Cursor rule

1---
2description: Detect and prevent security misconfigurations in JavaScript applications as defined in OWASP Top 10:2021-A05
3globs: **/*.js, **/*.jsx, **/*.ts, **/*.tsx, !**/node_modules/**, !**/dist/**, !**/build/**, !**/coverage/**
4---
5# JavaScript Security Misconfiguration (OWASP A05:2021)
6 
7<rule>
8name: javascript_security_misconfiguration
9description: Detect and prevent security misconfigurations in JavaScript applications as defined in OWASP Top 10:2021-A05
10 
11actions:
12  - type: enforce
13    conditions:
14      # Pattern 1: Missing or Insecure HTTP Security Headers
15      - pattern: "app\\.use\\([^)]*?\\)\\s*(?!.*(?:helmet|frameguard|hsts|noSniff|xssFilter|contentSecurityPolicy))"
16        location: "(?:app|server|index)\\.(?:js|ts)$"
17        message: "Missing HTTP security headers. Consider using Helmet.js to set secure HTTP headers."
18        
19      # Pattern 2: Insecure CORS Configuration
20      - pattern: "app\\.use\\(cors\\(\\{[^}]*?origin\\s*:\\s*['\"]\\*['\"]\\s*\\}\\)\\)"
21        message: "Insecure CORS configuration. Avoid using wildcard (*) for CORS origin in production environments."
22        
23      # Pattern 3: Exposed Environment Variables in Client-Side Code
24      - pattern: "process\\.env\\.[A-Z_]+"
25        location: "(?:src|components|pages)"
26        message: "Exposing environment variables in client-side code. Only use environment variables with NEXT_PUBLIC_, REACT_APP_, or VITE_ prefixes for client-side code."
27        
28      # Pattern 4: Insecure Cookie Settings
29      - pattern: "(?:cookie|cookies|session)\\([^)]*?\\{[^}]*?(?:secure\\s*:\\s*false|httpOnly\\s*:\\s*false|sameSite\\s*:\\s*['\"]none['\"])"
30        message: "Insecure cookie configuration. Set secure:true, httpOnly:true, and appropriate sameSite value for cookies."
31        
32      # Pattern 5: Missing Content Security Policy
33      - pattern: "app\\.use\\([^)]*?helmet\\([^)]*?\\{[^}]*?contentSecurityPolicy\\s*:\\s*false"
34        message: "Content Security Policy (CSP) is disabled. Enable and configure CSP to prevent XSS attacks."
35        
36      # Pattern 6: Debug Information Exposure
37      - pattern: "app\\.use\\([^)]*?morgan\\(['\"]dev['\"]\\)|console\\.(?:log|debug|info|warn|error)\\("
38        location: "(?:app|server|index)\\.(?:js|ts)$"
39        message: "Debug information might be exposed in production. Ensure logging is properly configured based on the environment."
40        
41      # Pattern 7: Insecure Server Configuration
42      - pattern: "app\\.disable\\(['\"]x-powered-by['\"]\\)"
43        negative_pattern: true
44        location: "(?:app|server|index)\\.(?:js|ts)$"
45        message: "X-Powered-By header is not disabled. Use app.disable('x-powered-by') to hide technology information."
46        
47      # Pattern 8: Directory Listing Enabled
48      - pattern: "express\\.static\\([^)]*?\\{[^}]*?index\\s*:\\s*false"
49        message: "Directory listing might be enabled. Set index:true or provide an index file to prevent directory listing."
50        
51      # Pattern 9: Missing Rate Limiting
52      - pattern: "app\\.(?:get|post|put|delete|patch)\\([^)]*?['\"](?:/api|/login|/register|/auth)['\"]"
53        negative_pattern: "(?:rateLimit|rateLimiter|limiter|throttle)"
54        message: "Missing rate limiting for sensitive endpoints. Implement rate limiting to prevent brute force attacks."
55        
56      # Pattern 10: Insecure WebSocket Configuration
57      - pattern: "new\\s+WebSocket\\([^)]*?\\)|io\\.on\\(['\"]connection['\"]"
58        negative_pattern: "(?:wss://|https://)"
59        message: "Potentially insecure WebSocket connection. Use secure WebSocket (wss://) in production."
60        
61      # Pattern 11: Hardcoded Configuration Values
62      - pattern: "(?:apiKey|secret|password|token|credentials)\\s*=\\s*['\"][^'\"]+['\"]"
63        message: "Hardcoded configuration values. Use environment variables or a secure configuration management system."
