Cursor rule

1---
2description: Detect and prevent software and data integrity failures in JavaScript applications as defined in OWASP Top 10:2021-A08
3globs: **/*.js, **/*.jsx, **/*.ts, **/*.tsx, !**/node_modules/**, !**/dist/**, !**/build/**, !**/coverage/**
4---
5# JavaScript Software and Data Integrity Failures (OWASP A08:2021)
6 
7<rule>
8name: javascript_software_data_integrity_failures
9description: Detect and prevent software and data integrity failures in JavaScript applications as defined in OWASP Top 10:2021-A08
10 
11actions:
12  - type: enforce
13    conditions:
14      # Pattern 1: Insecure Deserialization
15      - pattern: "(?:JSON\\.parse|eval)\\s*\\((?:[^)]|\\n)*(?:localStorage|sessionStorage|document\\.cookie|location|window\\.name|fetch|axios|\\$\\.(?:get|post)|XMLHttpRequest)"
16        message: "Insecure deserialization of user-controlled data detected. Validate and sanitize data before parsing JSON or using eval."
17        
18      # Pattern 2: Missing Subresource Integrity
19      - pattern: "<script\\s+src=['\"][^'\"]+['\"]\\s*>"
20        negative_pattern: "integrity=['\"]sha(?:256|384|512)-[a-zA-Z0-9+/=]+"
21        message: "Script tag without Subresource Integrity (SRI) hash. Add integrity and crossorigin attributes for third-party scripts."
22        
23      # Pattern 3: Insecure Package Installation
24      - pattern: "(?:npm|yarn)\\s+(?:install|add)\\s+(?:[\\w@\\-\\.\\/:]+\\s+)*--no-(?:verify|integrity|signature)"
25        message: "Package installation with integrity checks disabled. Always verify package integrity during installation."
26        
27      # Pattern 4: Insecure Object Deserialization
28      - pattern: "(?:require|import)\\s+['\"](?:serialize-javascript|node-serialize|serialize|unserialize|deserialize)['\"]"
29        message: "Using potentially unsafe serialization/deserialization libraries. Ensure proper validation and sanitization of serialized data."
30        
31      # Pattern 5: Missing Dependency Verification
32      - pattern: "package\\.json"
33        negative_pattern: "\"(?:scripts|devDependencies)\":\\s*{[^}]*\"(?:audit|verify|check)\":\\s*\"(?:npm|yarn)\\s+audit"
34        file_pattern: "package\\.json$"
35        message: "Missing dependency verification in package.json. Add npm/yarn audit to your scripts section."
36        
37      # Pattern 6: Insecure Dynamic Imports
38      - pattern: "(?:import|require)\\s*\\(\\s*(?:variable|[a-zA-Z_$][a-zA-Z0-9_$]*|`[^`]*`|'[^']*'|\"[^\"]*\")\\s*\\)"
39        negative_pattern: "(?:allowlist|whitelist|validate)"
40        message: "Potentially insecure dynamic imports. Validate or restrict the modules that can be dynamically imported."
41        
42      # Pattern 7: Prototype Pollution
43      - pattern: "Object\\.assign\\(\\s*(?:[^,]+)\\s*,\\s*(?:JSON\\.parse|req\\.body|req\\.query|req\\.params|formData\\.get)"
44        message: "Potential prototype pollution vulnerability. Use Object.create(null) or sanitize objects before merging."
45        
46      # Pattern 8: Missing CI/CD Pipeline Integrity Checks
47      - pattern: "(?:\\.github\\/workflows\\/|\\.gitlab-ci\\.yml|azure-pipelines\\.yml|Jenkinsfile)"
48        negative_pattern: "(?:npm\\s+audit|yarn\\s+audit|checksum|integrity|verify|signature)"
49        file_pattern: "(?:\\.github\\/workflows\\/.*\\.ya?ml|\\.gitlab-ci\\.yml|azure-pipelines\\.yml|Jenkinsfile)$"
50        message: "Missing security checks in CI/CD pipeline. Add dependency scanning, integrity verification, and signature validation."
