@sun-asterisk/sunlint 1.3.33 → 1.3.35

package/rules/security/S051_password_length_policy/typescript/config.json

@@ -0,0 +1,83 @@
+{
+  "ruleId": "S051",
+  "name": "Support 12–64 char passwords; reject >128",
+  "description": "Enforce modern password length policy (min 12, typical max 64; reject >128) and align FE/BE validators. Warn on bcrypt 72-byte truncation.",
+  "category": "security",
+  "severity": "error",
+  "options": {
+    "lengthPolicy": {
+      "minAllowedRange": {
+        "min": 8,
+        "recommended": 12,
+        "warnBelow": 12,
+        "errorBelow": 8
+      },
+      "maxRecommended": 64,
+      "hardRejectLength": 128
+    },
+    "mode": "strict",
+    "passwordIdentifiers": [
+      "password", "newPassword", "oldPassword", "confirmPassword", 
+      "passwd", "pwd", "passphrase", "secret", "credential"
+    ],
+    "uiHints": [
+      "type=[\"']password[\"']",
+      "placeholder.*password",
+      "label.*password",
+      "i18n.*password"
+    ],
+    "contextSignals": {
+      "routes": ["auth", "signup", "register", "login", "reset", "change-password"],
+      "files": ["auth", "password", "credential", "security"],
+      "methods": ["hashPassword", "validatePassword", "checkPassword"]
+    },
+    "validatorPatterns": {
+      "fe": [
+        "minLength\\s*:\\s*(\\d+)",
+        "maxLength\\s*:\\s*(\\d+)", 
+        "yup\\.string\\(\\).*\\.min\\((\\d+)\\).*\\.max\\((\\d+)\\)",
+        "z\\.string\\(\\).*\\.min\\((\\d+)\\).*\\.max\\((\\d+)\\)",
+        "Validators\\.minLength\\((\\d+)\\)",
+        "Validators\\.maxLength\\((\\d+)\\)",
+        "minlength=[\"']?(\\d+)[\"']?",
+        "maxlength=[\"']?(\\d+)[\"']?"
+      ],
+      "be": [
+        "Joi\\.string\\(\\).*min\\((\\d+)\\).*max\\((\\d+)\\)",
+        "Length\\s*\\(\\s*min\\s*=\\s*(\\d+).*max\\s*=\\s*(\\d+)\\)",
+        "@Size\\s*\\(\\s*min\\s*=\\s*(\\d+).*max\\s*=\\s*(\\d+)\\)",
+        "if\\s*\\(.*password\\.length\\s*[<>]=?\\s*(\\d+)\\)"
+      ]
+    },
+    "bcryptHints": {
+      "apis": [
+        "bcrypt\\.", "BCrypt\\.", "bcryptjs", "@nestjs/bcrypt",
+        "org\\.springframework\\.security\\.crypto\\.bcrypt"
+      ],
+      "warnOnMissingLengthCheck": true,
+      "byteLimit": 72,
+      "checkMethods": ["hash", "hashSync", "compare", "compareSync"]
+    },
+    "crossFileAnalysis": {
+      "enabled": true,
+      "compareFeBeMinMax": true,
+      "warnOnMismatch": true,
+      "toleranceDiff": 2
+    },
+    "policy": {
+      "requireMinSignals": 2,
+      "alignFeBe": true,
+      "rejectOverHardLimit": true,
+      "priorityOrder": ["weak_validators", "bcrypt_issues", "hard_limit"]
+    },
+    "allowlist": {
+      "paths": ["test/", "tests/", "__tests__/", "fixtures/", "mocks/", "dummy/"],
+      "notes": "Test and dummy files may have different password requirements"
+    },
+    "thresholds": {
+      "maxWeakValidators": 0,
+      "maxBcryptWithoutLengthCheck": 0,
+      "maxMissingHardLimit": 1
+    }
+  }
+}

package/rules/security/S052_weak_otp_entropy/dart/analyzer.js

@@ -0,0 +1,30 @@
+/**
+ * S052 Dart Analyzer
+ * JS wrapper that delegates to DartAnalyzer binary.
+ */
+
+class DartS052Analyzer {
+  constructor() {
+    this.ruleId = 'S052';
+    this.language = 'dart';
+  }
+
+  getMetadata() {
+    return {
+      ruleId: 'S052',
+      language: 'dart',
+      delegateTo: 'dart_analyzer'
+    };
+  }
+
+  async analyze(files, language, options) {
+    // Delegated to DartAnalyzer binary via heuristic-engine.js
+    return [];
+  }
+
+  supportsLanguage(language) {
+    return language === 'dart';
+  }
+}
+
+module.exports = DartS052Analyzer;

