netsuite-owasp-secure-coding

# OWASP Secure Coding Practices ## 1. Description This skill provides **implementation-depth OWASP secure coding coverage** for JavaScript and SuiteScript 2.1 development. It is the primary security reference for writing, reviewing, and auditing code. **What This Skill Covers:** - Complete OWASP Top 10 (2021) mapping with code-level mitigation patterns - 48 cataloged security pitfalls (OSCP-001 through OSCP-048) with BAD/GOOD code examples - Platform-agnostic JavaScript security patterns applicable beyond NetSuite - SuiteScript-specific security patterns for RESTlets, Suitelets, Client Scripts, and more - Output encoding for five HTML contexts (body, attribute, JavaScript, URL, CSS) - CSP header construction and deployment - File upload/download validation pipelines - API and RESTlet hardening patterns - AI agent security considerations for tool-assisted development - DRY security architecture: shared validation modules, centralized encoding, single-source configs - A mandatory security review checklist for every code review **Relationship to Existing Security Content:** If available, the `netsuite-sdf-leading-practices` skill contains two security-related principles from the SAFE Guide: - **Principle 5 (`05-security-privacy.md`)** -- Owns NetSuite-specific security topics: roles and permissions, token-based authentication (TBA), N/crypto module usage, PCI-DSS awareness, credential storage via script parameters, and SuiteCloud platform security features. - **Principle 11 (`11-security-best-practices.md`)** -- Owns OWASP awareness-level guidance: the core security principles list, a high-level OWASP Top 10 overview, basic input sanitization patterns, and parameterized query awareness. **This skill** (`netsuite-owasp-secure-coding`) provides everything below the awareness level: full implementation depth, exhaustive code patterns, all 48 pitfalls, context-specific encoding, CSP templates, file security, API hardening, client-side defenses, logging safety, and AI agent threat mitigation. It references Principles 5 and 11 where appropriate rather than duplicating their NetSuite-specific content. --- ## 2. How to Use ### Invocation Use this skill whenever you need a security review, threat analysis, or implementation guidance for SuiteScript or JavaScript security concerns. If your client supports explicit skill activation by name, activate `netsuite-owasp-secure-coding` and request the topic you need. ### Auto-Activation Triggers This skill auto-activates when the agent detects security-relevant context in the conversation. See Section 3 for the complete trigger list. ### Reference Files All deep-dive content is in the local `references/` directory. The skill loads the appropriate reference files based on the detected security topic. You can also request a specific reference directly: ``` Review this RESTlet for security issues. Load the injection prevention reference. Load the CSP header templates appendix. ``` --- ## 3. When to Use ### Keyword Triggers The skill activates when any of the following keywords or phrases appear in the conversation or code context: **Injection and Input:** `injection`, `sanitize`, `sanitise`, `validate input`, `SQL concatenation`, `string concatenation query`, `parameterized`, `prepared statement`, `user input` **XSS and Output:** `XSS`, `cross-site scripting`, `encode`, `output encoding`, `innerHTML`, `textContent`, `dangerouslySetInnerHTML`, `template literal injection` **Authentication and Session:** `auth`, `authentication`, `session`, `CSRF`, `token`, `TBA`, `OAuth`, `credential`, `password`, `login`, `logout`, `session fixation` **Headers and Browser:** `CSP`, `Content-Security-Policy`, `CORS`, `X-Frame-Options`, `HSTS`, `security header`, `postMessage`, `clickjacking` **Cryptography:** `crypto`, `hash`, `encrypt`, `decrypt`, `MD5`, `SHA-1`, `SHA-256`, `Math.random`, `nonce`, `HMAC`, `AES`, `secret key` **File Operations:** `file upload`, `file download`, `path traversal`, `MIME type`, `magic bytes`, `zip bomb`, `filename sanitization` **API and Network:** `RESTlet`, `Suitelet`, `API security`, `rate limit`, `SSRF`, `webhook`, `schema validation`, `request validation` **General Security:** `security`, `vulnerability`, `OWASP`, `pentest`, `hardening`, `exploit`, `attack surface`, `threat model`, `security review`, `security