@sun-asterisk/sunlint 1.3.26 → 1.3.28

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (69) hide show
  1. package/config/rules/enhanced-rules-registry.json +101 -17
  2. package/config/rules/rules-registry-generated.json +22 -22
  3. package/origin-rules/security-en.md +351 -338
  4. package/package.json +1 -1
  5. package/rules/common/C003_no_vague_abbreviations/analyzer.js +73 -21
  6. package/rules/common/C017_constructor_logic/symbol-based-analyzer.js +206 -2
  7. package/rules/common/C024_no_scatter_hardcoded_constants/symbol-based-analyzer.js +553 -58
  8. package/rules/common/C029_catch_block_logging/analyzer.js +47 -12
  9. package/rules/common/C033_separate_service_repository/symbol-based-analyzer.js +35 -15
  10. package/rules/common/C041_no_sensitive_hardcode/symbol-based-analyzer.js +9 -5
  11. package/rules/security/S003_open_redirect_protection/README.md +371 -0
  12. package/rules/security/S003_open_redirect_protection/analyzer.js +135 -0
  13. package/rules/security/S003_open_redirect_protection/config.json +58 -0
  14. package/rules/security/S003_open_redirect_protection/symbol-based-analyzer.js +884 -0
  15. package/rules/security/S004_sensitive_data_logging/analyzer.js +135 -0
  16. package/rules/security/S004_sensitive_data_logging/config.json +62 -0
  17. package/rules/security/S004_sensitive_data_logging/symbol-based-analyzer.js +592 -0
  18. package/rules/security/S005_no_origin_auth/analyzer.js +97 -148
  19. package/rules/security/S005_no_origin_auth/config.json +28 -67
  20. package/rules/security/S005_no_origin_auth/symbol-based-analyzer.js +708 -0
  21. package/rules/security/S006_no_plaintext_recovery_codes/symbol-based-analyzer.js +170 -31
  22. package/rules/security/S010_no_insecure_encryption/analyzer.js +8 -2
  23. package/rules/security/S012_hardcoded_secrets/analyzer.js +149 -0
  24. package/rules/security/S012_hardcoded_secrets/config.json +75 -0
  25. package/rules/security/S012_hardcoded_secrets/symbol-based-analyzer.js +1204 -0
  26. package/rules/security/S013_tls_enforcement/symbol-based-analyzer.js +87 -0
  27. package/rules/security/S017_use_parameterized_queries/analyzer.js +11 -78
  28. package/rules/security/S017_use_parameterized_queries/symbol-based-analyzer.js +1146 -1
  29. package/rules/security/S019_smtp_injection_protection/analyzer.js +120 -0
  30. package/rules/security/S019_smtp_injection_protection/config.json +35 -0
  31. package/rules/security/S019_smtp_injection_protection/symbol-based-analyzer.js +687 -0
  32. package/rules/security/S020_no_eval_dynamic_code/analyzer.js +55 -130
  33. package/rules/security/S020_no_eval_dynamic_code/symbol-based-analyzer.js +4 -19
  34. package/rules/security/S022_escape_output_context/README.md +254 -0
  35. package/rules/security/S022_escape_output_context/analyzer.js +510 -0
  36. package/rules/security/S022_escape_output_context/config.json +229 -0
  37. package/rules/security/S023_no_json_injection/analyzer.js +15 -0
  38. package/rules/security/S023_no_json_injection/ast-analyzer.js +18 -3
  39. package/rules/security/S023_no_json_injection/config.json +133 -0
  40. package/rules/security/S024_xpath_xxe_protection/regex-based-analyzer.js +41 -0
  41. package/rules/security/S027_no_hardcoded_secrets/analyzer.js +67 -8
  42. package/rules/security/S027_no_hardcoded_secrets/categorized-analyzer.js +29 -6
  43. package/rules/security/S029_csrf_protection/config.json +127 -0
  44. package/rules/security/S030_directory_browsing_protection/regex-based-analyzer.js +160 -28
  45. package/rules/security/S030_directory_browsing_protection/symbol-based-analyzer.js +81 -19
