Security-And-Owasp

# Security Standards

Comprehensive security rules for web application development. Every anti-pattern includes a severity classification, detection method, OWASP 2025 reference, and corrective code examples.

**Severity levels:**

- **CRITICAL** — Exploitable vulnerability. Must be fixed before merge.

- **IMPORTANT** — Significant risk. Should be fixed in the same sprint.

- **SUGGESTION** — Defense-in-depth improvement. Plan for a future iteration.

---

OWASP Top 10 — 2025 Quick Reference

| # | Category | Key Mitigation |

|---|----------|----------------|

| A01 | Broken Access Control | Auth middleware on every endpoint, RBAC, ownership checks |

| A02 | Security Misconfiguration | Security headers, no debug in prod, no default credentials |

| A03 | Software Supply Chain Failures *(NEW)* | `npm audit`, lockfile integrity, SBOM, SLSA provenance |

| A04 | Cryptographic Failures | Argon2id/bcrypt for passwords, TLS everywhere, no secrets in code |

| A05 | Injection | Parameterized queries, input validation, no raw HTML with user input |

| A06 | Insecure Design | Threat modeling, secure design patterns, abuse case testing |

| A07 | Authentication Failures | Rate-limit login, secure session management, MFA |

| A08 | Software or Data Integrity Failures | SRI for CDN scripts, signed artifacts, no insecure deserialization |

| A09 | Security Logging and Alerting Failures | Log security events, no PII in logs, correlation IDs, active alerting |

| A10 | Mishandling of Exceptional Conditions *(NEW)* | Handle all errors, no stack traces in prod, fail-secure |

---

Injection Anti-Patterns (I1-I8)

I1: SQL Injection via String Concatenation

- **Severity**: CRITICAL

- **Detection**: `\$\{.*\}.*(?:SELECT|INSERT|UPDATE|DELETE|FROM|WHERE)`

- **OWASP**: A05

// BAD
const unsafeResult = await db.query(`SELECT * FROM users WHERE id = ${userId}`);

// GOOD — parameterized query
const safeResult = await db.query('SELECT * FROM users WHERE id = $1', [userId]);

I2: NoSQL Injection (MongoDB Operator Injection)

- **Severity**: CRITICAL

- **Detection**: `\{\s*\$(?:gt|gte|lt|lte|ne|in|nin|regex|where|exists)`

- **OWASP**: A05

// BAD — attacker sends { "password": { "$gt": "" } }
const user = await User.findOne({ username: req.body.username, password: req.body.password });

// GOOD — validate and cast input types
const username = String(req.body.username);
const password = String(req.body.password);
const user = await User.findOne({ username });
const valid = user && await verifyPassword(user.passwordHash, password);

I3: Command Injection (exec with User Input)

- **Severity**: CRITICAL

- **Detection**: `(?:exec|execSync|execFile|execFileSync)\s*\(.*(?:req\.|params\.|query\.|body\.)`

- **OWASP**: A05

// BAD — shell interpolation, sync call blocks the event loop
import { execFileSync } from 'node:child_process';
const unsafeOutput = execFileSync('sh', ['-c', `ls -la ${req.query.dir}`]);

// GOOD — async execFile, arguments array, no shell, bounded time/output
import { execFile } from 'node:child_process';
import { promisify } from 'node:util';
const pExecFile = promisify(execFile);

const dir = String(req.query.dir ?? '');
if (!dir || dir.startsWith('-')) throw new Error('Invalid directory');
const { stdout: safeOutput } = await pExecFile('ls', ['-la', '--', dir], {
  timeout: 5_000,      // fail fast on hung processes
  maxBuffer: 1 << 20,  // 1 MiB cap to prevent memory exhaustion
});

// BEST — allowlist validation on top of the async, bounded call above
const allowedDirs = ['/data', '/public'];
if (!allowedDirs.includes(dir)) throw new Error('Invalid directory');

Prefer async `execFile`/`spawn` over `execFileSync` in server handlers: the sync variant blocks Node's event loop and can amplify DoS impact. Always pass a `timeout` and `maxBuffer` to bound execution.

I4: XSS via Unsanitized HTML Rendering

- **Severity**: CRITICAL

- **Detection**: `(?:v-html|\[innerHTML\]|da