Cursor rule

1---
2description: Detect and prevent the use of vulnerable and outdated components in JavaScript applications as defined in OWASP Top 10:2021-A06
3globs: **/*.js, **/*.jsx, **/*.ts, **/*.tsx, !**/node_modules/**, !**/dist/**, !**/build/**, !**/coverage/**
4---
5# JavaScript Vulnerable and Outdated Components (OWASP A06:2021)
6 
7<rule>
8name: javascript_vulnerable_outdated_components
9description: Detect and prevent the use of vulnerable and outdated components in JavaScript applications as defined in OWASP Top 10:2021-A06
10 
11actions:
12  - type: enforce
13    conditions:
14      # Pattern 1: Outdated Package Versions in package.json
15      - pattern: "\"(dependencies|devDependencies)\"\\s*:\\s*\\{[^}]*?\"([^\"]+)\"\\s*:\\s*\"\\^?([0-9]+\\.[0-9]+\\.[0-9]+)\""
16        location: "package\\.json$"
17        message: "Check for outdated dependencies in package.json. Regularly update dependencies to avoid known vulnerabilities."
18        
19      # Pattern 2: Direct CDN Links Without Integrity Hashes
20      - pattern: "<script\\s+src=['\"]https?://(?:cdn|unpkg|jsdelivr)[^'\"]*['\"][^>]*(?!integrity=)"
21        location: "\\.(html|js|jsx|ts|tsx)$"
22        message: "CDN resources without integrity hashes. Add integrity and crossorigin attributes to script tags loading external resources."
23        
24      # Pattern 3: Hardcoded Library Versions in HTML
25      - pattern: "<script\\s+src=['\"][^'\"]*(?:jquery|bootstrap|react|vue|angular|lodash|moment)[@-][0-9]+\\.[0-9]+\\.[0-9]+[^'\"]*['\"]"
26        location: "\\.html$"
27        message: "Hardcoded library versions in HTML. Consider using a package manager to manage dependencies."
28        
29      # Pattern 4: Deprecated Node.js APIs
30      - pattern: "(?:new Buffer\\(|require\\(['\"]crypto['\"]\\)\\.createCipher\\(|require\\(['\"]crypto['\"]\\)\\.randomBytes\\([^,)]+\\)|require\\(['\"]fs['\"]\\)\\.exists\\()"
31        message: "Using deprecated Node.js APIs. Replace with modern alternatives to avoid security and maintenance issues."
32        
33      # Pattern 5: Deprecated Browser APIs
34      - pattern: "document\\.write\\(|document\\.execCommand\\(|escape\\(|unescape\\(|showModalDialog\\(|localStorage\\.clear\\(\\)|sessionStorage\\.clear\\(\\)"
35        location: "(?:src|components|pages)"
36        message: "Using deprecated browser APIs. Replace with modern alternatives to avoid compatibility and security issues."
37        
38      # Pattern 6: Insecure Dependency Loading
39      - pattern: "require\\([^)]*?\\+\\s*[^)]+\\)|import\\([^)]*?\\+\\s*[^)]+\\)"
40        message: "Dynamic dependency loading with variable concatenation. This can lead to dependency confusion attacks."
41        
42      # Pattern 7: Vulnerable Regular Expression Patterns (ReDoS)
43      - pattern: "new RegExp\\([^)]*?(?:\\(.*\\)\\*|\\*\\+|\\+\\*|\\{\\d+,\\})"
44        message: "Potentially vulnerable regular expression pattern that could lead to ReDoS attacks. Review and optimize the regex pattern."
45        
46      # Pattern 8: Insecure Package Installation
47      - pattern: "npm\\s+install\\s+(?:--no-save|--no-audit|--no-fund|--force)"
48        location: "(?:scripts|Dockerfile|docker-compose\\.yml|\\.github/workflows)"
49        message: "Insecure package installation flags. Avoid using --no-audit, --no-save, or --force flags when installing packages."
50        
51      # Pattern 9: Missing Lock Files
52      - pattern: "package\\.json"
53        location: "package\\.json$"
54        negative_pattern: "package-lock\\.json|yarn\\.lock|pnpm-lock\\.yaml"
55        message: "Missing lock file. Use package-lock.json, yarn.lock, or pnpm-lock.yaml to ensure dependency consistency."
56        
57      # Pattern 10: Insecure Webpack Configuration
58      - pattern: "webpack\\.config\\.js"
59        location: "webpack\\.config\\.js$"
60        negative_pattern: "(?:noEmitOnErrors|optimization\\.minimize)"
61        message: "Potentially insecure webpack configuration. Consider enabling noEmitOnErrors and optimization.minimize."
62        
63      # Pattern 11: Outdated TypeScript Configuration
64      - pattern: "\"compilerOptions\"\\s*:\\s*\\{[^}]*?\"target\"\\s*:\\s*\"ES5\""
65        location: "tsconfig\\.json$"
66        message: "Outdated TypeScript target. Consider using a more modern target like ES2020 for better security features."
