owasp-asvs

name: owasp-asvs description: OWASP ASVS v5.0 security verification skill with Drupal 11 mappings. Use when performing security code reviews, implementing security requirements, or verifying security compliance in Drupal projects.

ASVS Security Verification Skill

Reference: OWASP ASVS v5.0.0 — cross-reference IDs against https://github.com/OWASP/ASVS for the authoritative source.

When This Activates

• Performing security code reviews
• Implementing security features
• Responding to security review findings
• Security compliance verification

ASVS Requirements Checklist

V1 — Encoding and Sanitization (Critical)

V2 — Validation

V3 — Web Frontend Security

V4 — API and Web Service

V5 — File Handling

V6 — Authentication

V7 — Session Management

V8 — Authorization

V9 — Communication (TLS/Transport)

V10 — Malicious Code / Supply Chain

V11 — Business Logic

V12 — Configuration

V13 — Data Protection

V14 — Cryptography

Critical Security Patterns for Drupal

SQL Injection (V1.1.4)

// VULNERABLE
$query = "SELECT * FROM users WHERE name = '" . $name . "'";

// SAFE — Drupal Query Builder
$result = $this->connection->select('users', 'u')
  ->fields('u')
  ->condition('name', $name)
  ->execute();

// SAFE — Placeholder
$result = $this->connection->query(
  'SELECT * FROM {users} WHERE name = :name',
  [':name' => $name]
);

XSS Prevention (V1.2.1)

// VULNERABLE
['#markup' => $user_input]

// SAFE — plain text
['#plain_text' => $user_input]

// SAFE — Twig auto-escape (always prefer)
{{ variable }}

// SAFE — Admin HTML (trusted editors only)
use Drupal\Component\Utility\Xss;
$safe = Xss::filterAdmin($html);

// SAFE — plain text in arbitrary context
use Drupal\Component\Utility\Html;
$safe = Html::escape($user_input);

CORS Configuration (V3.2.2)

// VULNERABLE — wildcard
$response->headers->set('Access-Control-Allow-Origin', '*');

// SAFE — explicit allowlist; only add Credentials header when the
// endpoint actually requires cookie/auth-header sharing
$allowed = $config->get('allowed_origins') ?: [];
$origin = $request->headers->get('Origin', '');
if ($origin && in_array($origin, $allowed, TRUE)) {
  $response->headers->set('Access-Control-Allow-Origin', $origin);
  $response->headers->set('Vary', 'Origin');
  // Only add if this endpoint specifically requires credentialed requests:
  // $response->headers->set('Access-Control-Allow-Credentials', 'true');
}

Authorization — Entity Access (V8.1.3, V8.3.1)

// VULNERABLE — route access only, no object-level check
$node = Node::load($nid);
return $node->get('field_secret')->value;

// SAFE — always check entity access
$node = Node::load($nid);
if (!$node || !$node->access('view')) {
  throw new AccessDeniedHttpException();
}
return $node->get('field_secret')->value;

// SAFE — AccessResult in access checker service
use Drupal\Core\Access\AccessResult;
public function access(AccountInterface $account): AccessResult {
  return AccessResult::allowedIfHasPermission($account, 'view secret content')
    ->cachePerPermissions();
}

CSRF for Custom Endpoints (V3.3.1)

// VULNERABLE — custom route with no CSRF check
public function myAction(Request $request): Response { ... }

// SAFE — Form API handles CSRF automatically; for non-form endpoints:
// In routing.yml add: requirements: { _csrf_token: 'TRUE' }
// Then validate token in controller:
$token = $request->query->get('token');
if (!$this->csrfTokenGenerator->validate($token, 'my-action')) {
  throw new AccessDeniedHttpException();
}

Rate Limiting — Flood Control (V2.3.1)

// Drupal's built-in flood control service
$flood = \Drupal::service('flood');
$identifier = $request->getClientIp();

if (!$flood->isAllowed('my_module.action', $threshold = 10, $window = 3600, $identifier)) {
  throw new TooManyRequestsHttpException(null, 'Rate limit exceeded.');
}

// Register the flood event after processing
$flood->register('my_module.action', $window = 3600, $identifier);

Secret Management (V6.3.1)

// VULNERABLE — stored in config
$secret = $config->get('jwt_secret');

// SAFE — environment variable
$secret = getenv('JWT_SECRET');

// SAFE — Key module (preferred for Drupal)
$key = \Drupal::service('key.repository')->getKey('jwt_secret');
$secret = $key->getKeyValue();

// Always fail hard in production if secret is missing
if ($is_production && empty($secret)) {
  throw new \RuntimeException('JWT secret is required in production.');
}

Security Headers (V3.2.1–V3.2.4)

// In an EventSubscriber on KernelEvents::RESPONSE:
$response->headers->set('Strict-Transport-Security', 'max-age=31536000; includeSubDomains; preload');
$response->headers->set('X-Content-Type-Options', 'nosniff');
$response->headers->set('Content-Security-Policy', "default-src 'self'; script-src 'self'");
$response->headers->set('Referrer-Policy', 'strict-origin-when-cross-origin');
$response->headers->set('X-Frame-Options', 'SAMEORIGIN');

File Upload Validation (V5.1.2)

// SAFE — validate extension and MIME type
$validators = [
  'file_validate_extensions' => ['pdf jpg png'],
  'file_validate_size'       => [10 * 1024 * 1024], // 10 MB
  'file_validate_image_resolution' => ['2000x2000'],
];
$file = file_save_upload('my_field', $validators, 'private://', FILE_EXISTS_RENAME);
if (!$file) {
  // Upload failed validation
}

Cryptographic Operations (V14.2.1, V14.3.1)

// SAFE — cryptographically secure random bytes
use Drupal\Component\Utility\Crypt;
$token = Crypt::randomBytesBase64(32);

// SAFE — password hashing (Drupal core)
$hashed = \Drupal::service('password')->hash($plain);
$valid  = \Drupal::service('password')->check($plain, $hashed);

// UNSAFE — never use for security-sensitive hashing
$bad = md5($input);
$bad = sha1($input);

Quick Verification Checklist

Before any code is committed:

• V1.1.4 SQL uses parameterized queries (Query Builder or placeholders)
• V1.2.1 Output uses #plain_text, Html::escape(), or Twig auto-escape
• V3.2.2 CORS uses explicit allowlist — no *
• V3.2.3 CSP header defined and restrictive
• V3.2.1 HSTS enforced for all HTTPS traffic
• V3.3.1 CSRF tokens present (Form API or _csrf_token routing requirement)
• V2.3.1 Rate limiting via flood control on sensitive endpoints
• V6.3.1 Secrets from Key module or environment — not from config.get()
• V7.1.4 Session destroyed on logout
• V8.1.3 Entity access checked on every object load (not just route)
• V9.1.1 All traffic over TLS; HTTP redirects to HTTPS
• V10.1.1 composer audit passes; composer.lock committed
• V12.1.1 Debug/verbose error modes disabled in production
• V14.1.1 No MD5/SHA-1 for security-sensitive operations

Red Flags

Drupal-Specific Module References

References

• OWASP ASVS v5.0
• ASVS v5.0 GitHub (authoritative IDs)
• Drupal Security Documentation
• Drupal Secure Coding Standards