drupal-broken-access-control

Drupal Broken Access Control Security Standards (OWASP A01:2021)

This rule enforces security best practices to prevent broken access control vulnerabilities in Drupal applications, as defined in OWASP Top 10:2021-A01.

actions:

• type: enforce conditions:

  Pattern 1: Missing access checks in routes

  • pattern: "\s*\$routes\['[^']'\]\s=\s*.*(?!_access|access_callback|requirements)" message: "Route definition is missing access control. Add '_permission', '_role', '_access', or custom access check in requirements."

  Pattern 2: Using user_access() instead of more secure methods

  • pattern: "user_access\(" message: "user_access() is deprecated. Use $account->hasPermission() or proper dependency injection with AccessResult methods."

  Pattern 3: Hard-coded user ID checks

  • pattern: "(\$user->id\(\)|\$user->uid)\s*===?\s*1" message: "Avoid hardcoded checks against user ID 1. Use role-based permissions or proper access control services."

  Pattern 4: Missing access check on entity operations

  • pattern: "\$entity->(?!access)(save|delete|update)\(\)" message: "Entity operation without prior access check. Use $entity->access('operation') before performing operations."

  Pattern 5: Using Drupal::currentUser() directly in services

  • pattern: "\\Drupal::currentUser\(\)" message: "Avoid using \Drupal::currentUser() directly. Inject the current_user service for better testability and security."

  Pattern 6: Missing access checks in controllers

  • pattern: "class [A-Za-z0-9_]+Controller.+extends ControllerBase[^}]+public function [a-zA-Z0-9_]+\([^{]\)\s\{(?![^}]*access)" message: "Controller method lacks explicit access checking. Add checks via route requirements or within the controller method."

  Pattern 7: Direct field value manipulation without access check

  • pattern: "\$entity->set\([^)]+\)\s*;(?![^;]*access)" message: "Direct field value manipulation without access check. Verify entity field access before manipulation."

  Pattern 8: Unprotected REST endpoints

  • pattern: "@RestResource\([^)]\)(?![^{]_access|access_callback)" message: "REST resource lacks access controls. Add access checks via annotations or in methods."

  Pattern 9: Insecure access check by client IP

  • pattern: "\$_SERVER\['REMOTE_ADDR'\]\s*===?\s*" message: "IP-based access control is insufficient. Use proper Drupal permission system instead."

  Pattern 10: Allow bypassing cache for authenticated users without proper checks

  • pattern: "#cache\['contexts'\]\s*=\s*\[[^\]]'user'[^\]]\]" message: "Using 'user' cache context without proper access checks may expose content to unauthorized users."

• type: suggest message: | Drupal Access Control Best Practices:

  1. Route Access Controls:

     • Always define access requirements in route definitions
     • Use permission-based access checks: '_permission', '_role', '_entity_access'
     • Implement custom access checkers implementing AccessInterface

  2. Entity Access Controls:

     • Always check entity access: $entity->access('view'|'update'|'delete')
     • Use EntityAccessControlHandler for consistent access control
     • Respect entity field access with $entity->get('field')->access('view'|'edit')

  3. Controller Security:

     • Inject and use proper services rather than \Drupal static calls
     • Add explicit access checks within controller methods
     • Use AccessResult methods (allowed, forbidden, neutral) with proper caching metadata