64        
65      # Pattern 12: Insecure SSL/TLS Configuration
66      - pattern: "https\\.createServer\\([^)]*?\\{[^}]*?rejectUnauthorized\\s*:\\s*false"
67        message: "Insecure SSL/TLS configuration. Never set rejectUnauthorized:false in production."
68        
69      # Pattern 13: Missing Security Middleware
70      - pattern: "express\\(\\)|require\\(['\"]express['\"]\\)"
71        negative_pattern: "(?:helmet|cors|rateLimit|bodyParser\\.json\\(\\{\\s*limit|express\\.json\\(\\{\\s*limit)"
72        location: "(?:app|server|index)\\.(?:js|ts)$"
73        message: "Missing essential security middleware. Consider using helmet, cors, rate limiting, and request size limiting."
74        
75      # Pattern 14: Insecure Error Handling
76      - pattern: "app\\.use\\([^)]*?function\\s*\\([^)]*?err[^)]*?\\)\\s*\\{[^}]*?res\\.status[^}]*?err(?:\\.message|\\.stack)"
77        message: "Insecure error handling. Avoid exposing error details like stack traces to clients in production."
78        
79      # Pattern 15: Outdated Dependencies Warning
80      - pattern: "(?:\"dependencies\"|\"devDependencies\")\\s*:\\s*\\{[^}]*?['\"](?:express|react|vue|angular|next|nuxt|axios)['\"]\\s*:\\s*['\"]\\^?\\d+\\.\\d+\\.\\d+['\"]"
81        location: "package\\.json$"
82        message: "Check for outdated dependencies. Regularly update dependencies to avoid known vulnerabilities."
83 
84  - type: suggest
85    message: |
86      **JavaScript Security Configuration Best Practices:**
87      
88      1. **HTTP Security Headers:**
89         - Use Helmet.js to set secure HTTP headers
90         - Configure Content Security Policy (CSP)
91         - Example:
92```javascript
93           const helmet = require('helmet');
94           
95           // Basic usage
96           app.use(helmet());
97           
98           // Custom CSP configuration
99           app.use(
100             helmet.contentSecurityPolicy({
101               directives: {
102                 defaultSrc: ["'self'"],
103                 scriptSrc: ["'self'", "'unsafe-inline'", 'trusted-cdn.com'],
104                 styleSrc: ["'self'", "'unsafe-inline'", 'trusted-cdn.com'],
105                 imgSrc: ["'self'", 'data:', 'trusted-cdn.com'],
106                 connectSrc: ["'self'", 'api.yourdomain.com'],
107                 fontSrc: ["'self'", 'trusted-cdn.com'],
108                 objectSrc: ["'none'"],
109                 mediaSrc: ["'self'"],
110                 frameSrc: ["'none'"],
111                 upgradeInsecureRequests: [],
112               },
113             })
114           );
115```
116      
117      2. **Secure CORS Configuration:**
118         - Specify allowed origins explicitly
119         - Configure appropriate CORS options
120         - Example:
121```javascript
122           const cors = require('cors');
123           
124           // Define allowed origins
125           const allowedOrigins = [
126             'https://yourdomain.com',
127             'https://app.yourdomain.com',
128             'https://admin.yourdomain.com'
129           ];
130           
131           // Configure CORS
132           app.use(cors({
133             origin: function(origin, callback) {
134               // Allow requests with no origin (like mobile apps, curl, etc.)