audit` **AI and Agent:** `prompt injection`, `AI security`, `agent security`, `tool poisoning`, `AI output validation`, `data exfiltration` ### Code Context Triggers The skill also activates when the agent detects these code patterns: - Writing or reviewing RESTlet scripts (`@NScriptType Restlet`) - Writing or reviewing Suitelets that generate HTML (`response.write`, `INLINEHTML`) - Client scripts with DOM manipulation (`innerHTML`, `document.write`, `eval`) - SuiteQL queries being constructed (`query.runSuiteQL`, `query.runSuiteQLPaged`, `N/query`) - File operations (`N/file`, `file.create`, `file.load`) - External HTTP calls (`N/https`, `https.post`, `https.get`) - Cryptographic operations (`N/crypto`, `createHash`, `createCipher`) - Any code review or security audit request --- ## 4. Companion Reference Map This skill is self-contained. To avoid content duplication, this map distinguishes what this skill owns from optional companion references that may exist in a broader NetSuite guidance set. | Source | Owns | Relationship to This Skill | |--------|------|----------------------------| | `netsuite-owasp-secure-coding` (This skill) | Full OWASP Top 10 implementation depth, all 48 OSCP pitfalls, five-context output encoding, CSP header construction, file upload/download validation pipeline, API/RESTlet hardening, client-side defenses (postMessage, DOM XSS, CSRF), logging safety, AI agent security, DRY security module patterns | Primary and authoritative source for implementation guidance in this package | | `05-security-privacy.md` (`netsuite-sdf-leading-practices`, optional companion reference) | NS roles and permissions, TBA authentication patterns, N/crypto module overview, PCI-DSS awareness, credential storage via Script Parameters, SuiteCloud platform security features | Supplemental background only; not required for this skill | | `11-security-best-practices.md` (`netsuite-sdf-leading-practices`, optional companion reference) | OWASP awareness list, core security principles, basic sanitize pattern, basic parameterized query mention, defense-in-depth overview | Supplemental background only; not required for this skill | **Cross-Reference Rules:** 1. Use this skill as the authoritative source for code-level implementation guidance. 2. If optional companion references are available, use them only for adjacent background such as role setup, token rotation, or high-level principles. 3. Do not assume companion references are installed; answer from this skill's local content first. --- ## 5. OWASP Top 10 (2021) Quick Map Each OWASP Top 10 category is mapped to the reference files in this skill that provide detailed coverage. | Category | ID | Reference Files | Key Topics | |----------|----|--------------------|------------| | Broken Access Control | A01:2021 | `04-access-control.md` | RBAC, IDOR, privilege escalation, runasrole, deployment audience | | Cryptographic Failures | A02:2021 | `06-cryptography-data-protection.md` | SHA-256+, AES-256, key management, PII masking, CSPRNG | | Injection | A03:2021 | `01-injection-prevention.md`, `03-xss-output-encoding.md` | SuiteQL params, LDAP escape, CRLF, XSS, DOM sinks | | Insecure Design | A04:2021 | (Covered across multiple) | Threat modeling, defense in depth, least privilege | | Security Misconfiguration | A05:2021 | `05-security-misconfiguration.md` | Error messages, debug mode, headers, default creds, SDF manifest | | Vulnerable Components | A06:2021 | `05-security-misconfiguration.md` | Dependency audit, feature minimization, unused endpoints | | Authentication Failures | A07:2021 | `02-authentication-session.md` | Credential storage, TBA security, session fixation, cookie attrs | | Software and Data Integrity Failures | A08:2021 | `06-cryptography-data-protection.md` | HMAC verification, webhook signatures, data-at-rest encryption | | Security Logging and Monitoring Failures | A09:2021 | `10-logging-monitoring.md` | What to log, what not to log, log injection, audit trails | | SSRF | A10:2021 | `08-api-restlet-security.md` | URL allowlists, protocol validation, internal network protection | **Appendices Providing Additional Depth:** | Appendix | File | Covers | |----------|------|--------| | AI Agent Security | `references/appendices/appendix-ai-agent-security.md` | Prompt injection, tool poisoning, over-permissioned agents | | CSP Header Templates | `references/appendices/appendix-csp-header-templates.md` | Ready-to-use CSP strings, nonce-based templates, NS-specific | | Security Checklist | `references/appendices/appendix-security-checklist.md` | Phase-organized verification items with severity indicators | | SuiteScript Security Patterns | `references/appendices/appendix-suitescript-security-patterns.md` | Copy-paste boilerplate for RESTlets, Suitelets, UE scripts | --- ## 6. DRY Principles for Security Repeating security logic across scripts is a maintenance hazard and a source of inconsistency. Apply these DRY principles to your security code. ### 6.1 Centralized Validation Module Create a single validation module that all scripts import. When a validation rule changes, it changes in one place. ```javascript /** * Shared validation utilities. * * @NApiVersion 2.1 * @NModuleScope Public * @module ./lib/SecurityValidation */ define(['N/error'], (error) => { /** * Validate that a value is a positive integer. * @param {*} val - The value to validate. * @param {string} fieldName - The field name for error messages. * @returns {number} The parsed integer. */ const requirePositiveInt = (val, fieldName) => { const n = parseInt(val, 10); if (isNaN(n) || n < 1) { throw error.create({ name: 'INVALID_INPUT', message: `${fieldName} must be a positive integer.`, notifyOff: true }); } return n; }; /** * Validate that a value is one of an allowed set. * @param {*} val - The value to validate. * @param {Array} allowed - The allowed values. * @param {string} fieldName - The field name for error messages. * @returns {*} The validated value. */ const requireEnum = (val, allowed, fieldName) => { if (!allowed.includes(val)) { throw error.create({ name: 'INVALID_INPUT', message: `${fieldName} must be one of: ${allowed.join(', ')}`, notifyOff: true }); } return val; }; /** * Validate that a string matches an alphanumeric pattern. * Use for structured identifiers, codes, and keys. * @param {string} val - The value to validate. * @param {string} fieldName - The field name for error messages. * @param {number} [maxLength=200] - Maximum allowed length. * @returns {string} The validated string. */ const requireAlphanumeric = (val, fieldName, maxLength) => { maxLength = maxLength || 200; if (typeof val !== 'string' || val.length === 0 || val.length > maxLength) { throw error.create({ name: 'INVALID_INPUT', message: `${fieldName} must be a non-empty string up to ${maxLength} characters.`, notifyOff: true }); } if (!/^[a-zA-Z0-9_-]+$/.test(val)) { throw error.create({ name: 'INVALID_INPUT', message: `${fieldName} contains disallowed characters. Only alphanumeric, hyphens, and underscores are permitted.`, notifyOff: true }); } return val; }; /** * Sanitize a string for safe inclusion in HTML body context. * Encodes the five critical HTML characters as entities. * @param {*} val - The value to sanitize. * @returns {string} The HTML-safe string. */ const sanitizeHtml = (val) => { if (val == null) return ''; return String(val) .replace(/&/g, '&amp;') .replace(/</g, '&lt;') .replace(/>/g, '&gt;') .replace(/"/g, '&quot;') .replace(/'/g, '&#x27;'); }; /** * Sanitize a value for safe inclusion in log messages. * Strips newlines, control characters, and truncates. * @param {*} val - The value to sanitize. * @param {number} [maxLength=500] - Maximum output length. * @returns {string} The log-safe string. */ const sanitizeForLog = (val) => { return String(val) .replace(/[\r\n]/g, ' ') .replace(/[\x00-\x1F]/g, '') .substring(0, 500); }; return { requirePositiveInt, requireEnum, requireAlphanumeric, sanitizeHtml, sanitizeForLog }; }); ``` ### 6.2 Shared Encoding Module See example 13 in `03-xss-output-encoding.md` for the full five-context encoding module. Import it everywhere that output is rendered: ```javascript define(['./lib/encoding', './lib/SecurityValidation'], (enc, validate) => { // enc.forHtml(), enc.forAttribute(), enc.forJavaScript(), enc.forUrl(), enc.forCss() // validate.requirePositiveInt(), validate.sanitizeHtml(), etc. }); ``` ### 6.3 Single Source of Truth for Security Configuration Store security-relevant configuration in a single place per project: ```javascript /** * Security configuration constants. * * @NApiVersion 2.1 * @NModuleScope Public * @module ./lib/SecurityConfig */ define([], () => { return Object.freeze({