  46. package/rules/security/S031_secure_session_cookies/analyzer.js +20 -2
  47. package/rules/security/S031_secure_session_cookies/regex-based-analyzer.js +100 -0
  48. package/rules/security/S031_secure_session_cookies/symbol-based-analyzer.js +8 -1
  49. package/rules/security/S032_httponly_session_cookies/analyzer.js +2 -2
  50. package/rules/security/S032_httponly_session_cookies/regex-based-analyzer.js +115 -0
  51. package/rules/security/S032_httponly_session_cookies/symbol-based-analyzer.js +39 -10
  52. package/rules/security/S036_lfi_rfi_protection/analyzer.js +224 -0
  53. package/rules/security/S036_lfi_rfi_protection/config.json +20 -0
  54. package/rules/security/S040_session_fixation_protection/analyzer.js +153 -0
  55. package/rules/security/S040_session_fixation_protection/config.json +20 -0
  56. package/rules/security/S042_require_re_authentication_for_long_lived/README.md +83 -0
  57. package/rules/security/S042_require_re_authentication_for_long_lived/analyzer.js +153 -0
  58. package/rules/security/S042_require_re_authentication_for_long_lived/config.json +41 -0
  59. package/rules/security/S042_require_re_authentication_for_long_lived/symbol-based-analyzer.js +1139 -0
  60. package/rules/security/S043_password_changes_invalidate_all_sessions/README.md +107 -0
  61. package/rules/security/S043_password_changes_invalidate_all_sessions/analyzer.js +153 -0
  62. package/rules/security/S043_password_changes_invalidate_all_sessions/config.json +41 -0
  63. package/rules/security/S043_password_changes_invalidate_all_sessions/symbol-based-analyzer.js +541 -0
  64. package/docs/COMMAND-EXAMPLES.md +0 -390
  65. package/docs/FILE_LIMITS_COMPLETION_REPORT.md +0 -151
  66. package/docs/FOLDER_STRUCTURE.md +0 -59
  67. package/docs/SIMPLIFIED_USAGE_GUIDE.md +0 -208
  68. package/rules/security/S017_use_parameterized_queries/regex-based-analyzer.js +0 -541
  69. package/rules/security/S020_no_eval_dynamic_code/regex-based-analyzer.js +0 -307
@@ -1,208 +0,0 @@
1
- # 🚀 SunLint Performance - Simplified Usage Guide
2
-
3
- ## 🎯 **TÓM TẮT: 3 Commands Duy Nhất Bạn Cần Biết**
4
-
5
- ### **1. 🏃‍♂️ Quick Start (90% use cases)**
6
- ```bash
7
- sunlint --all --input=src
8
- ```
9
- ✅ **Auto-detects** project size và chọn settings tối ưu
10
- ✅ **Zero configuration** - chỉ cần chỉ định input folder
11
- ✅ **Works everywhere** - small projects đến enterprise
12
-
13
- ### **2. ⚡ Performance Modes (khi cần tùy chỉnh)**
14
- ```bash
15
- # Fast scan (for testing/development)
16
- sunlint --all --input=src --performance=fast
17
-
18
- # Thorough analysis (for CI/CD)
19
- sunlint --all --input=src --performance=careful
20
- ```
21
-
22
- ### **3. 🛠️ Custom Timeout (khi project rất lớn)**
23
- ```bash
24
- sunlint --all --input=src --timeout=120000 # 2 minutes
25
- ```
26
-
27
- ---
28
-
29
- ## 🤖 **Auto Performance Detection**
30
-
31
- SunLint **tự động phát hiện** project size và chọn settings tối ưu:
32
-
33
- | **Project Size** | **Files** | **Auto Settings** | **Timeout** |
34
- |------------------|-----------|-------------------|-------------|
35
- | **Small** | < 100 | Fast analysis | 30s |
36
- | **Medium** | 100-500 | Balanced | 60s |
37
- | **Large** | 500-1000 | Careful + progressive | 120s |
38
- | **Enterprise** | 1000+ | Conservative + streaming | 300s |
39
-
40
- ### **Auto-Detection Logic**
41
- ```bash
42
- # ✅ SunLint tự động:
43
- # - Đếm số files trong input folder
44
- # - Phát hiện TypeScript, Node.js project
45
- # - Chọn timeout và batch size phù hợp
46
- # - Bật progressive results cho large projects
47
-
48
- sunlint --all --input=src # Làm tất cả tự động!
