drupal-insecure-design

Drupal Insecure Design Security Standards (OWASP A04:2021)

This rule enforces security best practices to prevent insecure design vulnerabilities in Drupal applications, as defined in OWASP Top 10:2021-A04.

Rule Details

• Name: drupal_insecure_design

• Description: Detect and prevent insecure design patterns in Drupal as defined in OWASP Top 10:2021-A04

Filters

• file extension pattern: \\.(php|inc|module|install|theme|info\\.yml)$
• file path pattern: (modules|themes|profiles)/custom

Enforcement Checks

• Conditions:
  • pattern \\$permissions\\[['\"][^'\"]+['\"]\\]\\s*=\\s*array\\((?![^)]*(administer|manage|edit|delete)[^)]*(content|configuration|users)).*?\\); – Permissions should follow Drupal naming patterns (verb + object) and be specific. Avoid overly broad permissions.
    • Pattern 1: Insecure permission design
  • pattern if\\s*\\([^\\)]*===?\\s*['\"][a-zA-Z0-9_]+['\"]\\s*\\) – Consider moving business logic rules to configuration to allow for proper adjustment without code changes.
    • Pattern 2: Hard-coded business logic values
  • pattern preg_replace|str_replace|strip_tags – Avoid ad hoc sanitization. Use Drupal's built-in sanitization tools: t(), Xss::filter(), etc.
    • Pattern 3: Ad hoc input sanitization
  • pattern class\\s+[a-zA-Z0-9_]+Controller.+\\{[^}]*->query\\( – Follow separation of concerns. Move database logic to services or repositories, not in controllers.
    • Pattern 4: Database logic in controllers
  • pattern function\\s+[a-zA-Z0-9_]+_entity_access\\([^)]*\\)\\s*\\{[^}]*return\\s+AccessResult::allowed\\(\\); – Avoid unconditional access grants. Implement proper conditional checks based on roles, permissions, or entity ownership.
    • Pattern 5: Weak entity access policy
  • pattern session_start|session_set_cookie_params – Avoid custom session management. Use Drupal's session handling system and services.
    • Pattern 6: Custom session management
  • pattern (?:\\\\Drupal::[a-zA-Z_]+\\(\\).*){3,} – Excessive static service calls indicate poor dependency injection. Use proper service injection.
    • Pattern 7: Excessive global state dependency
  • pattern password_verify\\(|password_hash\\( – Avoid custom authentication. Use Drupal's built-in authentication system and services.
    • Pattern 8: Custom user authentication
  • pattern function\\s+[a-zA-Z0-9_]+_schema\\(\\)[^{]*\\{[^}]*return\\s+\\$schema;(?![^}]*validate_utf8|[^}]*'not null') – Database schemas should enforce data integrity with proper constraints (NOT NULL, length, etc.).
    • Pattern 9: Missing schema definitions
  • pattern \\$config\\[['\"](mdc:?!secure_|security_|private_)[^'\"]+['\"]\\]\\s*=\\s*(?:FALSE|0|'0'|\"0\"); – Security-related configuration should default to secure settings (opt-in for potentially insecure features).
    • Pattern 10: Insecure defaults