role) {
114                 return res.status(403).json({ error: 'Forbidden' });
115               }
116               
117               next();
118             };
119           };
120           
121           // Apply to routes
122           router.get('/admin/users', 
123             authenticate, 
124             requireRole('admin'), 
125             adminController.listUsers
126           );
127```
128      
129      3. **Rate Limiting:**
130         - Implement rate limiting for all API endpoints
131         - Use different limits for different endpoints based on sensitivity
132         - Example:
133```javascript
134           const rateLimit = require('express-rate-limit');
135           
136           // General API rate limit
137           const apiLimiter = rateLimit({
138             windowMs: 15 * 60 * 1000, // 15 minutes
139             max: 100, // limit each IP to 100 requests per windowMs
140             standardHeaders: true,
141             legacyHeaders: false,
142           });
143           
144           // More strict limit for authentication endpoints
145           const authLimiter = rateLimit({
146             windowMs: 15 * 60 * 1000,
147             max: 5, // limit each IP to 5 login attempts per windowMs
148             standardHeaders: true,
149             legacyHeaders: false,
150           });
151           
152           // Apply rate limiters
153           app.use('/api/', apiLimiter);
154           app.use('/api/auth/', authLimiter);
155```
156      
157      4. **Input Validation:**
158         - Validate all user inputs using schema validation
159         - Implement both client and server-side validation
160         - Example:
161```javascript
162           const Joi = require('joi');
163           
164           // Define validation schema
165           const userSchema = Joi.object({
166             username: Joi.string().alphanum().min(3).max(30).required(),
167             email: Joi.string().email().required(),
168             password: Joi.string().pattern(new RegExp('^[a-zA-Z0-9]{8,30}$')).required(),
169             role: Joi.string().valid('user', 'admin').default('user')
170           });
171           
172           // Validation middleware
173           const validateUser = (req, res, next) => {
174             const { error } = userSchema.validate(req.body);
175             if (error) {
176               return res.status(400).json({ error: error.details[0].message });
177             }
178             next();
179           };
180           
181           // Apply validation
182           router.post('/users', validateUser, userController.create);
183```
184      
185      5. **Proper Error Handling:**
186         - Implement centralized error handling
187         - Avoid exposing sensitive information in error messages
188         - Example:
189```javascript
190           // Centralized error handler
191           app.use((err, req, res, next) => {
192             // Log error for internal use
193             console.error(err.stack);
194             
195             // Send appropriate response to client
196             const statusCode = err.statusCode || 500;
197             res.status(statusCode).json({
198               status: 'error',
199               message: statusCode === 500 ? 'Internal server error' : err.message
200             });
201           });
202           
203           // Custom error class
204           class AppError extends Error {
205             constructor(message, statusCode) {
206               super(message);
207               this.statusCode = statusCode;
208               this.status = `${statusCode}`.startsWith('4') ? 'fail' : 'error';
209               this.isOperational = true;
210               
211               Error.captureStackTrace(this, this.constructor);
212             }
213           }
214           
215           // Usage in controllers
216           if (!user) {
217             return next(new AppError('User not found', 404));
218           }
219```
220      
221      6. **Secure Authentication Design:**
222         - Use secure password hashing (bcrypt, Argon2)
223         - Implement proper session management
224         - Use secure token validation
225         - Example:
226```javascript
227           const bcrypt = require('bcrypt');
228           const jwt = require('jsonwebtoken');
229           
230           // Password hashing
231           const hashPassword = async (password) => {
232             const salt = await bcrypt.genSalt(12);
233             return bcrypt.hash(password, salt);
234           };
235           
236           // Password verification
237           const verifyPassword = async (password, hashedPassword) => {
238             return await bcrypt.compare(password, hashedPassword);
239           };
240           
241           // Token generation
242           const generateToken = (userId) => {
243             return jwt.sign(
244               { id: userId },
245               process.env.JWT_SECRET,
246               { expiresIn: '1h' }
247             );
248           };
249           
250           // Token verification middleware
251           const verifyToken = (req, res, next) => {
252             const token = req.headers.authorization?.split(' ')[1];
253             
254             if (!token) {
255               return res.status(401).json({ error: 'No token provided' });
256             }
257             
258             try {
259               const decoded = jwt.verify(token, process.env.JWT_SECRET);
260               req.userId = decoded.id;
261               next();
262             } catch (error) {
263               return res.status(401).json({ error: 'Invalid token' });
264             }
265           };
266```
267      
268      7. **Comprehensive Logging:**
269         - Log security-relevant events
270         - Include necessary context but avoid sensitive data
271         - Use structured logging
272         - Example:
273```javascript
274           const winston = require('winston');
275           
276           // Create logger
277           const logger = winston.createLogger({
278             level: 'info',
279             format: winston.format.json(),
280             defaultMeta: { service: 'user-service' },
281             transports: [
282               new winston.transports.File({ filename: 'error.log', level: 'error' }),
283               new winston.transports.File({ filename: 'combined.log' })
284             ]
285           });
286           
287           // Logging middleware
288           app.use((req, res, next) => {
289             const start = Date.now();
290             
291             res.on('finish', () => {
292               const duration = Date.now() - start;
293               logger.info({
294                 method: req.method,
295                 path: req.path,
296                 statusCode: res.statusCode,
297                 duration,
298                 ip: req.ip,
299                 userId: req.user?.id || 'anonymous'
300               });
301             });
302             
303             next();
304           });
305           