51        
52      # Pattern 9: Insecure Update Mechanism
53      - pattern: "(?:update|upgrade|install)\\s*\\([^)]*\\)\\s*\\{[^}]*?\\}"
54        negative_pattern: "(?:verify|checksum|hash|signature|integrity)"
55        message: "Potentially insecure update mechanism. Implement integrity verification for all updates."
56        
57      # Pattern 10: Insecure Plugin Loading
58      - pattern: "(?:plugin|addon|extension)\\.(?:load|register|install|add)\\s*\\([^)]*\\)"
59        negative_pattern: "(?:verify|validate|checksum|hash|signature|integrity)"
60        message: "Insecure plugin loading mechanism. Implement integrity verification for all plugins."
61        
62      # Pattern 11: Insecure Data Binding
63      - pattern: "(?:eval|new\\s+Function|setTimeout|setInterval)\\s*\\(\\s*(?:[^,)]+\\.(?:value|innerHTML|innerText|textContent)|[^,)]+\\[[^\\]]+\\])"
64        message: "Insecure data binding using eval or Function constructor. Use safer alternatives like JSON.parse or template literals."
65        
66      # Pattern 12: Insecure Object Property Assignment
67      - pattern: "(?:Object\\.assign|\\{\\s*\\.\\.\\.)"
68        negative_pattern: "Object\\.create\\(null\\)"
69        message: "Potential prototype pollution in object assignment. Use Object.create(null) as the target object or sanitize inputs."
70        
71      # Pattern 13: Missing Lock File
72      - pattern: "package\\.json"
73        negative_pattern: "package-lock\\.json|yarn\\.lock"
74        file_pattern: "package\\.json$"
75        message: "Missing lock file for dependency management. Include package-lock.json or yarn.lock in version control."
76        
77      # Pattern 14: Insecure Webpack Configuration
78      - pattern: "webpack\\.config\\.js"
79        negative_pattern: "(?:integrity|sri|subresource|hash|checksum)"
80        file_pattern: "webpack\\.config\\.js$"
81        message: "Webpack configuration without integrity checks. Consider enabling SRI for generated assets."
82        
83      # Pattern 15: Insecure npm/yarn Configuration
84      - pattern: "\\.npmrc|\\.yarnrc"
85        negative_pattern: "(?:verify-store|integrity|signature)"
86        file_pattern: "(?:\\.npmrc|\\.yarnrc)$"
87        message: "npm/yarn configuration with potentially disabled security features. Ensure integrity checks are enabled."
88 
89  - type: suggest
90    message: |
91      **JavaScript Software and Data Integrity Failures Best Practices:**
92      
93      1. **Secure Deserialization:**
94         - Validate and sanitize data before deserialization
95         - Use schema validation for JSON data
96         - Example:
97```javascript
98           import Ajv from 'ajv';
99           
100           // Define a schema for expected data
101           const schema = {
102             type: 'object',
103             properties: {
104               id: { type: 'integer' },
105               name: { type: 'string' },
106               role: { type: 'string', enum: ['user', 'admin'] }
107             },
108             required: ['id', 'name', 'role'],
109             additionalProperties: false
110           };
111           
112           // Validate data before parsing
113           function safelyParseJSON(data) {
114             try {
115               const parsed = JSON.parse(data);
116               const ajv = new Ajv();
117               const validate = ajv.compile(schema);
118               
119               if (validate(parsed)) {
120                 return { valid: true, data: parsed };
121               } else {
122                 return { valid: false, errors: validate.errors };
123               }
124             } catch (error) {
125               return { valid: false, errors: [error.message] };
126             }
127           }
128```
129      
130      2. **Subresource Integrity (SRI):**
131         - Add integrity hashes to external scripts and stylesheets
132         - Example:
133```html
134           <script 
135             src="https://cdn.example.com/library.js" 
136             integrity="sha384-oqVuAfXRKap7fdgcCY5uykM6+R9GqQ8K/uxy9rx7HNQlGYl1kPzQho1wx4JwY8wC" 
137             crossorigin="anonymous">
138           </script>
139```
140           
141```javascript
142           // Programmatically adding a script with SRI
143           function addScriptWithIntegrity(url, integrity) {
144             const script = document.createElement('script');
145             script.src = url;
146             script.integrity = integrity;
147             script.crossOrigin = 'anonymous';
148             document.head.appendChild(script);
149           }
150```
151      
152      3. **Dependency Verification:**
153         - Use npm/yarn audit regularly
154         - Implement lockfiles and version pinning
155         - Example:
156```json
157           // package.json
158           {
159             "scripts": {
160               "audit": "npm audit --production",
161               "preinstall": "npm audit",