67        
68      # Pattern 12: Insecure Package Sources
69      - pattern: "registry\\s*=\\s*(?!https://registry\\.npmjs\\.org)"
70        location: "\\.npmrc$"
71        message: "Using a non-standard npm registry. Ensure you trust the source of your packages."
72        
73      # Pattern 13: Missing npm audit in CI/CD
74      - pattern: "(?:ci|test|build)\\s*:\\s*\"[^\"]*?\""
75        location: "package\\.json$"
76        negative_pattern: "npm\\s+audit"
77        message: "Missing npm audit in CI/CD scripts. Add 'npm audit' to your CI/CD pipeline to detect vulnerabilities."
78        
79      # Pattern 14: Insecure Import Maps
80      - pattern: "<script\\s+type=['\"]importmap['\"][^>]*>[^<]*?\"imports\"\\s*:\\s*\\{[^}]*?\"[^\"]+\"\\s*:\\s*\"https?://[^\"]+\""
81        negative_pattern: "integrity="
82        message: "Insecure import maps without integrity checks. Add integrity hashes to import map entries."
83        
84      # Pattern 15: Outdated Polyfills
85      - pattern: "(?:core-js|@babel/polyfill|es6-promise|whatwg-fetch)"
86        message: "Using potentially outdated polyfills. Consider using modern alternatives or feature detection."
87 
88  - type: suggest
89    message: |
90      **JavaScript Vulnerable and Outdated Components Best Practices:**
91      
92      1. **Dependency Management:**
93         - Regularly update dependencies to their latest secure versions
94         - Use tools like npm audit, Snyk, or Dependabot to detect vulnerabilities
95         - Example:
96```javascript
97           // Add these scripts to package.json
98           {
99             "scripts": {
100               "audit": "npm audit",
101               "audit:fix": "npm audit fix",
102               "outdated": "npm outdated",
103               "update": "npm update",
104               "prestart": "npm audit --production"
105             }
106           }
107```
108      
109      2. **Lock Files:**
110         - Always use lock files (package-lock.json, yarn.lock, or pnpm-lock.yaml)
111         - Commit lock files to version control
112         - Example:
113```bash
114           # Generate a lock file if it doesn't exist
115           npm install
116           
117           # Or for Yarn
118           yarn
119           
120           # Or for pnpm
121           pnpm install
122```
123      
124      3. **Subresource Integrity:**
125         - Use integrity hashes when loading resources from CDNs
126         - Example:
127```html
128           <script 
129             src="https://cdn.jsdelivr.net/npm/react@18.2.0/umd/react.production.min.js" 
130             integrity="sha384-tMH8h3BGESGckSAVGZ82T9n90ztNepwCjSPJ0A7g2vdY8M0oKtDaDGg0G53cysJA" 
131             crossorigin="anonymous">
132           </script>
133```
134      
135      4. **Automated Security Scanning:**
136         - Integrate security scanning into your CI/CD pipeline
137         - Example GitHub Actions workflow:
138```yaml
139           name: Security Scan
140           
141           on:
142             push:
143               branches: [ main ]
144             pull_request:
145               branches: [ main ]
146             schedule:
147               - cron: '0 0 * * 0'  # Run weekly
148           
149           jobs:
150             security:
151               runs-on: ubuntu-latest
152               steps:
153                 - uses: actions/checkout@v3
154                 - name: Setup Node.js
155                   uses: actions/setup-node@v3
156                   with:
157                     node-version: '18'
158                     cache: 'npm'
159                 - name: Install dependencies
160                   run: npm ci
161                 - name: Run security audit
162                   run: npm audit --audit-level=high
163                 - name: Run Snyk to check for vulnerabilities
164                   uses: snyk/actions/node@master
165                   env:
166                     SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
167```
168      
169      5. **Dependency Pinning:**
170         - Pin dependencies to specific versions to prevent unexpected updates
171         - Example:
172```json
173           {
174             "dependencies": {
175               "express": "4.18.2",
176               "react": "18.2.0",
177               "lodash": "4.17.21"
178             }
179           }
180```
181      
182      6. **Deprecated API Replacement:**
183         - Replace deprecated Node.js APIs with modern alternatives
184         - Example:
185```javascript
186           // INSECURE: Using deprecated Buffer constructor
187           const buffer = new Buffer(data);
188           
189           // SECURE: Using Buffer.from()
190           const buffer = Buffer.from(data);
191           
192           // INSECURE: Using deprecated crypto methods
193           const crypto = require('crypto');
194           const cipher = crypto.createCipher('aes-256-cbc', key);
195           
196           // SECURE: Using modern crypto methods
197           const crypto = require('crypto');
198           const iv = crypto.randomBytes(16);
199           const cipher = crypto.createCipheriv('aes-256-cbc', key, iv);
200```
201      
202      7. **Browser API Modernization:**
203         - Replace deprecated browser APIs with modern alternatives
