@sun-asterisk/sunlint 1.2.2 → 1.3.1

package/config/release.json

@@ -0,0 +1,70 @@
+{
+  "name": "Release Validation Configuration",
+  "description": "Comprehensive analysis for release validation", 
+  
+  "performance": {
+    "maxSemanticFiles": -1,
+    "maxConcurrentRules": 8,
+    "timeoutMs": 300000
+  },
+  
+  "input": ["."],
+  
+  "include": [
+    "src/**/*.ts",
+    "src/**/*.js",
+    "lib/**/*.ts",
+    "app/**/*.ts",
+    "packages/*/src/**/*.ts"
+  ],
+  
+  "exclude": [
+    "node_modules/**",
+    "dist/**",
+    "build/**",
+    "coverage/**",
+    "**/*.min.*",
+    "**/*.bundle.*"
+  ],
+  
+  "rules": {
+    "enabled": "all"
+  },
+  
+  "output": {
+    "format": "detailed",
+    "console": true,
+    "summary": true,
+    "includeContext": true,
+    "showFixSuggestions": true,
+    "output": "release-validation-report.json"
+  },
+  
+  "engines": {
+    "semantic": {
+      "enabled": true,
+      "fileLimit": -1,
+      "enableCaching": true,
+      "crossFileAnalysis": true
+    },
+    "ai": {
+      "enabled": true,
+      "provider": "openai",
+      "model": "gpt-4o-mini"
+    }
+  },
+  
+  "reporting": {
+    "baseline": {
+      "enabled": true,
+      "file": "release-baseline.json",
+      "compareWithPrevious": true
+    },
+    "trends": {
+      "enabled": true,
+      "historyFile": "release-trends.json"
+    },
+    "failOnNewViolations": true,
+    "exitOnError": true
+  }
+}

package/config/rule-analysis-strategies.js

@@ -22,9 +22,10 @@ module.exports = {
       accuracy: { ast: 95, regex: 85 }
     },
     'C017': {
-      reason: 'Constructor logic analysis needs AST context',
-      methods: ['ast', 'regex'],
-      accuracy: { ast: 90, regex: 70 }
+      reason: 'Constructor logic analysis needs semantic context - Phase 2 with symbol-based analysis',
+      methods: ['semantic', 'ast', 'regex'],
+      accuracy: { semantic: 95, ast: 85, regex: 70 },
+      strategy: 'semantic-primary'
     },
     'S015': {
       reason: 'TLS certificate validation requires AST context analysis',
@@ -65,6 +66,24 @@ module.exports = {
       strategy: 'ast-primary-regex-fallback',
       accuracy: { ast: 90, regex: 75, combined: 95 }
     },
+    'C035': {
+      reason: 'Error logging context requires symbol-based + regex analysis',
+      methods: ['semantic', 'regex'],
+      strategy: 'semantic-primary-regex-fallback',
+      accuracy: { semantic: 90, regex: 70, combined: 95 }
+    },
+    'C040': {
+      reason: 'Validation centralization requires project-wide symbol analysis + data flow tracking',
+      methods: ['semantic', 'regex'],
+      strategy: 'semantic-primary-regex-fallback',
+      accuracy: { semantic: 95, regex: 75, combined: 97 }
+    },
+    'C076': {
+      reason: 'Public API type enforcement requires symbol-based analysis for export boundaries',
+      methods: ['semantic'],
+      strategy: 'semantic-primary',
+      accuracy: { semantic: 95 }
+    },
     'C041': {
       reason: 'Hardcoded secrets need AST literal analysis like ESLint',
       methods: ['ast', 'regex'],
@@ -87,4 +106,4 @@ module.exports = {
       strategy: 'progressive-enhancement'
     }
   }
-};
+};

