/owasp-asvs

name: owasp-asvs
description: OWASP ASVS v5.0 security verification skill with Drupal 11 mappings. Use when performing security code reviews, implementing security requirements, or verifying security compliance in Drupal projects.

ASVS Security Verification Skill

Reference: OWASP ASVS v5.0.0 — cross-reference IDs against https://github.com/OWASP/ASVS for the authoritative source.

When This Activates

• Performing security code reviews
• Implementing security features
• Responding to security review findings
• Security compliance verification

---

ASVS Requirements Checklist

V1 — Encoding and Sanitization (Critical)

| ID | Requirement | Drupal Validation | |----|-------------|-------------------| | V1.1.1 | Output encoding for HTTP/HTML context | Twig auto-escape or `#plain_text` | | V1.1.2 | Dynamic URL building with encoding | `Url::fromRoute()`, never string concat | | V1.1.3 | JavaScript/JSON encoding | `Json::encode()` before output | | V1.1.4 | **SQL injection prevention** | **Parameterized queries only** | | V1.1.5 | OS command injection prevention | Avoid `shell_exec`, `exec`, `system` | | V1.1.6 | LDAP injection prevention | Use parameterized LDAP queries | | V1.1.7 | Regex metacharacter escaping | `preg_quote()` on user input | | V1.2.1 | HTML sanitization | `Xss::filter()` or `Xss::filterAdmin()` | | V1.2.2 | No `eval()` with user input | Avoid `eval()`, use `Json::decode()` | | V1.2.3 | SSRF prevention | Validate URLs against explicit allowlist |

V2 — Validation

| ID | Requirement | Drupal Validation | |----|-------------|-------------------| | V2.1.1 | Input validation at server | Validate all user input server-side | | V2.1.2 | Server-side validation only | Never trust client-only validation | | V2.2.1 | Positive validation (allowlist) | Use `\Drupal\Component\Utility\Html::escape()` for plain text | | V2.3.1 | **Anti-automation / rate limiting** | Flood control or custom rate limit service |

V3 — Web Frontend Security

| ID | Requirement | Drupal Validation | |----|-------------|-------------------| | V3.1.1 | Cookie Secure attribute | `ini_set('session.cookie_secure', TRUE)` | | V3.1.2 | Cookie SameSite attribute | `session.cookie_samesite = Lax` in `settings.php` | | V3.1.3 | Cookie HttpOnly | `session.cookie_httponly = TRUE` | | V3.2.1 | **HSTS header** | `Strict-Transport-Security` response header | | V3.2.2 | **CORS allowlist** | **Validate Origin; never use wildcard** | | V3.2.3 | CSP header | `Content-Security-Policy` response header | | V3.2.4 | X-Content-Type-Options | `nosniff` | | V3.2.5 | Referrer-Policy | Set appropriate policy | | V3.2.6 | frame-ancestors | Prevent clickjacking via CSP or `X-Frame-Options` | | V3.3.1 | **CSRF protection** | Form API tokens (automatic) or `CsrfTokenGenerator` for custom endpoints |

V4 — API and Web Service

| ID | Requirement | Drupal Validation | |----|-------------|-------------------| | V4.1.1 | Content-Type header | Set correct `Content-Type` on all responses | | V4.1.2 | HTTP method restrictions | `routing.yml` `methods:` key | | V4.1.3 | HTTP request smuggling | Proper header parsing; avoid custom HTTP parsing | | V4.2.1 | Authentication on every API endpoint | `_permission` or `_custom_access` in routing |

V5 — File Handling

| ID | Requirement | Drupal Validation | |----|-------------|-------------------| | V5.1.1 | File size limits | `upload_max_filesize`, managed file field limits | | V5.1.2 | File type validation | `file_validate_extensions()` + MIME check | | V5.2.1 | No file execution | Never serve uploads from a web-accessible path as PHP | | V5.2.2 | Path traversal prevention | Use `FileSystem::realpath()`, validate against allowed dirs |

V6 — Authentication

| ID | Requirement | Drupal Validation | |----|-------------|-------------------| | V6.1.1 | Password minimum length | Minimum 12 chars (Drupal default: 8 — raise it) | | V6.1.2 | Breached password check | Integrate HaveIBeenPwned API or `password_policy` module | | V6.1.3 | No restrictive composition rules | Allow all printable characters | | V6.1.4 | Long password support | Allow 64+ characters | | V6.2.1 | Multi-factor authentication | `tfa` module or SAML/OIDC with MFA | | V6.3.1 | **Secrets from secure source** | `getenv()` or Key module — never `config.get()` | | V6.3.2 | No production secret fallback | Throw exception if secret missing in prod |

V7 — Session Management

| ID | Requirement | Drupal Validation | |----|-------------|-------------------| | V7.1.1 | Session identifier length | Minimum 128 bits of entropy | | V7.1.2 | Session identifier randomness | Cryptographically random (Drupal core handles this) | | V7.1.3 | Session inactivity timeout | Configure in `settings.php` | | V7.1.4 | Session termination on logout | `session_destroy()` via `AccountInterface::logout()` | | V7.2.1 | New session on privilege change | `\Drupal::service('session')->migrate()` on role change | | V7.2.2 | Session token not in URLs | Ensure `session.use_only_cookies = TRUE` |

V8 — Authorization

| ID | Requirement | Drupal Validation | |----|-------------|-------------------| | V8.1.1 | Least privilege | Grant minimal roles/permissions | | V8.1.2 | Role-based access control | `user.permissions` + `AccessResult` | | V8.1.3 | Access control on every request | `_permission`, `_entity_access`, or `_custom_access` | | V8.2.1 | No user/role enumeration | Return identical responses for missing vs forbidden | | V8.2.2 | Sensitive data access logging | Watchdog or event subscriber | | V8.3.1 | Object-level authorization | Check entity ownership, not just route access |

V9 — Communication (TLS/Transport)

| ID | Requirement | Drupal Validation | |----|-------------|-------------------| | V9.1.1 | TLS required for all traffic | Enforce HTTPS; redirect HTTP → HTTPS | | V9.1.2 | TLS certificate validity | Valid cert, no self-signed in production | | V9.1.3 | TLS 1.2+ only | Disable TLS 1.0/1.1 at server level | | V