drupal-logging-failures

Drupal Security Logging and Monitoring Failures Standards (OWASP A09:2021)

This rule enforces security best practices to prevent logging and monitoring failures in Drupal applications, as defined in OWASP Top 10:2021-A09.

actions:

• type: enforce conditions:

  Pattern 1: Missing critical event logging

  • pattern: "(delete|update|create|execute|grant|revoke|config|schema).function[^}]\{(?![^}]*(log|watchdog|logger))" message: "Critical operations should include logging. Implement proper logging for security-relevant actions."

  Pattern 2: Suppressed error logging

  • pattern: "@include|@require|@eval|error_reporting\(0\)|ini_set\('"['"],\s*['"]0['"]\)" message: "Avoid suppressing errors and warnings. Implement proper error handling and logging instead."

  Pattern 3: Improper exception handling without logging

  • pattern: "catch\s*\([^{]\)\s\{(?![^}]*log|[^}]*watchdog|[^}]*logger)" message: "Exceptions should be properly logged, especially in security-critical sections."

  Pattern 4: Disabled watchdog

  • pattern: "dblog\.settings\.yml|syslog\.settings\.yml|logging\.settings\.yml" message: "Ensure logging is properly configured and not disabled. Verify log verbosity and retention policies."

  Pattern 5: Missing authentication event logging

  • pattern: "(login|authenticate|logout|password).function[^}]\{(?![^}]*(log|watchdog|logger))" message: "Authentication events should always be logged for security monitoring and auditing."

  Pattern 6: Failure to log access control decisions

  • pattern: "AccessResult::(allowed|forbidden|neutral)\([^)]\)(?)" message: "Consider logging significant access control decisions, especially denials, for security monitoring."

  Pattern 7: Missing logging in file operations

  • pattern: "(file_save|file_delete|file_move|file_copy)[^;];(?)" message: "File operations should be logged, especially for security-sensitive files."

  Pattern 8: Insufficient detail in log messages

  • pattern: "(\->log|watchdog)\([^,)],[^,)]\)" message: "Log messages should include sufficient context and detail for effective security monitoring."

  Pattern 9: Failure to log configuration changes

  • pattern: "\$config->set\([^;];(?)" message: "Configuration changes should be logged to maintain an audit trail and detect unauthorized changes."

  Pattern 10: Missing logs for API access

  • pattern: "class\s+[a-zA-Z0-9_]+Resource.+\{[^}]function\s+[a-zA-Z0-9_]+\([^{]\)\s*\{(?![^}]*(log|watchdog|logger))" message: "API endpoint access should be logged for security monitoring, especially for sensitive operations."

• type: suggest message: | Drupal Security Logging & Monitoring Best Practices:

  1. Comprehensive Logging Implementation:

     • Use Drupal's Logger Factory service: \Drupal::logger('module_name')
     • Implement proper log levels: emergency, alert, critical, error, warning, notice, info, debug
     • Include context in log messages with relevant identifiers and information
     • Log security-relevant events consistently across the application
     • Structure log messages to facilitate automated analysis

  2. Critical Events to Log:

     • Authentication events (login attempts, failures, logouts)
     • Access control decisions (particularly denials)
     • All administrative actions
     • Data modification operations on sensitive information
     • Configuration and settings changes
     • File operations (uploads, downloads of sensitive content)
     • API access and usage