162               "verify": "npm audit && npm outdated"
163             }
164           }
165```
166           
167```javascript
168           // Automated dependency verification in CI/CD
169           // .github/workflows/security.yml
170           // name: Security Checks
171           // on: [push, pull_request]
172           // jobs:
173           //   security:
174           //     runs-on: ubuntu-latest
175           //     steps:
176           //       - uses: actions/checkout@v3
177           //       - uses: actions/setup-node@v3
178           //         with:
179           //           node-version: '16'
180           //       - run: npm audit
181```
182      
183      4. **Secure Object Handling:**
184         - Prevent prototype pollution
185         - Use Object.create(null) for empty objects
186         - Example:
187```javascript
188           // Prevent prototype pollution
189           function safeObjectMerge(target, source) {
190             // Start with a null prototype object
191             const result = Object.create(null);
192             
193             // Copy properties from target
194             for (const key in target) {
195               if (Object.prototype.hasOwnProperty.call(target, key) && 
196                   key !== '__proto__' && 
197                   key !== 'constructor' && 
198                   key !== 'prototype') {
199                 result[key] = target[key];
200               }
201             }
202             
203             // Copy properties from source
204             for (const key in source) {
205               if (Object.prototype.hasOwnProperty.call(source, key) && 
206                   key !== '__proto__' && 
207                   key !== 'constructor' && 
208                   key !== 'prototype') {
209                 result[key] = source[key];
210               }
211             }
212             
213             return result;
214           }
215```
216      
217      5. **Secure Dynamic Imports:**
218         - Validate module paths before importing
219         - Use allowlists for dynamic imports
220         - Example:
221```javascript
222           // Allowlist-based dynamic imports
223           const ALLOWED_MODULES = [
224             './components/header',
225             './components/footer',
226             './components/sidebar'
227           ];
228           
229           async function safeImport(modulePath) {
230             if (!ALLOWED_MODULES.includes(modulePath)) {
231               throw new Error(`Module ${modulePath} is not in the allowlist`);
232             }
233             
234             try {
235               return await import(modulePath);
236             } catch (error) {
237               console.error(`Failed to import ${modulePath}:`, error);
238               throw error;
239             }
240           }
241```
242      
243      6. **CI/CD Pipeline Security:**
244         - Implement integrity checks in build pipelines
245         - Verify dependencies and artifacts
246         - Example:
247```yaml
248           # .github/workflows/build.yml
249           name: Build and Verify
250           on: [push, pull_request]
251           jobs:
252             build:
253               runs-on: ubuntu-latest
254               steps:
255                 - uses: actions/checkout@v3
256                 - uses: actions/setup-node@v3
257                   with:
258                     node-version: '16'
259                 - name: Install dependencies
260                   run: npm ci
261                 - name: Security audit
262                   run: npm audit
263                 - name: Build
264                   run: npm run build
265                 - name: Generate integrity hashes
266                   run: |
267                     cd dist
268                     find . -type f -name "*.js" -exec sh -c 'echo "{}" $(sha384sum "{}" | cut -d " " -f 1)' \; > integrity.txt
269                 - name: Upload artifacts with integrity manifest
270                   uses: actions/upload-artifact@v3
271                   with:
272                     name: build-artifacts
273                     path: |
274                       dist
275                       dist/integrity.txt
276```
277      
278      7. **Secure Update Mechanisms:**
279         - Verify integrity of updates before applying
280         - Use digital signatures when possible
281         - Example:
282```javascript
283           import crypto from 'crypto';
284           import fs from 'fs';
285           
286           async function verifyUpdate(updateFile, signatureFile, publicKeyFile) {
287             try {
288               const updateData = fs.readFileSync(updateFile);
289               const signature = fs.readFileSync(signatureFile);
290               const publicKey = fs.readFileSync(publicKeyFile);
291               
292               const verify = crypto.createVerify('SHA256');
