@sun-asterisk/sunlint 1.3.26 → 1.3.28

package/config/rules/enhanced-rules-registry.json

@@ -496,16 +496,62 @@
       "tags": ["security", "idor", "access-control"]
     },
     "S003": {
-      "name": "No Unvalidated Redirect",
-      "description": "Prevent unvalidated redirects and forwards",
+      "name": "Open Redirect Protection",
+      "description": "URL redirects must validate against an allow list to prevent open redirect vulnerabilities",
       "category": "security",
       "severity": "error",
       "languages": ["typescript", "javascript"],
-      "analyzer": "eslint",
-      "eslintRule": "custom/typescript_s003",
+      "analyzer": "./rules/security/S003_open_redirect_protection/analyzer.js",
+      "config": "./rules/security/S003_open_redirect_protection/config.json",
       "version": "1.0.0",
       "status": "stable",
-      "tags": ["security", "redirect", "validation"]
+      "tags": ["security", "owasp", "injection", "open-redirect", "phishing", "url-validation"],
+      "strategy": {
+        "preferred": "heuristic",
+        "fallbacks": ["heuristic"],
+        "accuracy": {
+          "heuristic": 95
+        }
+      },
+      "engineMappings": {
+        "heuristic": ["rules/security/S003_open_redirect_protection/analyzer.js"]
+      },
+      "metadata": {
+        "owaspCategory": "A03:2021 - Injection",
+        "cweId": "CWE-601",
+        "frameworks": ["Express", "NestJS", "Next.js", "Nuxt.js", "Spring Boot"],
+        "detectionPatterns": 28,
+        "testCases": 118
+      }
+    },
+    "S004": {
+      "name": "Sensitive Data Logging Protection",
+      "description": "Prevent logging of sensitive information like passwords, tokens, and payment data without proper redaction",
+      "category": "security",
+      "severity": "warning",
+      "languages": ["typescript", "javascript"],
+      "analyzer": "./rules/security/S004_sensitive_data_logging/analyzer.js",
+      "config": "./rules/security/S004_sensitive_data_logging/config.json",
+      "version": "1.0.0",
+      "status": "stable",
+      "tags": ["security", "owasp", "logging", "sensitive-data", "pii", "credentials", "data-exposure"],
+      "strategy": {
+        "preferred": "heuristic",
+        "fallbacks": ["heuristic"],
+        "accuracy": {
+          "heuristic": 90
+        }
+      },
+      "engineMappings": {
+        "heuristic": ["rules/security/S004_sensitive_data_logging/analyzer.js"]
+      },
+      "metadata": {
+        "owaspCategory": "A09:2021 - Security Logging and Monitoring Failures",
+        "cweId": "CWE-532",
+        "frameworks": ["Express", "NestJS", "Next.js", "Nuxt.js", "Spring Boot", "Winston", "Pino", "Bunyan"],
+        "detectionPatterns": 90,
+        "testCases": 45
+      }
     },
     "S005": {
       "name": "No Origin Header Authentication",
@@ -636,16 +682,34 @@
       "tags": ["security", "uuid", "random"]
     },
     "S012": {
-      "name": "No Hardcoded Secrets",
-      "description": "Prevent hardcoded secrets in source code",
+      "name": "Hardcoded Secrets Protection",
+      "description": "Detects hardcoded secrets, API keys, passwords, tokens, and credentials in source code to prevent accidental exposure through version control",
       "category": "security",
       "severity": "error",
       "languages": ["typescript", "javascript"],
-      "analyzer": "eslint",
-      "eslintRule": "custom/typescript_s012",
+      "analyzer": "./rules/security/S012_hardcoded_secrets/analyzer.js",
+      "config": "./rules/security/S012_hardcoded_secrets/config.json",
       "version": "1.0.0",
       "status": "stable",
-      "tags": ["security", "secrets", "hardcoded"]
+      "tags": ["security", "owasp", "secrets", "credentials", "cryptographic-failures", "hardcoded-secrets", "api-keys", "passwords", "tokens"],
+      "strategy": {
+        "preferred": "heuristic",
+        "fallbacks": ["heuristic"],
+        "accuracy": {
+          "heuristic": 92
+        }
+      },
+      "engineMappings": {
+        "heuristic": ["rules/security/S012_hardcoded_secrets/analyzer.js"]
+      },
+      "metadata": {
+        "owaspCategory": "A02:2021 - Cryptographic Failures",
+        "cweId": "CWE-798",
+        "frameworks": ["Node.js", "Express", "NestJS", "Next.js", "React", "Vue", "Angular"],
+        "secretTypes": ["API Keys", "Passwords", "Access Tokens", "Private Keys", "JWT Secrets", "Database Credentials", "OAuth Secrets", "AWS Keys", "GitHub Tokens", "Slack Tokens"],
+        "detectionPatterns": 50,
+        "testCases": 30
+      }
     },
     "S013": {
       "name": "Verify TLS Connection",
@@ -736,16 +800,34 @@
       "tags": ["security", "validation", "input"]
     },
     "S019": {
-      "name": "No Raw User Input in Email",
-      "description": "Prevent raw user input in email content",
+      "name": "SMTP Injection Protection",
+      "description": "Detects potential SMTP/IMAP injection vulnerabilities by identifying unsanitized user input in email fields and direct SMTP protocol manipulation",
       "category": "security",
       "severity": "error",
       "languages": ["typescript", "javascript"],
-      "analyzer": "eslint",
-      "eslintRule": "custom/typescript_s019",
+      "analyzer": "./rules/security/S019_smtp_injection_protection/analyzer.js",
+      "config": "./rules/security/S019_smtp_injection_protection/config.json",
       "version": "1.0.0",
       "status": "stable",
-      "tags": ["security", "email", "injection"]
+      "tags": ["security", "owasp", "injection", "smtp", "email", "crlf"],
+      "strategy": {
+        "preferred": "heuristic",
+        "fallbacks": ["heuristic"],
+        "accuracy": {
+          "heuristic": 90
+        }
+      },
+      "engineMappings": {
+        "heuristic": ["rules/security/S019_smtp_injection_protection/analyzer.js"]
+      },
+      "metadata": {
+        "owaspCategory": "A03:2021 - Injection",
+        "cweId": "CWE-93, CWE-144",
+        "frameworks": ["Node.js", "Express", "NestJS", "Next.js"],
+        "emailLibraries": ["nodemailer", "sendgrid", "mailgun", "aws-ses", "postmark"],
+        "detectionTypes": ["Unsanitized email fields", "SMTP command injection", "CRLF injection"],
+        "testCases": 40
+      }
     },
     "S020": {
       "name": "Avoid using eval() or executing dynamic code",
@@ -1156,7 +1238,8 @@
       "category": "security",
       "severity": "error",
       "languages": ["typescript", "javascript"],
-      "analyzer": "eslint",
+      "analyzer": "./rules/security/S042_require_re_authentication_for_long_lived/analyzer.js",
+      "config": "./rules/security/S042_require_re_authentication_for_long_lived/config.json",
       "eslintRule": "custom/typescript_s042",
       "version": "1.0.0",
       "status": "stable",
@@ -1168,7 +1251,8 @@
       "category": "security",
       "severity": "error",
       "languages": ["typescript", "javascript"],
-      "analyzer": "eslint",
+      "analyzer": "./rules/security/S043_password_changes_invalidate_all_sessions/analyzer.js",
+      "config": "./rules/security/S043_password_changes_invalidate_all_sessions/config.json",
       "eslintRule": "custom/typescript_s043",
       "version": "1.0.0",
       "status": "stable",

