55 lines
2.2 KiB
Markdown
55 lines
2.2 KiB
Markdown
|
# Security Requirements
|
||
|
|
|
||
|
|
Phase: implementation
|
||
|
|
Enforcement: informational (graduating to blocking Q3 2026)
|
||
|
|
|
||
|
|
## SEC-001: Input Validation
|
||
|
|
|
||
|
|
All external input (API request bodies, query parameters, headers, file uploads) MUST be validated through a schema validator before processing.
|
||
|
|
|
||
|
|
**Rule:** No raw request body access in business logic. All endpoints must define and validate against a schema (JSON Schema, protobuf, or framework-equivalent).
|
||
|
|
|
||
|
|
**Test:** Grep for direct `request.body` / `req.body` / `getParameter()` usage outside of controller/validation layer.
|
||
|
|
|
||
|
|
```
|
||
|
|
# Bad
|
||
|
|
String name = request.getParameter("name");
|
||
|
|
db.query("SELECT * FROM users WHERE name = '" + name + "'");
|
||
|
|
|
||
|
|
# Good
|
||
|
|
ValidatedInput input = validator.validate(request, CreateUserSchema.class);
|
||
|
|
userService.create(input);
|
||
|
|
```
|
||
|
|
|
||
|
|
## SEC-002: No Raw SQL
|
||
|
|
|
||
|
|
All database queries MUST use parameterized queries or an ORM. No string concatenation in SQL statements.
|
||
|
|
|
||
|
|
**Rule:** Zero tolerance for SQL string concatenation with user-controlled values.
|
||
|
|
|
||
|
|
**Test:** Regex scan for SQL keywords adjacent to string concatenation operators (`+`, `concat`, `format`, `f"`, template literals).
|
||
|
|
|
||
|
|
## SEC-003: Authentication Annotations
|
||
|
|
|
||
|
|
All new REST endpoints MUST have an explicit auth annotation. No endpoint may be implicitly public.
|
||
|
|
|
||
|
|
**Rule:** Every `@RequestMapping`, `@GetMapping`, `@PostMapping` (or equivalent) must be accompanied by `@ReltioSecured` or `@PublicEndpoint`. Missing annotation = violation.
|
||
|
|
|
||
|
|
**Test:** AST/regex check that every endpoint method has an auth annotation.
|
||
|
|
|
||
|
|
## SEC-004: Secrets in Code
|
||
|
|
|
||
|
|
No hardcoded secrets, tokens, passwords, or API keys in source code.
|
||
|
|
|
||
|
|
**Rule:** All secrets must come from environment variables, vault, or config service. String literals matching secret patterns are violations.
|
||
|
|
|
||
|
|
**Test:** Regex scan for patterns: API keys, JWT tokens, passwords in string literals, base64-encoded credentials.
|
||
|
|
|
||
|
|
## SEC-005: Dependency Vulnerability
|
||
|
|
|
||
|
|
No new dependencies with known critical/high CVEs.
|
||
|
|
|
||
|
|
**Rule:** Any new dependency added to `pom.xml`, `package.json`, `go.mod`, or equivalent must pass a vulnerability scan.
|
||
|
|
|
||
|
|
**Test:** Run `npm audit` / `mvn dependency-check:check` / `govulncheck` on changed dependency files.
|