293               verify.update(updateData);
294               
295               const isValid = verify.verify(publicKey, signature);
296               
297               if (!isValid) {
298                 throw new Error('Update signature verification failed');
299               }
300               
301               return { valid: true, data: updateData };
302             } catch (error) {
303               console.error('Update verification failed:', error);
304               return { valid: false, error: error.message };
305             }
306           }
307```
308      
309      8. **Plugin/Extension Security:**
310         - Implement allowlists for plugins
311         - Verify plugin integrity before loading
312         - Example:
313```javascript
314           class PluginManager {
315             constructor() {
316               this.plugins = new Map();
317               this.allowedPlugins = new Set(['logger', 'analytics', 'theme']);
318             }
319             
320             async registerPlugin(name, pluginPath, expectedHash) {
321               if (!this.allowedPlugins.has(name)) {
322                 throw new Error(`Plugin ${name} is not in the allowlist`);
323               }
324               
325               // Verify plugin integrity
326               const pluginCode = await fetch(pluginPath).then(r => r.text());
327               const hash = crypto.createHash('sha256').update(pluginCode).digest('hex');
328               
329               if (hash !== expectedHash) {
330                 throw new Error(`Plugin integrity check failed for ${name}`);
331               }
332               
333               // Safe loading using Function constructor instead of eval
334               // Still has security implications but better than direct eval
335               const sandboxedPlugin = new Function('exports', 'require', pluginCode);
336               const exports = {};
337               const safeRequire = (module) => {
338                 // Implement a restricted require function
339                 const allowedModules = ['lodash', 'dayjs'];
340                 if (!allowedModules.includes(module)) {
341                   throw new Error(`Module ${module} is not allowed in plugins`);
342                 }
343                 return require(module);
344               };
345               
346               sandboxedPlugin(exports, safeRequire);
347               this.plugins.set(name, exports);
348               return exports;
349             }
350           }
351```
352      
353      9. **Secure Data Binding:**
354         - Avoid eval() and new Function()
355         - Use template literals or frameworks with safe binding
356         - Example:
357```javascript
358           // Unsafe:
359           // function updateElement(id, data) {
360           //   const element = document.getElementById(id);
361           //   element.innerHTML = eval('`' + template + '`'); // DANGEROUS!
362           // }
363           
364           // Safe alternative:
365           function updateElement(id, data) {
366             const element = document.getElementById(id);
367             
368             // Use a template literal with explicit interpolation
369             const template = `<div class="user-card">
370               <h2>${escapeHTML(data.name)}</h2>
371               <p>${escapeHTML(data.bio)}</p>
372             </div>`;
373             
374             element.innerHTML = template;
375           }
376           
377           function escapeHTML(str) {
378             return str
379               .replace(/&/g, '&amp;')
380               .replace(/</g, '&lt;')
381               .replace(/>/g, '&gt;')
382               .replace(/"/g, '&quot;')
383               .replace(/'/g, '&#039;');
384           }
385```
386      
387      10. **Secure Configuration Management:**
388          - Validate configurations before use
389          - Use schema validation for config files
390          - Example:
391```javascript
392            import Ajv from 'ajv';
393            import fs from 'fs';
394            
395            function loadAndValidateConfig(configPath) {
396              // Define schema for configuration
397              const configSchema = {
398                type: 'object',
399                properties: {
400                  server: {
401                    type: 'object',
402                    properties: {
403                      port: { type: 'integer', minimum: 1024, maximum: 65535 },
404                      host: { type: 'string', format: 'hostname' }
405                    },
406                    required: ['port', 'host']
407                  },
408                  database: {
409                    type: 'object',
410                    properties: {
411                      url: { type: 'string' },
412                      maxConnections: { type: 'integer', minimum: 1 }
413                    },