135               if (!origin) return callback(null, true);
136               
137               if (allowedOrigins.indexOf(origin) === -1) {
138                 const msg = 'The CORS policy for this site does not allow access from the specified Origin.';
139                 return callback(new Error(msg), false);
140               }
141               
142               return callback(null, true);
143             },
144             methods: ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS'],
145             credentials: true,
146             maxAge: 86400 // 24 hours
147           }));
148```
149      
150      3. **Environment-Based Configuration:**
151         - Use different configurations for development and production
152         - Validate configuration at startup
153         - Example:
154```javascript
155           const express = require('express');
156           const helmet = require('helmet');
157           const morgan = require('morgan');
158           
159           const app = express();
160           
161           // Environment-specific configuration
162           if (process.env.NODE_ENV === 'production') {
163             // Production settings
164             app.use(helmet());
165             app.use(morgan('combined'));
166             app.set('trust proxy', 1); // Trust first proxy
167             
168             // Disable X-Powered-By header
169             app.disable('x-powered-by');
170           } else {
171             // Development settings
172             app.use(morgan('dev'));
173           }
174           
175           // Validate required environment variables
176           const requiredEnvVars = ['DATABASE_URL', 'JWT_SECRET'];
177           for (const envVar of requiredEnvVars) {
178             if (!process.env[envVar]) {
179               console.error(`Error: Environment variable ${envVar} is required`);
180               process.exit(1);
181             }
182           }
183```
184      
185      4. **Secure Cookie Configuration:**
186         - Set secure, httpOnly, and sameSite attributes
187         - Use signed cookies when appropriate
188         - Example:
189```javascript
190           const session = require('express-session');
191           
192           app.use(session({
193             secret: process.env.SESSION_SECRET,
194             name: 'sessionId', // Custom cookie name instead of default
195             cookie: {
196               secure: process.env.NODE_ENV === 'production', // HTTPS only in production
197               httpOnly: true, // Prevents client-side JS from reading the cookie
198               sameSite: 'lax', // Controls when cookies are sent with cross-site requests
199               maxAge: 3600000, // 1 hour in milliseconds
200               domain: process.env.NODE_ENV === 'production' ? '.yourdomain.com' : undefined
201             },
202             resave: false,
203             saveUninitialized: false
204           }));
205```
206      
207      5. **Request Size Limiting:**
208         - Limit request body size to prevent DoS attacks
209         - Example:
210```javascript
211           // Using express built-in middleware
212           app.use(express.json({ limit: '10kb' }));
213           app.use(express.urlencoded({ extended: true, limit: '10kb' }));
214           
215           // Or using body-parser
216           const bodyParser = require('body-parser');
217           app.use(bodyParser.json({ limit: '10kb' }));
218           app.use(bodyParser.urlencoded({ extended: true, limit: '10kb' }));
219```
220      
221      6. **Proper Error Handling:**
222         - Use a centralized error handler
223         - Don't expose sensitive information in error responses
224         - Example:
225```javascript
226           // Custom error class
227           class AppError extends Error {
228             constructor(message, statusCode) {
229               super(message);
230               this.statusCode = statusCode;
231               this.status = `${statusCode}`.startsWith('4') ? 'fail' : 'error';
232               this.isOperational = true;
233               
234               Error.captureStackTrace(this, this.constructor);
235             }
236           }
237           
238           // Global error handling middleware
239           app.use((err, req, res, next) => {
240             err.statusCode = err.statusCode || 500;
241             err.status = err.status || 'error';
242             
243             // Different handling for development and production
244             if (process.env.NODE_ENV === 'development') {
245               res.status(err.statusCode).json({
246                 status: err.status,
247                 error: err,
248                 message: err.message,
249                 stack: err.stack
250               });
251             } else if (process.env.NODE_ENV === 'production') {
252               // Only send operational errors to the client
253               if (err.isOperational) {
254                 res.status(err.statusCode).json({
255                   status: err.status,
256                   message: err.message
257                 });
258               } else {
259                 // Log programming or unknown errors
260                 console.error('ERROR 💥', err);
261                 
262                 // Send generic message
263                 res.status(500).json({
264                   status: 'error',
265                   message: 'Something went wrong'
266                 });
267               }
268             }
269           });
270```
271      
272      7. **Rate Limiting:**
273         - Apply rate limiting to sensitive endpoints
274         - Use different limits for different endpoints
275         - Example:
276```javascript
277           const rateLimit = require('express-rate-limit');
278           
279           // Create a rate limiter for API endpoints
280           const apiLimiter = rateLimit({
281             windowMs: 15 * 60 * 1000, // 15 minutes
282             max: 100, // limit each IP to 100 requests per windowMs
283             standardHeaders: true, // Return rate limit info in the `RateLimit-*` headers
284             legacyHeaders: false, // Disable the `X-RateLimit-*` headers
285             message: 'Too many requests from this IP, please try again after 15 minutes'
286           });
287           
288           // Create a stricter rate limiter for authentication endpoints
289           const authLimiter = rateLimit({
290             windowMs: 15 * 60 * 1000, // 15 minutes
291             max: 5, // limit each IP to 5 login attempts per windowMs
292             standardHeaders: true,
293             legacyHeaders: false,
294             message: 'Too many login attempts from this IP, please try again after 15 minutes'
295           });
296           
297           // Apply rate limiters to routes
298           app.use('/api/', apiLimiter);
299           app.use('/api/auth/', authLimiter);
300```
301      
302      8. **Secure WebSocket Configuration:**
303         - Use secure WebSocket connections (wss://)
304         - Implement authentication for WebSocket connections
305         - Example:
306```javascript
307           const http = require('http');
308           const https = require('https');
309           const socketIo = require('socket.io');
310           const fs = require('fs');
311           
312           let server;
313           
314           // Create secure server in production
315           if (process.env.NODE_ENV === 'production') {
316             const options = {
317               key: fs.readFileSync('/path/to/private.key'),
318               cert: fs.readFileSync('/path/to/certificate.crt')
319             };
320             server = https.createServer(options, app);
321           } else {
322             server = http.createServer(app);
323           }
324           
325           const io = socketIo(server, {
326             cors: {
327               origin: process.env.NODE_ENV === 'production' 
328                 ? 'https://yourdomain.com' 
329                 : 'http://localhost:3000',
330               methods: ['GET', 'POST'],
331               credentials: true
332             }
333           });
334           
335           // WebSocket authentication middleware
336           io.use((socket, next) => {
337             const token = socket.handshake.auth.token;
338             
339             if (!token) {
340               return next(new Error('Authentication error'));
341             }
342             
343             // Verify token
344             // ...
