drupal-insecure-design

Drupal Insecure Design Security Standards (OWASP A04:2021)

This rule enforces security best practices to prevent insecure design vulnerabilities in Drupal applications, as defined in OWASP Top 10:2021-A04.

actions:

• type: enforce conditions:

  Pattern 1: Insecure permission design

  • pattern: "\$permissions\[['"][^'"]+['"]\]\s*=\sarray\((?[^)](content|configuration|users)).?\);" message: "Permissions should follow Drupal naming patterns (verb + object) and be specific. Avoid overly broad permissions."

  Pattern 2: Hard-coded business logic values

  • pattern: "if\s*\([^\)]===?\s['"][a-zA-Z0-9_]+['"]\s*\)" message: "Consider moving business logic rules to configuration to allow for proper adjustment without code changes."

  Pattern 3: Ad hoc input sanitization

  • pattern: "preg_replace|str_replace|strip_tags" message: "Avoid ad hoc sanitization. Use Drupal's built-in sanitization tools: t(), Xss::filter(), etc."

  Pattern 4: Database logic in controllers

  • pattern: "class\s+[a-zA-Z0-9_]+Controller.+\{[^}]*->query\(" message: "Follow separation of concerns. Move database logic to services or repositories, not in controllers."

  Pattern 5: Weak entity access policy

  • pattern: "function\s+[a-zA-Z0-9_]+_entity_access\([^)]\)\s\{[^}]*return\s+AccessResult::allowed\(\);" message: "Avoid unconditional access grants. Implement proper conditional checks based on roles, permissions, or entity ownership."

  Pattern 6: Custom session management

  • pattern: "session_start|session_set_cookie_params" message: "Avoid custom session management. Use Drupal's session handling system and services."

  Pattern 7: Excessive global state dependency

  • pattern: "(?:\\Drupal::[a-zA-Z_]+\(\).*){3,}" message: "Excessive static service calls indicate poor dependency injection. Use proper service injection."

  Pattern 8: Custom user authentication

  • pattern: "password_verify\(|password_hash\(" message: "Avoid custom authentication. Use Drupal's built-in authentication system and services."

  Pattern 9: Missing schema definitions

  • pattern: "function\s+[a-zA-Z0-9_]+_schema\(\)[^{]*\{[^}]*return\s+\$schema;(?![^}]validate_utf8|[^}]'not null')" message: "Database schemas should enforce data integrity with proper constraints (NOT NULL, length, etc.)."

  Pattern 10: Insecure defaults

  • pattern: "\$config\['"[^'"]+['"]\]\s*=\s*(?:FALSE|0|'0'|"0");" message: "Security-related configuration should default to secure settings (opt-in for potentially insecure features)."

• type: suggest message: | Drupal Secure Design Best Practices:

  1. Secure Architecture Principles:

     • Follow the principle of least privilege for all user roles and permissions
     • Implement defense in depth with multiple security layers
     • Use Drupal's entity/field API for structured data instead of custom tables
     • Employ service-oriented architecture with proper dependency injection
     • Follow Drupal coding standards to leverage community security expertise

  2. Permission System Design:

     • Design granular permissions following the verb+object pattern
     • Avoid creating omnipotent permissions that grant excessive access
     • Use context-aware access systems like Entity Access or Node Grants
     • Consider record-based and field-based access for better control
     • Document permission architecture and security implications