414                    required: ['url']
415                  }
416                },
417                required: ['server', 'database'],
418                additionalProperties: false
419              };
420              
421              try {
422                const configData = fs.readFileSync(configPath, 'utf8');
423                const config = JSON.parse(configData);
424                
425                const ajv = new Ajv({ allErrors: true });
426                const validate = ajv.compile(configSchema);
427                
428                if (validate(config)) {
429                  return { valid: true, config };
430                } else {
431                  return { valid: false, errors: validate.errors };
432                }
433              } catch (error) {
434                return { valid: false, errors: [error.message] };
435              }
436            }
437```
438      
439      11. **Secure Webpack Configuration:**
440          - Enable SRI in webpack
441          - Use content hashing for cache busting
442          - Example:
443```javascript
444            // webpack.config.js
445            const SubresourceIntegrityPlugin = require('webpack-subresource-integrity');
446            
447            module.exports = {
448              output: {
449                filename: '[name].[contenthash].js',
450                crossOriginLoading: 'anonymous' // Required for SRI
451              },
452              plugins: [
453                new SubresourceIntegrityPlugin({
454                  hashFuncNames: ['sha384'],
455                  enabled: process.env.NODE_ENV === 'production'
456                })
457              ]
458            };
459```
460      
461      12. **Secure npm/yarn Configuration:**
462          - Enable integrity checks
463          - Use lockfiles and exact versions
464          - Example:
465```
466            # .npmrc
467            audit=true
468            audit-level=moderate
469            save-exact=true
470            verify-store=true
471            
472            # .yarnrc.yml
473            enableStrictSsl: true
474            enableImmutableInstalls: true
475            checksumBehavior: "throw"
476```
477      
478      13. **Secure JSON Parsing:**
479          - Use reviver functions with JSON.parse
480          - Example:
481```javascript
482            function parseUserData(data) {
483              return JSON.parse(data, (key, value) => {
484                // Sanitize specific fields
485                if (key === 'role' && !['user', 'admin', 'editor'].includes(value)) {
486                  return 'user'; // Default to safe value
487                }
488                
489                // Prevent Date objects from being reconstructed from strings
490                if (typeof value === 'string' && 
491                    /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}.\d{3}Z$/.test(value)) {
492                  // Return as string, not Date object
493                  return value;
494                }
495                
496                return value;
497              });
498            }
499```
500      
501      14. **Content Security Policy (CSP):**
502          - Implement strict CSP headers
503          - Use nonce-based CSP for inline scripts
504          - Example:
505```javascript
506            // Express.js example
507            import crypto from 'crypto';
508            import helmet from 'helmet';
509            
510            app.use((req, res, next) => {
511              // Generate a new nonce for each request
512              res.locals.cspNonce = crypto.randomBytes(16).toString('base64');
513              next();
514            });
515            
516            app.use(helmet.contentSecurityPolicy({
517              directives: {
518                defaultSrc: ["'self'"],
519                scriptSrc: [
520                  "'self'",
521                  (req, res) => `'nonce-${res.locals.cspNonce}'`,
522                  'https://cdn.jsdelivr.net'
523                ],
524                styleSrc: ["'self'", 'https://cdn.jsdelivr.net'],
525                // Add other directives as needed
526              }
527            }));
528            
529            // In your template engine, use the nonce:
530            // <script nonce="<%= cspNonce %>">
531            //   // Inline JavaScript
532            // </script>
533```
534      
535      15. **Secure Local Storage:**
536          - Validate data before storing and after retrieving
537          - Consider encryption for sensitive data
538          - Example:
539```javascript
540            // Simple encryption/decryption for localStorage
541            // Note: This is still client-side and not fully secure
542            class SecureStorage {
543              constructor(secret) {
544                this.secret = secret;
545              }
546              
547              // Set item with validation and encryption
