@sun-asterisk/sunlint 1.3.18 → 1.3.20

package/config/rules/enhanced-rules-registry.json

@@ -870,6 +870,23 @@
       "status": "stable",
       "tags": ["security", "secrets", "hardcoded"]
     },
+    "S028": {
+      "name": "Limit upload file size and number of files per user",
+      "description": "File uploads must enforce size limits and file quantity limits to prevent resource exhaustion and DoS attacks. Both file size and number of files should be limited at the server-side.",
+      "category": "security",
+      "severity": "error",
+      "languages": ["typescript", "javascript", "java"],
+      "analyzer": "./rules/security/S028_file_upload_size_limits/analyzer.js",
+      "version": "1.0.0",
+      "status": "stable",
+      "tags": [
+        "security",
+        "file-upload",
+        "dos-prevention",
+        "resource-limits",
+        "owasp"
+      ]
+    },
     "S029": {
       "name": "Require CSRF Protection",
       "description": "Require CSRF protection for state-changing operations",
@@ -1079,16 +1096,27 @@
       }
     },
     "S041": {
-      "name": "Require Session Invalidate on Logout",
-      "description": "Require session invalidation on logout",
+      "name": "Session Tokens must be invalidated after logout or expiration",
+      "description": "Session tokens must be properly invalidated after logout or expiration to prevent session hijacking and unauthorized access. This includes clearing session data, invalidating JWT tokens, and ensuring proper session cleanup.",
       "category": "security",
       "severity": "error",
       "languages": ["typescript", "javascript"],
-      "analyzer": "eslint",
-      "eslintRule": "custom/typescript_s041",
+      "analyzer": "./rules/security/S041_session_token_invalidation/analyzer.js",
+      "config": "./rules/security/S041_session_token_invalidation/config.json",
       "version": "1.0.0",
       "status": "stable",
-      "tags": ["security", "session", "logout"]
+      "tags": ["security", "session", "token", "logout", "invalidation", "owasp"],
+      "strategy": {
+        "preferred": "ast",
+        "fallbacks": ["ast", "regex"],
+        "accuracy": {
+          "ast": 95,
+          "regex": 85
+        }
+      },
+      "engineMappings": {
+        "heuristic": ["rules/security/S041_session_token_invalidation/analyzer.js"]
+      }
     },
     "S042": {
       "name": "Require Periodic Reauthentication",
@@ -1115,28 +1143,49 @@
       "tags": ["security", "session", "password"]
     },
     "S044": {
-      "name": "Require Full Session for Sensitive Operations",
-      "description": "Require full session validation for sensitive operations",
+      "name": "Re-authentication Required for Sensitive Operations",
+      "description": "Require re-authentication before performing sensitive operations such as password changes, email changes, profile updates, and other critical account modifications. This prevents unauthorized access to sensitive account functions even if a session is compromised.",
       "category": "security",
       "severity": "error",
       "languages": ["typescript", "javascript"],
-      "analyzer": "eslint",
-      "eslintRule": "custom/typescript_s044",
+      "analyzer": "./rules/security/S044_re_authentication_required/analyzer.js",
+      "config": "./rules/security/S044_re_authentication_required/config.json",
       "version": "1.0.0",
       "status": "stable",
-      "tags": ["security", "session", "validation"]
+      "tags": ["security", "authentication", "re-authentication", "sensitive-operations", "owasp"],
+      "strategy": {
+        "preferred": "ast",
+        "fallbacks": ["ast", "regex"],
+        "accuracy": {
+          "ast": 95,
+          "regex": 85
+        }
+      },
+      "engineMappings": {
+        "heuristic": ["rules/security/S044_re_authentication_required/analyzer.js"]
+      }
     },
     "S045": {
-      "name": "Anti Automation Controls",
-      "description": "Implement anti-automation controls",
+      "name": "Brute-force Protection",
+      "description": "Implement protection against brute-force attacks on authentication endpoints. This rule detects missing rate limiting, account lockout mechanisms, and other brute-force protection measures in authentication flows.",
       "category": "security",
-      "severity": "warning",
+      "severity": "error",
       "languages": ["typescript", "javascript"],
-      "analyzer": "eslint",
-      "eslintRule": "custom/typescript_s045",
+      "analyzer": "./rules/security/S045_brute_force_protection/analyzer.js",
+      "config": "./rules/security/S045_brute_force_protection/config.json",
       "version": "1.0.0",
       "status": "stable",
-      "tags": ["security", "automation", "protection"]
+      "tags": ["security", "authentication", "brute-force", "rate-limiting", "owasp"],
+      "strategy": {
+        "preferred": "heuristic",
+        "fallbacks": ["heuristic"],
+        "accuracy": {
+          "heuristic": 95
+        }
+      },
+      "engineMappings": {
+        "heuristic": "rules/security/S045_brute_force_protection/analyzer.js"
+      }
     },
     "S046": {
       "name": "Secure Notification on Auth Change",
@@ -1239,8 +1288,16 @@
       "name": "One Behavior per Test (AAA Pattern)",
       "description": "Enforce single behavior testing - each test should verify exactly one action/behavior with clear Arrange-Act-Assert structure",
       "category": "common",
-      "severity": "warning", 
-      "languages": ["typescript", "javascript", "java", "csharp", "swift", "kotlin", "python"],
+      "severity": "warning",
+      "languages": [
+        "typescript",
+        "javascript",
+        "java",
+        "csharp",
+        "swift",
+        "kotlin",
+        "python"
+      ],
       "analyzer": "./rules/common/C065_one_behavior_per_test/analyzer.js",
       "config": "./rules/common/C065_one_behavior_per_test/config.json",
       "version": "1.0.0",
@@ -1451,6 +1508,8 @@
       "category": "general",
       "severity": "warning",
       "languages": ["typescript", "javascript"],
+      "analyzer": "./rules/common/C017_constructor_logic/analyzer.js",
+      "config": "./rules/common/C017_constructor_logic/config.json",
       "version": "1.0.0",
       "status": "migrated",
       "tags": ["migrated"],

package/core/cli-program.js

@@ -36,7 +36,8 @@ function createCliProgram() {
     .option('-o, --output <file>', 'Output file path')
     .option('--output-summary <file>', 'Output summary report file path (JSON format for CI/CD)')
     .option('--upload-report [url]', 'Upload summary report to API endpoint after analysis (default: Sun* Coding Standards API)')
-    .option('--config <file>', 'Configuration file path (default: auto-discover)');
+    .option('--config <file>', 'Configuration file path (default: auto-discover)')
+    .option('--github-annotate [mode]', 'Annotate GitHub PR: annotate (inline), summary (comment), all (both) - default: all');
 
   // File targeting options
   program
@@ -134,6 +135,13 @@ CI/CD Integration:
   $ sunlint --all --output-summary=report.json --upload-report
   $ sunlint --all --output-summary=report.json --upload-report=https://custom-api.com/reports
 
+GitHub Actions Integration:
+  $ sunlint --all --input=src --github-annotate                       # Both inline + summary (default)
+  $ sunlint --all --input=src --github-annotate=annotate              # Inline comments only
+  $ sunlint --all --input=src --github-annotate=summary               # Summary comment only
+  $ sunlint --all --input=src --github-annotate=all                   # Both inline + summary
+  $ sunlint --all --changed-files --github-annotate                   # With changed files
+
 ESLint Integration:
   $ sunlint --typescript --eslint-integration --input=src
   $ sunlint --all --eslint-integration --eslint-merge-rules --input=src