rules-astro

Astro API endpoint does not check the HTTP method. Endpoints that mutate state (POST/PUT/DELETE) must verify the method to prevent cross-site request forgery (CSRF) and unintended GET-triggered side effects. FIX: Check 'request.method' at the top of the handler and return 405 for unexpected methods. For state-mutating routes also validate a CSRF token or require a custom header (e.g. 'X-Requested-With').

Misuse of environment variables in Astro component. 'process.env' is a Node.js global and generally not available or correctly processed in client-side Astro components or islands. For environment variables, use 'import.meta.env' (e.g., 'import.meta.env.PUBLIC_MY_VAR'). Ensure client-side variables are prefixed with 'PUBLIC_' in your '.env' file.

Deprecated API usage: 'Astro.fetchContent()' is no longer recommended. Use 'Astro.glob()' for querying local content files (e.g., Markdown, MDX). 'Astro.glob()' offers better performance and a more consistent API. Example: const posts = await Astro.glob('../pages/**/*.md');

RISK: Hardcoded secret/API key detected in source. Committing credentials to VCS exposes them in git history permanently — the average time-to-exploit for leaked secrets is under 5 minutes (GitGuardian 2025). FIX: Use environment variables (import.meta.env.SECRET_VAR for server-only, PUBLIC_ prefix for client-safe values) and load them at runtime. Never commit secrets.

Insecure link detected: Links with 'target="_blank"' should always include 'rel="noopener noreferrer"' to prevent tabnabbing (reverse tabnabbing) attacks. This prevents the opened page from gaining partial control over the opener page. Add 'rel="noopener noreferrer"' to all such links.

Potential Path Traversal vulnerability detected. Using 'fs' module functions (e.g., readFile, writeFile) with paths derived directly from 'Astro.params' without strict sanitization and validation can allow attackers to access or modify arbitrary files on the server. Always sanitize and validate user-supplied path segments to ensure they stay within intended directories.

RISK: A PUBLIC_ prefixed environment variable name contains a secret-sounding term (SECRET/KEY/TOKEN/PASSWORD/PRIVATE). In Astro, PUBLIC_ variables are embedded in the client bundle and shipped to every browser visitor — they are not secret. FIX: Remove the PUBLIC_ prefix and access the variable only in server-side code (.ts, server API routes, or the frontmatter fence), or rename it to a non-secret purpose.

Potential Cross-Site Scripting (XSS) vulnerability detected. Using 'set:html' with untrusted or unsanitized input can lead to arbitrary code execution in the user's browser. Always sanitize user-generated or external content using a library like 'dompurify' or 'sanitize-html' before injecting it via 'set:html'. Example: <div set:html={DOMPurify.sanitize(userContent)} />