rules-cloudflare

RISK (CWE-942): combining Access-Control-Allow-Origin: * with Access-Control-Allow-Credentials: true is rejected by browsers (spec §3.2.5) AND creates a credential-forwarding vulnerability on pre-ES2022 environments and proxies that do not enforce the restriction. FIX: set Access-Control-Allow-Origin to the specific requesting origin (echo the Origin header after allowlist validation) whenever credentials are included.

RISK (CWE-89): D1 .prepare() called with string concatenation — concatenating a variable into the SQL string enables SQL injection regardless of value source. FIX: use parameterized ? placeholders and pass values through .bind(...args).

RISK (CWE-89): D1 .prepare() called with a template literal containing a \${} interpolation — any user-controlled value injected here is a SQL injection. FIX: move every variable into a .bind() placeholder instead: db.prepare('SELECT … WHERE id = ?').bind(id)

RISK (CWE-20): Durable Object storage.put() called with a value that appears to come directly from request body without intermediate validation. Unvalidated DO state can corrupt object invariants, inflate storage unboundedly, or enable mass-assignment attacks. FIX: validate and type-assert the parsed body (check field types, lengths, allowed values) before passing it to storage.put(); reject unexpected keys.

RISK (CWE-798): a secret, token, or API key appears to be hardcoded in Worker source — it will be visible in the deployed bundle, wrangler tail, and any VCS commit. FIX: move secrets to the Cloudflare Secrets Store (wrangler secret put) or sigmashake-vault; read at runtime via env.SECRET_NAME or the vault binding.

RISK (CWE-79 XSS): interpolating request-derived values directly into an HTML Response body enables reflected XSS. FIX: HTML-escape all user input before embedding in HTML — replace <, >, &, ", ' with their HTML entities; prefer c.json() for API responses; use a templating function that auto-escapes (e.g. the layout helpers in sigmashake-hub/src/views/).

RISK (CWE-352): a route registered with app.all() or app.any() performs a mutating D1/KV/R2 write — any HTTP method (including GET, which browsers follow from <img src=...> or navigation) will execute the mutation. FIX: register mutating routes on app.post() / app.patch() / app.put() / app.delete() explicitly, and add requireAuth() middleware.

RISK (CWE-95): eval() in a Cloudflare Worker executes arbitrary code and is blocked by Cloudflare's V8 isolate security policy — it will throw at runtime AND introduces RCE if any argument derives from user input. FIX: eliminate eval(); if you need dynamic dispatch use a lookup table or safe template engine.

RISK (CWE-639): KV/R2 key built directly from a request parameter — an attacker can craft arbitrary keys to enumerate other users' data, overwrite rate-limit counters, or delete critical KV entries (e.g. rate-limit keys by setting them to 'admin:token:<victim>'). FIX: normalise and validate the key components against an allowlist pattern before constructing the KV key; prefix user-scoped keys with a verified user ID.

RISK: logging Authorization, Cookie, or internal-secret headers writes bearer tokens and session IDs to Cloudflare Workers tail logs, which can be accessed by any org member with wrangler tail permission. FIX: redact sensitive headers before logging — log only the header name and a boolean indicating presence, never the value.

RISK (CWE-95): new Function() constructs and executes code from a string — equivalent to eval() for security purposes. Cloudflare Workers restrict dynamic code evaluation; this will throw at runtime and is an RCE vector if any argument is user-controlled. FIX: replace with a static function map or proper module import.

RISK: a variable holding a secret resolved from env is passed to console.log/error. This writes the secret value into Cloudflare Workers logs (wrangler tail), which are visible to any account member. FIX: never log secret values; log only a redacted marker like '[SECRET_NAME: set]'.

RISK (CWE-918 SSRF): fetch() is called with a URL built via template-literal interpolation — if any interpolated value comes from a request (path param, query string, body) an attacker can redirect the request to an internal endpoint. FIX: extract the hostname from a compile-time constant and only allow the path segment from user input after URL-encoding and validation.

RISK (CWE-918 SSRF): fetch() called with a variable whose name suggests it originates from a request or user input. An attacker can reach internal Cloudflare metadata (169.254.169.254), service bindings, or internal Workers. FIX: validate the URL against an explicit allowlist of trusted hostnames before fetching; never pass a user-supplied URL directly to fetch().

RISK (CWE-522): sensitive values in wrangler [vars] are stored as plaintext in the Cloudflare dashboard and visible to anyone with the account:read permission. FIX: use [[secrets_store_secrets]] (Cloudflare Secrets Store) or the vault service binding for all secret values; only non-sensitive configuration belongs in [vars].

Using 'flexible' SSL encrypts traffic between the user and Cloudflare, but sends traffic in plain text between Cloudflare and your origin server. Use 'full' or 'strict' to ensure end-to-end encryption.

Leaving WAF rules in 'log' mode indefinitely provides no active protection against attacks. It is recommended to use 'block' or 'managed_challenge' after testing.

Declaring mutable global variables (using 'let') outside of the request handler in a Cloudflare Worker can lead to cross-request data leaks, as isolates are reused across requests.

Using Math.random() in a Cloudflare Worker for security-sensitive operations (like token generation) is unsafe. Use crypto.getRandomValues() instead.