drupal-injection

Drupal Injection Security Standards (OWASP A03:2021)

This rule enforces security best practices to prevent injection vulnerabilities in Drupal applications, as defined in OWASP Top 10:2021-A03.

Rule Details

• Name: drupal_injection

• Description: Detect and prevent injection vulnerabilities in Drupal as defined in OWASP Top 10:2021-A03

Filters

• file extension pattern: \\.(php|inc|module|install|theme)$
• file path pattern: (modules|themes|profiles|core)/.*

Enforcement Checks

• Conditions:
  • pattern db_query\\(['\"][^'\"]*\\$[^'\"]*['\"] – Direct variables in SQL queries are vulnerable to SQL injection. Use parameterized queries with placeholders.
    • Pattern 1: Raw SQL queries without placeholders
  • pattern ->query\\(['\"][^'\"]*\\$[^'\"]*['\"] – Use parameterized queries with placeholders to prevent SQL injection: ->query($sql, [$param1, $param2]).
    • Pattern 2: Modern DB API without placeholders
  • pattern <?=|<?php\\s+echo\\s+(?!(t|\\\\t|\\$this->t))[^;]*; – Direct output may lead to XSS. Use t(), escaped variables with Html::escape(), or Twig templates.
    • Pattern 3: Unescaped output
  • pattern [\"']#markup[\"']\\s*=>\\s*(?!t\\(|\\\\t\\(|Xss::filterAdmin|Html::escape)\\$ – Never use unfiltered variables in #markup. Use t(), Xss::filterAdmin(), or Html::escape().
    • Pattern 4: Unfiltered user input in render arrays
  • pattern ->addJsSettings\\(\\[(?![^\\]]*(Xss::filter|Json::encode))\\$ – Filter variables before adding to JavaScript settings using Xss::filter() or properly encode with Json::encode().
    • Pattern 5: Unescaped variables in JavaScript settings
  • pattern `exec\(|shell_exec\(|system\(|passthru\(|proc_open\(|popen\(|`` – Command execution functions can lead to command injection. Use Symfony\Component\Process\Process if necessary.
    • Pattern 6: Direct command execution
  • pattern ->redirect\\(\\s*\\$(?!(this->|allowed_destinations|config)) – Unvalidated redirects can lead to open redirect vulnerabilities. Whitelist allowed destinations.
    • Pattern 7: Unvalidated redirect
  • pattern ->condition\\([^,]*,\\s*\\$(?!(this->|config|entity|storage))[^,]*, – Use proper input validation before using variables in database conditions to prevent SQL injection.
    • Pattern 8: Raw user input in conditions
  • pattern (?<!buildForm|getFormId)\\s*function\\s+[a-zA-Z0-9_]+Form\\s*\\([^{]*\\{[^}]*return\\s+\\$form;(?![^}]*FormBuilderInterface|[^}]*::TOKEN|[^}]*#token) – Form submissions must include CSRF protection with $form['#token'].
    • Pattern 9: Missing CSRF protection in forms
  • pattern file_get_contents\\(\\s*\\$(?!(this->|allowed_paths|config)) – Validate file paths before operations to prevent path traversal attacks.
    • Pattern 10: Unvalidated file operations