mcpField
B
bitrix-security

bitrix-security

github.com/bxmaximumSecurity47308 installsUpdated 2w ago
Repository

About bitrix-security

bitrix-security is a security guidance skill for Bitrix development, covering request validation, output escaping, SQL, and file-operation risks. It treats inputs as untrusted and calls for checking object permissions in each action.

Key features

  1. 01CSRF and XSS protection guidance
  2. 02SQL injection and SSRF safeguards
  3. 03Secure file uploads and local-file handling
  4. 04Access, REST scope, and crypto rules
  5. 05Validate entity sources and permissions

Use cases

  1. 01Review Bitrix form and output handling
  2. 02Check ORM and raw SQL queries
  3. 03Assess upload, redirect, and SSRF risks
  4. 04Audit REST actions and object permissions

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/bxmaximum/bitrix-framework-skills --skill bitrix-security

After installing, type/bitrix-securityin Claude Code to confirm it loaded.

Bundled files

References and scripts installed along with SKILL.md.

rules/
csrf-xss.md
jwt-crypto-access.md
sql-ssrf.md

Details

From the project README

Security

Baseline: main 23.0+ · Verified: main 26.800.0

General defaults (no superglobals, keep default prefilters, escape output) live in bitrix-framework.

TaskRead
CSRF, escaping, HTML sanitizing, link and redirect targets, raw-HTML sinksrules/csrf-xss.md
SQL injection (raw, ORM, ExpressionField), SSRF, local files, uploads, stored settingsrules/sql-ssrf.md
Rights checks, #[ActionAccess], REST scopes, JWT/JWK, encryption, 2FArules/jwt-crypto-access.md

Invariants

  • Untrusted: request data, and also DB-stored settings, imports, REST payloads. The type and owner of an entity come from its DB record, never from the request.
  • Whitelist whatever becomes SQL structure (field names, operators, functions, order keys), whatever its source.
  • Escape for the output context: HTML htmlspecialcharsbx(), JS Json::encode(), URLs through a scheme allow-list.
  • User input never goes unchecked into CFile::MakeFileArray(), file_get_contents(), unserialize(), redirect targets.
  • Authentication/Csrf filters don't authorize: check rights on the object in every action.

Comments

Markdown supported