package/config/rules/rules-registry-generated.json

@@ -3569,8 +3569,8 @@
       "languages": [
         "All languages"
       ],
-      "version": "1.0",
-      "status": "activated",
+      "version": "1.1",
+      "status": "draft",
       "tags": [
         "Common",
         "readability",
@@ -3596,8 +3596,8 @@
       "languages": [
         "All languages"
       ],
-      "version": "1.0",
-      "status": "activated",
+      "version": "1.1",
+      "status": "draft",
       "tags": [
         "Common",
         "readability",
@@ -3755,8 +3755,8 @@
       "languages": [
         "All languages"
       ],
-      "version": "1.0",
-      "status": "activated",
+      "version": "1.1",
+      "status": "draft",
       "tags": [
         "Common",
         "readability",
@@ -4029,8 +4029,8 @@
       "languages": [
         "All languages"
       ],
-      "version": "1.0",
-      "status": "activated",
+      "version": "1.1",
+      "status": "draft",
       "tags": [
         "Common",
         "readability",
@@ -4107,8 +4107,8 @@
       "languages": [
         "All languages"
       ],
-      "version": "1.0",
-      "status": "activated",
+      "version": "1.1",
+      "status": "draft",
       "tags": [
         "Common",
         "readability",
@@ -4194,8 +4194,8 @@
       "languages": [
         "All languages"
       ],
-      "version": "1.0.0",
-      "status": "draft",
+      "version": "1.1",
+      "status": "activated",
       "tags": [
         "Common",
         "readability",
@@ -4583,8 +4583,8 @@
       "languages": [
         "All languages"
       ],
-      "version": "1.0.0",
-      "status": "draft",
+      "version": "1.1",
+      "status": "activated",
       "tags": [
         "Common",
         "readability",
@@ -4638,8 +4638,8 @@
       "languages": [
         "All languages"
       ],
-      "version": "1.0",
-      "status": "activated",
+      "version": "1.1",
+      "status": "draft",
       "tags": [
         "Common",
         "readability",
@@ -4721,8 +4721,8 @@
       "languages": [
         "All languages"
       ],
-      "version": "1.0",
-      "status": "activated",
+      "version": "1.1",
+      "status": "draft",
       "tags": [
         "Common",
         "readability",
@@ -4802,8 +4802,8 @@
       "languages": [
         "All languages"
       ],
-      "version": "1.0",
-      "status": "activated",
+      "version": "1.1",
+      "status": "draft",
       "tags": [
         "Common",
         "readability",
@@ -5147,8 +5147,8 @@
       "languages": [
         "All languages"
       ],
-      "version": "1.0",
-      "status": "activated",
+      "version": "1.1",
+      "status": "draft",
       "tags": [
         "Common",
         "readability",