204         - Example:
205```javascript
206           // INSECURE: Using document.write
207           document.write('<h1>Hello World</h1>');
208           
209           // SECURE: Using DOM manipulation
210           document.getElementById('content').innerHTML = '<h1>Hello World</h1>';
211           
212           // INSECURE: Using escape/unescape
213           const encoded = escape(data);
214           
215           // SECURE: Using encodeURIComponent
216           const encoded = encodeURIComponent(data);
217```
218      
219      8. **Safe Dynamic Imports:**
220         - Avoid dynamic imports with variable concatenation
221         - Example:
222```javascript
223           // INSECURE: Dynamic import with concatenation
224           const moduleName = userInput;
225           import('./' + moduleName + '.js');
226           
227           // SECURE: Validate input against a whitelist
228           const validModules = ['module1', 'module2', 'module3'];
229           if (validModules.includes(moduleName)) {
230             import(`./${moduleName}.js`);
231           }
232```
233      
234      9. **Regular Expression Safety:**
235         - Avoid vulnerable regex patterns that could lead to ReDoS attacks
236         - Example:
237```javascript
238           // INSECURE: Vulnerable regex pattern
239           const regex = /^(a+)+$/;
240           
241           // SECURE: Optimized regex pattern
242           const regex = /^a+$/;
243```
244      
245      10. **Vendor Management:**
246          - Evaluate the security posture of third-party libraries before use
247          - Prefer libraries with active maintenance and security focus
248          - Example evaluation criteria:
249            - When was the last commit?
250            - How quickly are security issues addressed?
251            - Does the project have a security policy?
252            - Is there a responsible disclosure process?
253            - How many open issues and pull requests exist?
254            - What is the download count and GitHub stars?
255      
256      11. **Runtime Dependency Checking:**
257          - Implement runtime checks for critical dependencies
258          - Example:
259```javascript
260            // Check package version at runtime for critical dependencies
261            try {
262              const packageJson = require('some-critical-package/package.json');
263              const semver = require('semver');
264              
265              if (semver.lt(packageJson.version, '2.0.0')) {
266                console.warn('Warning: Using a potentially vulnerable version of some-critical-package');
267              }
268            } catch (err) {
269              console.error('Error checking package version:', err);
270            }
271```
272      
273      12. **Minimal Dependencies:**
274          - Minimize the number of dependencies to reduce attack surface
275          - Regularly audit and remove unused dependencies
276          - Example:
277```bash
278            # Find unused dependencies
279            npx depcheck
280            
281            # Analyze your bundle size
282            npx webpack-bundle-analyzer
283```
284 
285  - type: validate
286    conditions:
287      # Check 1: Using npm audit
288      - pattern: "\"scripts\"\\s*:\\s*\\{[^}]*?\"audit\"\\s*:\\s*\"npm audit"
289        message: "Using npm audit to check for vulnerabilities."
290      
291      # Check 2: Using lock files
292      - pattern: "package-lock\\.json|yarn\\.lock|pnpm-lock\\.yaml"
293        message: "Using lock files to ensure dependency consistency."
294      
295      # Check 3: Using integrity hashes
296      - pattern: "integrity=['\"]sha\\d+-[A-Za-z0-9+/=]+['\"]"
297        message: "Using subresource integrity hashes for external resources."
298      
299      # Check 4: Using modern Buffer API
300      - pattern: "Buffer\\.(?:from|alloc|allocUnsafe)"
301        message: "Using modern Buffer API instead of deprecated constructor."
302      
303      # Check 5: Using dependency scanning in CI
304      - pattern: "npm\\s+audit|snyk\\s+test|yarn\\s+audit"
305        location: "(?:\\.github/workflows|\\.gitlab-ci\\.yml|Jenkinsfile|azure-pipelines\\.yml)"
306        message: "Integrating dependency scanning in CI/CD pipeline."
307 
308metadata:
309  priority: high
310  version: 1.0
311  tags:
312    - security
313    - javascript
314    - nodejs
315    - browser
316    - dependencies
317    - owasp
318    - language:javascript
319    - framework:express
320    - framework:react
321    - framework:vue
322    - framework:angular
323    - category:security
324    - subcategory:dependencies
325    - standard:owasp-top10
326    - risk:a06-vulnerable-outdated-components
327  references:
328    - "https://owasp.org/Top10/A06_2021-Vulnerable_and_Outdated_Components/"
329    - "https://cheatsheetseries.owasp.org/cheatsheets/Nodejs_Security_Cheat_Sheet.html"
330    - "https://cheatsheetseries.owasp.org/cheatsheets/NPM_Security_Cheat_Sheet.html"
331    - "https://docs.npmjs.com/cli/v8/commands/npm-audit"
332    - "https://snyk.io/learn/npm-security/"
333    - "https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity"
334    - "https://github.com/OWASP/NodeGoat"
335    - "https://owasp.org/www-project-dependency-check/"
336</rule> 
337