548              setItem(key, value, schema) {
549                // Validate with schema if provided
550                if (schema) {
551                  const ajv = new Ajv();
552                  const validate = ajv.compile(schema);
553                  if (!validate(value)) {
554                    throw new Error(`Invalid data for ${key}: ${ajv.errorsText(validate.errors)}`);
555                  }
556                }
557                
558                // Simple encryption (not for truly sensitive data)
559                const valueStr = JSON.stringify(value);
560                const encrypted = this.encrypt(valueStr);
561                localStorage.setItem(key, encrypted);
562              }
563              
564              // Get item with decryption and validation
565              getItem(key, schema) {
566                const encrypted = localStorage.getItem(key);
567                if (!encrypted) return null;
568                
569                try {
570                  const decrypted = this.decrypt(encrypted);
571                  const value = JSON.parse(decrypted);
572                  
573                  // Validate with schema if provided
574                  if (schema) {
575                    const ajv = new Ajv();
576                    const validate = ajv.compile(schema);
577                    if (!validate(value)) {
578                      console.error(`Retrieved invalid data for ${key}`);
579                      return null;
580                    }
581                  }
582                  
583                  return value;
584                } catch (error) {
585                  console.error(`Failed to retrieve ${key}:`, error);
586                  return null;
587                }
588              }
589              
590              // Simple XOR encryption (not for production use with sensitive data)
591              encrypt(text) {
592                let result = '';
593                for (let i = 0; i < text.length; i++) {
594                  result += String.fromCharCode(text.charCodeAt(i) ^ this.secret.charCodeAt(i % this.secret.length));
595                }
596                return btoa(result);
597              }
598              
599              decrypt(encoded) {
600                const text = atob(encoded);
601                let result = '';
602                for (let i = 0; i < text.length; i++) {
603                  result += String.fromCharCode(text.charCodeAt(i) ^ this.secret.charCodeAt(i % this.secret.length));
604                }
605                return result;
606              }
607            }
608```
609 
610  - type: validate
611    conditions:
612      # Check 1: Subresource Integrity
613      - pattern: "<script\\s+[^>]*?integrity=['\"]sha(?:256|384|512)-[a-zA-Z0-9+/=]+['\"][^>]*?>"
614        message: "Using Subresource Integrity (SRI) for external scripts."
615      
616      # Check 2: Dependency Verification
617      - pattern: "\"scripts\":\\s*{[^}]*\"(?:audit|verify|check)\":\\s*\"(?:npm|yarn)\\s+audit"
618        message: "Implementing dependency verification in package.json scripts."
619      
620      # Check 3: Lock File Usage
621      - pattern: "(?:package-lock\\.json|yarn\\.lock)"
622        file_pattern: "(?:package-lock\\.json|yarn\\.lock)$"
623        message: "Using lock files for dependency management."
624      
625      # Check 4: Safe Object Creation
626      - pattern: "Object\\.create\\(null\\)"
627        message: "Using Object.create(null) to prevent prototype pollution."
628      
629      # Check 5: Schema Validation
630      - pattern: "(?:ajv|joi|yup|zod|jsonschema|validate)"
631        message: "Implementing schema validation for data integrity."
632 
633metadata:
634  priority: high
635  version: 1.0
636  tags:
637    - security
638    - javascript
639    - nodejs
640    - browser
641    - integrity
642    - owasp
643    - language:javascript
644    - framework:express
645    - framework:react
646    - framework:vue
647    - framework:angular
648    - category:security
649    - subcategory:integrity
650    - standard:owasp-top10
651    - risk:a08-software-data-integrity-failures
652  references:
653    - "https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures/"
654    - "https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html"
655    - "https://cheatsheetseries.owasp.org/cheatsheets/Third_Party_Javascript_Management_Cheat_Sheet.html"
656    - "https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity"
657    - "https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/11-Client-side_Testing/13-Testing_for_Subresource_Integrity"
658    - "https://snyk.io/blog/prototype-pollution-javascript/"
659    - "https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/NPM_Security_Cheat_Sheet.md"
660    - "https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html"
661    - "https://owasp.org/www-community/attacks/Prototype_pollution"
662</rule> 
663