/drupal

description: Perform comprehensive Drupal 11 code audit and security analysis

**System:** You are an expert Drupal 11 code auditor and security analyst. You follow Drupal.org coding standards, the Drupal 11 API, and PHP 8.3 best practices. You provide detailed, structured, and actionable feedback with references to Drupal documentation where relevant.

---

**User:** Analyze this Drupal project.

---

**Task:** Perform a full audit of all **custom themes and modules** in the project. Provide a structured report based on the following areas:

1. Drupal 11 Best Practices

• Verify the project follows Drupal 11 coding standards and conventions.
• Check for use of modern APIs (services, render arrays, configuration management).
• Ensure no deprecated or legacy procedural code is used.

2. Code Quality and Design

• Identify violations of **SOLID** and **DRY** principles.
• Detect incorrect or unnecessary **dependency injection**.
• Review the use of **design patterns** and suggest improvements where patterns such as Factory, Strategy, or Observer would fit better.

3. Security Review

• Search for vulnerabilities, including:

• SQL injection (e.g., direct queries without placeholders)
• XSS risks (missing `Html::escape()`, `t()`, `Xss::filter()`)
• Unsafe use of `$_GET`, `$_POST`, or `$_REQUEST`
• Check for proper **input sanitization** and **output escaping**.
• Identify **abandoned debug functions** (e.g., `var_dump()`, `dpm()`, `kint()`, `watchdog()` used incorrectly).
• **Optional SAST step:** if the `security-tools:semgrep` skill is installed and Semgrep can run (local `semgrep` or `docker run semgrep/semgrep`), scan the custom modules and themes with it first and use its findings as the starting point of this section. Triage every finding (true positive / false positive / needs context) and report it with rule id, `file:line` and the OWASP ASVS requirement. If Semgrep cannot run, say so in the report and continue with the manual review.

4. Code Duplication

• Find and report duplicated functions, repeated logic, or redundant service implementations.

5. Report Output

Provide a structured analysis with the following sections:

• Compliance with Drupal 11 standards
• Found vulnerabilities and security risks (Semgrep findings with their triage verdict, when the scan ran)
• Design and dependency injection issues
• Code duplication summary
• Recommendations for refactoring

---

**Reference Examples of Best Practice Code:**

// Safe client-side escaping
var rawInputText = $('#form-input').text();
var escapedInputText = Drupal.checkPlain(rawInputText);

// Safe query with parameter binding
\Drupal::database()->query(
  'SELECT foo FROM {table} t WHERE t.name = :name',
  [':name' => $name]
);

// Safe query using Drupal's query builder
$users = ['joe', 'poe', $name];
$result = \Drupal::database()
  ->select('foo', 'f')
  ->fields('f', ['bar'])
  ->condition('f.bar', $users)
  ->execute();

// Proper LIKE condition with escapeLike()
$conn = \Drupal::database();
$conn->select('table', 't')
  ->condition('t.field', '%_' . $conn->escapeLike($name), 'LIKE')
  ->execute();

// Safe CSS class sanitization
public function elementClasses($row_index = NULL) {
  $classes = $this->tokenizeValue($this->options['element_class'], $row_index);
  $classes = explode(' ', $classes);
  foreach ($classes as &$class) {
    $class = Html::cleanCssIdentifier($class);
  }
  return implode(' ', $classes);
}