drupal-injection

Drupal Injection Security Standards (OWASP A03:2021)

This rule enforces security best practices to prevent injection vulnerabilities in Drupal applications, as defined in OWASP Top 10:2021-A03.

actions:

• type: enforce conditions:

  Pattern 1: Raw SQL queries without placeholders

  • pattern: "db_query\(['"][^'"]\$[^'"]['"]" message: "Direct variables in SQL queries are vulnerable to SQL injection. Use parameterized queries with placeholders."

  Pattern 2: Modern DB API without placeholders

  • pattern: "->query\(['"][^'"]\$[^'"]['"]" message: "Use parameterized queries with placeholders to prevent SQL injection: ->query($sql, [$param1, $param2])."

  Pattern 3: Unescaped output

  • pattern: "<?=|<?php\s+echo\s+(?!(t|\\t|\$this->t))[^;]*;" message: "Direct output may lead to XSS. Use t(), escaped variables with Html::escape(), or Twig templates."

  Pattern 4: Unfiltered user input in render arrays

  • pattern: "["']#markup["']\s*=>\s*(?!t\(|\\t\(|Xss::filterAdmin|Html::escape)\$" message: "Never use unfiltered variables in #markup. Use t(), Xss::filterAdmin(), or Html::escape()."

  Pattern 5: Unescaped variables in JavaScript settings

  • pattern: "->addJsSettings\(\[(?![^\]]*(Xss::filter|Json::encode))\$" message: "Filter variables before adding to JavaScript settings using Xss::filter() or properly encode with Json::encode()."

  Pattern 6: Direct command execution

  • pattern: "exec\(|shell_exec\(|system\(|passthru\(|proc_open\(|popen\(|`" message: "Command execution functions can lead to command injection. Use Symfony\Component\Process\Process if necessary."

  Pattern 7: Unvalidated redirect

  • pattern: "->redirect\(\s*\$(?!(this->|allowed_destinations|config))" message: "Unvalidated redirects can lead to open redirect vulnerabilities. Whitelist allowed destinations."

  Pattern 8: Raw user input in conditions

  • pattern: "->condition\([^,],\s\$(?!(this->|config|entity|storage))[^,]*," message: "Use proper input validation before using variables in database conditions to prevent SQL injection."

  Pattern 9: Missing CSRF protection in forms

  • pattern: "(?<!buildForm|getFormId)\sfunction\s+[a-zA-Z0-9_]+Form\s\([^{]*\{[^}]return\s+\$form;(?![^}]FormBuilderInterface|[^}]::TOKEN|[^}]#token)" message: "Form submissions must include CSRF protection with $form['#token']."

  Pattern 10: Unvalidated file operations

  • pattern: "file_get_contents\(\s*\$(?!(this->|allowed_paths|config))" message: "Validate file paths before operations to prevent path traversal attacks."

• type: suggest message: | Drupal Injection Prevention Best Practices:

  1. SQL Injection Prevention:

     • Always use parameterized queries with placeholders
     • Use the Database API's condition methods: ->condition(), ->where()
     • Properly escape table and field names with {}
     • Consider using EntityQuery for entity operations

  2. XSS Prevention:

     • Use Drupal's t() function for user-visible strings
     • Apply appropriate filtering: Html::escape(), Xss::filter(), Xss::filterAdmin()
     • Use #plain_text instead of #markup when displaying user input
     • Utilize Twig's automatic escaping in templates
     • For admin UIs, be careful with Xss::filterAdmin() as it allows some tags

  3. CSRF Protection:

     • Always include form tokens with $form['#token']
     • Validate form tokens with FormState->validateToken()
     • For AJAX requests, utilize Drupal's ajax framework
     • Use drupal_valid_token() for custom validation