345             
346             next();
347           });
348```
349      
350      9. **Security Dependency Management:**
351         - Regularly update dependencies
352         - Use tools like npm audit or Snyk
353         - Example:
354```javascript
355           // package.json scripts
356           {
357             "scripts": {
358               "audit": "npm audit",
359               "audit:fix": "npm audit fix",
360               "outdated": "npm outdated",
361               "update": "npm update",
362               "prestart": "npm audit --production"
363             }
364           }
365```
366      
367      10. **Secure Logging Configuration:**
368          - Configure logging based on environment
369          - Avoid logging sensitive information
370          - Example:
371```javascript
372            const winston = require('winston');
373            
374            // Define log levels
375            const levels = {
376              error: 0,
377              warn: 1,
378              info: 2,
379              http: 3,
380              debug: 4,
381            };
382            
383            // Define log level based on environment
384            const level = () => {
385              const env = process.env.NODE_ENV || 'development';
386              return env === 'development' ? 'debug' : 'warn';
387            };
388            
389            // Define log format
390            const format = winston.format.combine(
391              winston.format.timestamp({ format: 'YYYY-MM-DD HH:mm:ss:ms' }),
392              winston.format.printf(
393                (info) => `${info.timestamp} ${info.level}: ${info.message}`
394              )
395            );
396            
397            // Define transports
398            const transports = [
399              new winston.transports.Console(),
400              new winston.transports.File({
401                filename: 'logs/error.log',
402                level: 'error',
403              }),
404              new winston.transports.File({ filename: 'logs/all.log' }),
405            ];
406            
407            // Create the logger
408            const logger = winston.createLogger({
409              level: level(),
410              levels,
411              format,
412              transports,
413            });
414            
415            module.exports = logger;
416```
417 
418  - type: validate
419    conditions:
420      # Check 1: Helmet usage
421      - pattern: "helmet\\(\\)|frameguard\\(\\)|hsts\\(\\)|noSniff\\(\\)|xssFilter\\(\\)|contentSecurityPolicy\\(\\)"
422        message: "Using Helmet.js or individual HTTP security headers middleware."
423      
424      # Check 2: Secure CORS configuration
425      - pattern: "cors\\(\\{[^}]*?origin\\s*:\\s*(?!['\"]*\\*)['\"]"
426        message: "Using secure CORS configuration with specific origins."
427      
428      # Check 3: Environment-based configuration
429      - pattern: "process\\.env\\.NODE_ENV\\s*===\\s*['\"]production['\"]"
430        message: "Implementing environment-specific configuration."
431      
432      # Check 4: Secure cookie settings
433      - pattern: "cookie\\s*:\\s*\\{[^}]*?secure\\s*:\\s*true[^}]*?httpOnly\\s*:\\s*true"
434        message: "Using secure cookie configuration."
435      
436      # Check 5: Request size limiting
437      - pattern: "(?:express|bodyParser)\\.json\\(\\{[^}]*?limit\\s*:"
438        message: "Implementing request size limiting."
439 
440metadata:
441  priority: high
442  version: 1.0
443  tags:
444    - security
445    - javascript
446    - nodejs
447    - browser
448    - configuration
449    - owasp
450    - language:javascript
451    - framework:express
452    - framework:react
453    - framework:vue
454    - framework:angular
455    - category:security
456    - subcategory:misconfiguration
457    - standard:owasp-top10
458    - risk:a05-security-misconfiguration
459  references:
460    - "https://owasp.org/Top10/A05_2021-Security_Misconfiguration/"
461    - "https://cheatsheetseries.owasp.org/cheatsheets/Nodejs_Security_Cheat_Sheet.html"
462    - "https://expressjs.com/en/advanced/best-practice-security.html"
463    - "https://helmetjs.github.io/"
464    - "https://github.com/OWASP/NodeGoat"
465    - "https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html"
466    - "https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html"
467</rule> 
468