49
- ```
50
-
51
- ---
52
-
53
- ## 📋 **Common Usage Patterns**
54
-
55
- ### **Development (hàng ngày)**
56
- ```bash
57
- # Quick feedback loop
58
- sunlint --rules=C019,C041,S027 --input=src
59
-
60
- # Check specific files
61
- sunlint --all --input=src/components --performance=fast
62
- ```
63
-
64
- ### **Code Review/PR**
65
- ```bash
66
- # Check changed files only
67
- sunlint --all --changed-files
68
-
69
- # Quick but comprehensive
70
- sunlint --all --input=src --performance=fast --verbose
71
- ```
72
-
73
- ### **CI/CD Pipeline**
74
- ```bash
75
- # Thorough analysis with auto-optimization
76
- sunlint --all --input=src --format=json --output=results.json
77
-
78
- # For large projects in CI
79
- sunlint --all --input=src --performance=careful --quiet
80
- ```
81
-
82
- ### **Weekly Code Quality Review**
83
- ```bash
84
- # Full analysis with detailed reporting
85
- sunlint --all --input=src --verbose --format=table
86
- ```
87
-
88
- ---
89
-
90
- ## 🚨 **Troubleshooting Simplified**
91
-
92
- ### **❌ Getting Timeouts?**
93
- ```bash
94
- # Try longer timeout
95
- sunlint --all --input=src --timeout=120000
96
-
97
- # Or limit files
98
- sunlint --all --input=src --max-files=500
99
- ```
100
-
101
- ### **❌ Taking Too Long?**
102
- ```bash
103
- # Use fast mode
104
- sunlint --all --input=src --performance=fast
105
-
106
- # Or check specific rules
107
- sunlint --rules=C002,C019,S027 --input=src
108
- ```
109
-
110
- ### **❌ Memory Issues?**
111
- ```bash
112
- # Automatic handling - just use auto mode
113
- sunlint --all --input=src --performance=auto
114
- ```
115
-
116
- ---
117
-
118
- ## 🎛️ **Migration from Complex Commands**
119
-
120
- ### **BEFORE (v3.x - Complex)**
121
- ```bash
122
- # ❌ Too many options to remember
123
- sunlint --all --input=src \
124
- --performance-profile=balanced \
125
- --adaptive-timeout \
126
- --max-memory=2GB \
127
- --batch-size=10 \
128
- --progressive-results \
129
- --verbose
130
- ```
131
-
132
- ### **AFTER (v4.x - Simplified)**
133
- ```bash
134
- # ✅ Simple and effective
135
- sunlint --all --input=src --verbose
136
- ```
137
-
138
- ### **Advanced Users Can Still Customize**
139
- ```bash
140
- # For power users who need control
141
- sunlint --all --input=src --performance=careful --timeout=180000
142
- ```
143
-
144
- ---
145
-
146
- ## 📊 **Performance Comparison**
147
-
148
- | **Command** | **Small Project** | **Large Project** | **Enterprise** |
149
- |-------------|-------------------|-------------------|----------------|
150
- | `--performance=auto` | ~10s | ~60s | ~120s |
151
- | `--performance=fast` | ~5s | ~30s | ~60s |
152
- | `--performance=careful` | ~15s | ~90s | ~180s |
153
-
154
- ---
155
-
156
- ## ✅ **Best Practices**
157
-
158
- ### **🎯 DO (Recommended)**
159
- ```bash
160
- ✅ sunlint --all --input=src # Let auto-detection work
161
- ✅ sunlint --all --input=src --verbose # See what's happening
162
- ✅ sunlint --quality --input=src --performance=fast # Quick quality check
163
- ✅ sunlint --all --changed-files # Only check changes
164
- ```
165
-
166
- ### **❌ DON'T (Avoid)**
167
- ```bash
168
- ❌ sunlint --all --input=src --performance-profile=conservative --batch-size=5 --streaming-analysis
169
- # Too complex - just use --performance=careful
170
-
171
- ❌ sunlint --all --input=src --timeout=5000
172
- # Too short - let auto-detection choose
173
-
174
- ❌ sunlint --all --input=huge-project
175
- # Missing performance hint - add --performance=careful
176
- ```
177
-
178
- ---
179
-
180
- ## 🏆 **Success Metrics**
181
-
182
- ### **✅ Simplified CLI Achieved**
183
- - **3 main commands** cover 90% of use cases
184
- - **Auto-detection** eliminates guesswork
185
- - **Zero configuration** for most projects
186
- - **Predictable performance** across project sizes
187
-
188
- ### **✅ Backward Compatibility**
189
- - Old commands still work but show deprecation warnings
190
- - Gradual migration path for existing users
191
- - Advanced options available for power users
192
-
193
- ---
194
-
195
- ## 🚀 **Quick Start Checklist**
196
-
197
- - [ ] **Update to SunLint v4.x** with auto-performance
198
- - [ ] **Use basic command**: `sunlint --all --input=src`
199
- - [ ] **Add --verbose** if you want to see progress
200
- - [ ] **Use --performance=fast** for quick checks
201
- - [ ] **Use --performance=careful** for thorough analysis
202
- - [ ] **Test with your project** to validate performance
203
-
204
- ---
205
-
206
- **🎯 Bottom Line: Chỉ cần nhớ `sunlint --all --input=src` - mọi thứ khác được tự động optimize!**
207
-
208
- *🚀 Simple • ⚡ Fast • 🎯 Effective*