package/config/rules/S027-categories.json

@@ -0,0 +1,122 @@
+{
+  "S027": {
+    "categories": [
+      {
+        "name": "AWS Credentials",
+        "severity": "critical",
+        "description": "AWS access keys, secret keys, and session tokens",
+        "patterns": [
+          "AKIA[0-9A-Z]{16}",
+          "(?i)aws[-_]?(secret[-_]?access[-_]?key|access[-_]?key[-_]?id)[\\s:=]+[\"']?[A-Za-z0-9\\/+=]{20,40}[\"']?",
+          "(?i)aws[-_]?session[-_]?token[\\s:=]+[\"']?[A-Za-z0-9\\/+=]{100,}[\"']?"
+        ],
+        "exclude_patterns": [
+          "(?i)(test|mock|fake|example|demo)[-_]?aws",
+          "AWS_REGION|AWS_DEFAULT_REGION"
+        ]
+      },
+      {
+        "name": "JWT & Authentication Tokens",
+        "severity": "critical", 
+        "description": "JWT tokens and authentication credentials",
+        "patterns": [
+          "eyJ[A-Za-z0-9\\-_=]+\\.[A-Za-z0-9\\-_=]+\\.?[A-Za-z0-9\\-_.+/=]*",
+          "(?i)(jwt|bearer|auth)[-_]?(token|secret)[\\s:=]+[\"']?[a-zA-Z0-9\\-_=]{20,}[\"']?",
+          "(?i)authorization[\\s:=]+[\"']?(bearer|basic)[\\s]+[a-zA-Z0-9\\-_=]{10,}[\"']?"
+        ]
+      },
+      {
+        "name": "API Keys & Secrets",
+        "severity": "high",
+        "description": "Generic API keys and secret tokens",
+        "patterns": [
+          "(?i)(api[-_]?key|secret[-_]?key|access[-_]?token)[\\s:=]+[\"']?[a-zA-Z0-9\\-_=]{16,}[\"']?",
+          "(?i)(client[-_]?secret|app[-_]?secret)[\\s:=]+[\"']?[a-zA-Z0-9\\-_=]{20,}[\"']?",
+          "(?i)(private[-_]?key|encryption[-_]?key)[\\s:=]+[\"']?[a-zA-Z0-9\\-_=]{20,}[\"']?"
+        ],
+        "exclude_patterns": [
+          "(?i)(display|row|sort|primary|foreign)[-_]?key",
+          "(?i)key(value|path|name|code|id|index)",
+          "^key$"
+        ]
+      },
+      {
+        "name": "Database Credentials", 
+        "severity": "high",
+        "description": "Database connection strings and passwords",
+        "patterns": [
+          "(mongodb|mysql|postgres|redis):\\/\\/[^\\/\\s'\"]+:[^\\/\\s'\"]+@[^\\/\\s'\"]+",
+          "(?i)(db|database)[-_]?(password|pass|pwd|secret)[\\s:=]+[\"']?[a-zA-Z0-9\\-_=]{6,}[\"']?",
+          "(?i)connection[-_]?string[\\s:=]+[\"']?[^\"'\\s]{20,}[\"']?"
+        ]
+      },
+      {
+        "name": "Third-party Service Keys",
+        "severity": "high", 
+        "description": "GitHub, Slack, Stripe and other service tokens",
+        "patterns": [
+          "gh[pousr]_[A-Za-z0-9_]{36}",
+          "xox[baprs]-[A-Za-z0-9-]+",
+          "sk_live_[A-Za-z0-9]{24,}",
+          "(?i)(github|slack|stripe|paypal)[-_]?(token|key|secret)[\\s:=]+[\"']?[a-zA-Z0-9\\-_=]{16,}[\"']?"
+        ]
+      },
+      {
+        "name": "Suspicious Variable Names",
+        "severity": "medium",
+        "description": "Variables with sensitive naming patterns",
+        "patterns": [
+          "(?i)(client|app|service)[-_]?(id|key|token|secret)[\"']?\\s*[:=]\\s*[\"'][A-Za-z0-9\\-_=]{12,}[\"']?",
+          "(?i)(oauth|openid)[-_]?(client[-_]?id|secret)[\\s:=]+[\"']?[a-zA-Z0-9\\-_=]{10,}[\"']?"
+        ],
+        "exclude_patterns": [
+          "(?i)(send|verify|update|register|reset).*password",
+          "(?i)password.*(reset|verify|update|first|time)"
+        ]
+      },
+      {
+        "name": "Base64 Encoded Secrets",
+        "severity": "medium",
+        "description": "Potentially encoded sensitive data",
+        "patterns": [
+          "[A-Za-z0-9+\\/]{64,}={0,2}"
+        ],
+        "exclude_patterns": [
+          "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789",
+          "(?i)(test|demo|example|sample)"
+        ]
+      },
+      {
+        "name": "Environment Variables",
+        "severity": "low",
+        "description": "Public environment variables that might leak info",
+        "patterns": [
+          "NEXT_PUBLIC_[A-Z0-9_]+[\\s:=]+[\"'][^\"']+[\"']",
+          "(?i)react_app_[A-Z0-9_]+[\\s:=]+[\"'][^\"']+[\"']"
+        ],
+        "exclude_patterns": [
+          "NODE_ENV|ENV|ENVIRONMENT|MODE|DEBUG"
+        ]
+      },
+      {
+        "name": "File Path Leaks",
+        "severity": "low", 
+        "description": "Sensitive file patterns",
+        "patterns": [
+          "\\.env(\\..+)?$",
+          "(secrets?|credentials?|private[-_]?keys?)\\.(json|ya?ml|ts|js)$",
+          "id_rsa|id_dsa|\\.pem|\\.p12|\\.pfx$"
+        ]
+      }
+    ],
+    "global_exclude_patterns": [
+      "(?i)(test|mock|fake|dummy|example|demo|sample|placeholder)",
+      "(?i)(localhost|127\\.0\\.0\\.1|development|dev|staging)",
+      "^(true|false|null|undefined|none|empty)$",
+      "\\.(test|spec|mock)\\.",
+      "__tests__|\\/tests?\\/|\\/spec\\/"
+    ],
+    "min_length": 8,
+    "max_length": 1000
+  }
+}