306           // Security event logging
307           logger.warn({
308             event: 'failed_login',
309             username: req.body.username,
310             ip: req.ip,
311             timestamp: new Date().toISOString()
312           });
313```
314      
315      8. **Secure Configuration Management:**
316         - Use environment-specific configurations
317         - Validate configuration at startup
318         - Example:
319```javascript
320           const Joi = require('joi');
321           
322           // Define environment variables schema
323           const envSchema = Joi.object({
324             NODE_ENV: Joi.string().valid('development', 'production', 'test').required(),
325             PORT: Joi.number().default(3000),
326             DATABASE_URL: Joi.string().required(),
327             JWT_SECRET: Joi.string().min(32).required(),
328             JWT_EXPIRES_IN: Joi.string().default('1h'),
329             CORS_ORIGIN: Joi.string().required()
330           }).unknown();
331           
332           // Validate environment variables
333           const { error, value } = envSchema.validate(process.env);
334           
335           if (error) {
336             throw new Error(`Configuration validation error: ${error.message}`);
337           }
338           
339           // Use validated config
340           const config = {
341             env: value.NODE_ENV,
342             port: value.PORT,
343             db: {
344               url: value.DATABASE_URL
345             },
346             jwt: {
347               secret: value.JWT_SECRET,
348               expiresIn: value.JWT_EXPIRES_IN
349             },
350             cors: {
351               origin: value.CORS_ORIGIN.split(',')
352             }
353           };
354           
355           module.exports = config;
356```
357      
358      9. **Secure File Operations:**
359         - Validate and sanitize file paths
360         - Use content-type validation for uploads
361         - Implement file size limits
362         - Example:
363```javascript
364           const path = require('path');
365           const fs = require('fs');
366           
367           // Secure file access function
368           const getSecureFilePath = (userInput) => {
369             // Define allowed directory
370             const baseDir = path.resolve(__dirname, '../public/files');
371             
372             // Normalize and resolve full path
373             const normalizedPath = path.normalize(userInput);
374             const fullPath = path.join(baseDir, normalizedPath);
375             
376             // Ensure path is within allowed directory
377             if (!fullPath.startsWith(baseDir)) {
378               throw new Error('Invalid file path');
379             }
380             
381             return fullPath;
382           };
383           
384           // Usage
385           try {
386             const filePath = getSecureFilePath(req.params.filename);
387             const fileContent = fs.readFileSync(filePath, 'utf8');
388             res.send(fileContent);
389           } catch (error) {
390             next(error);
391           }
392```
393      
394      10. **Secure WebSocket Implementation:**
395          - Implement authentication for WebSocket connections
396          - Validate and sanitize WebSocket messages
397          - Example:
398```javascript
399            const http = require('http');
400            const socketIo = require('socket.io');
401            const jwt = require('jsonwebtoken');
402            
403            const server = http.createServer(app);
404            const io = socketIo(server);
405            
406            // WebSocket authentication middleware
407            io.use((socket, next) => {
408              const token = socket.handshake.auth.token;
409              
410              if (!token) {
411                return next(new Error('Authentication error'));
412              }
413              
414              try {
415                const decoded = jwt.verify(token, process.env.JWT_SECRET);
416                socket.userId = decoded.id;
417                next();
418              } catch (error) {
419                return next(new Error('Authentication error'));
420              }
421            });
422            
423            io.on('connection', (socket) => {
424              console.log(`User ${socket.userId} connected`);
425              
426              // Join user to their own room for private messages
427              socket.join(`user:${socket.userId}`);
428              
429              // Message validation
430              socket.on('message', (data) => {
431                // Validate message data
432                if (!data || !data.content || typeof data.content !== 'string') {
433                  return socket.emit('error', { message: 'Invalid message format' });
434                }
435                
436                // Process message
437                // ...
438              });
439            });
440```
441 
442  - type: validate
443    conditions:
444      # Check 1: Rate limiting implementation
445      - pattern: "(?:rateLimit|rateLimiter|limiter|throttle)\\([^)]*?\\)"
446        message: "Implementing rate limiting for API protection."
447      
448      # Check 2: Input validation
449      - pattern: "(?:validate|sanitize|check|schema|joi|yup|zod|validator|isValid)"
450        message: "Using input validation or schema validation."
451      
452      # Check 3: Proper error handling
453      - pattern: "(?:try\\s*\\{[^}]*?\\}\\s*catch\\s*\\([^)]*?\\)\\s*\\{[^}]*?(?:res\\.status|next\\(err|next\\(error|errorHandler))"
454        message: "Implementing proper error handling."
455      
456      # Check 4: Authentication middleware
457      - pattern: "(?:authenticate|authorize|requireAuth|isAuthenticated|checkAuth|verifyToken|passport\\.authenticate)"
458        message: "Using authentication middleware for routes."
459      
460      # Check 5: Secure configuration
461      - pattern: "(?:helmet|cors\\(\\{[^}]*?origin\\s*:\\s*(?!['\"]*\\*)['\"])"
462        message: "Using secure HTTP headers and CORS configuration."
463 
464metadata:
465  priority: high
466  version: 1.0
467  tags:
468    - security
469    - javascript
470    - nodejs
471    - browser
472    - design
473    - owasp
474    - language:javascript
475    - framework:express
476    - framework:react
477    - framework:vue
478    - framework:angular
479    - category:security
480    - subcategory:insecure-design
481    - standard:owasp-top10
482    - risk:a04-insecure-design
483  references:
484    - "https://owasp.org/Top10/A04_2021-Insecure_Design/"
485    - "https://cheatsheetseries.owasp.org/cheatsheets/Nodejs_Security_Cheat_Sheet.html"
486    - "https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html"
487    - "https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html"
488    - "https://cheatsheetseries.owasp.org/cheatsheets/Access_Control_Cheat_Sheet.html"
489    - "https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html"
490    - "https://github.com/OWASP/NodeGoat"
491</rule> 
492