package/rules/security/S052_weak_otp_entropy/index.js

@@ -0,0 +1,83 @@
+/**
+ * S052 Rule Router
+ * Routes analysis to the appropriate language-specific analyzer.
+ * Supports: TypeScript, JavaScript, Dart
+ */
+
+const path = require('path');
+
+class S052Router {
+  constructor() {
+    this.analyzers = new Map();
+    this.ruleId = 'S052';
+  }
+
+  getAnalyzer(language) {
+    const normalizedLang = this.normalizeLanguage(language);
+
+    if (!this.analyzers.has(normalizedLang)) {
+      try {
+        const analyzerPath = path.join(__dirname, normalizedLang, 'analyzer.js');
+        const AnalyzerClass = require(analyzerPath);
+        this.analyzers.set(normalizedLang, new AnalyzerClass());
+      } catch (error) {
+        return null;
+      }
+    }
+
+    return this.analyzers.get(normalizedLang);
+  }
+
+  normalizeLanguage(language) {
+    if (typeof language !== 'string') {
+      return 'typescript';
+    }
+    const languageMap = {
+      'typescript': 'typescript',
+      'javascript': 'typescript',
+      'ts': 'typescript',
+      'js': 'typescript',
+      'dart': 'dart'
+    };
+    return languageMap[language.toLowerCase()] || language.toLowerCase();
+  }
+
+  supportsLanguage(language) {
+    if (typeof language !== 'string') return false;
+    const supported = ['typescript', 'javascript', 'ts', 'js', 'dart'];
+    return supported.includes(language.toLowerCase());
+  }
+
+  getSupportedLanguages() {
+    return ['typescript', 'javascript', 'dart'];
+  }
+
+  async analyze(files, language, options = {}) {
+    const analyzer = this.getAnalyzer(language);
+    if (!analyzer) return [];
+    if (typeof analyzer.analyze === 'function') {
+      return analyzer.analyze(files, language, options);
+    }
+    return [];
+  }
+
+  async initialize(semanticEngineOrLanguage = null, semanticEngine = null) {
+    let engine = semanticEngine;
+    let lang = null;
+
+    if (typeof semanticEngineOrLanguage === 'string') {
+      lang = semanticEngineOrLanguage;
+    } else if (semanticEngineOrLanguage && typeof semanticEngineOrLanguage === 'object') {
+      engine = semanticEngineOrLanguage;
+    }
+
+    if (lang) {
+      const analyzer = this.getAnalyzer(lang);
+      if (analyzer && typeof analyzer.initialize === 'function') {
+        await analyzer.initialize(engine);
+      }
+    }
+  }
+}
+
+module.exports = new S052Router();

package/rules/security/S052_weak_otp_entropy/typescript/config.json

@@ -0,0 +1,57 @@
+{
+  "ruleId": "S052",
+  "name": "OTP must have ≥20-bit entropy (≥6 digits) and use CSPRNG",
+  "description": "Prevent guessable OTP by enforcing CSPRNG and minimal entropy. Ban non-crypto RNG and too-short codes.",
+  "category": "security",
+  "severity": "error",
+  "options": {
+    "otpIdentifiers": [
+      "otp","oneTime","one_time","passcode","verificationCode","verifyCode",
+      "confirmCode","pin","totp","hotp","resetCode","activationCode"
+    ],
+    "bannedRngApis": {
+      "typescript": ["Math\\.random\\s*\\("],
+      "javascript": ["Math\\.random\\s*\\("],
+      "node": ["crypto\\.pseudoRandomBytes\\s*\\("],
+      "java": ["new\\s+Random\\s*\\(","ThreadLocalRandom\\.current\\s*\\("],
+      "kotlin": ["kotlin\\.random\\.Random(\\.Default)?"],
+      "dart": ["new\\s+Random\\s*\\(","Random\\s*\\("]
+    },
+    "allowedRngApis": {
+      "node": ["crypto\\.randomInt\\s*\\(","crypto\\.randomBytes\\s*\\("],
+      "java": ["new\\s+SecureRandom\\s*\\("],
+      "kotlin": ["java\\.security\\.SecureRandom"],
+      "dart": ["Random\\.secure\\s*\\("]
+    },
+    "lengthChecks": {
+      "numericMinDigits": 6,
+      "alphanumericMinLength": 6,
+      "regexBadNumeric4": "\\\\b\\\\d{4}\\\\b"
+    },
+    "totpHotpHints": {
+      "requireStandardLib": true,
+      "minSecretBits": 128,
+      "maxTimeStepSeconds": 30,
+      "maxWindow": 1
+    },
+    "policy": {
+      "requireCsprng": true,
+      "forbidNonCryptoRng": true,
+      "forbidFourDigitOtp": true,
+      "requireNoLoggingOfOtp": true,
+      "requireSingleUseAndTtl": true
+    },
+    "detectionHeuristics": {
+      "variableNameMatchBoost": true,
+      "builderFunctions": ["generateOtp","issueOtp","createCode","sendOtp","totp","hotp"]
+    },
+    "allowlist": {
+      "paths": ["test/","tests/","__tests__/","fixtures/","mocks/"],
+      "notes": "Trong test vẫn cấm 4-digit OTP nếu test chạy e2e với hệ thật."
+    },
+    "thresholds": {
+      "maxBannedRngUsages": 0,
+      "maxShortOtpPatterns": 0
+    }
+  }
+}

package/rules/security/S054_no_default_accounts/dart/analyzer.js

@@ -0,0 +1,30 @@
+/**
+ * S054 Dart Analyzer
+ * JS wrapper that delegates to DartAnalyzer binary.
+ */
+
+class DartS054Analyzer {
+  constructor() {
+    this.ruleId = 'S054';
+    this.language = 'dart';
+  }
+
+  getMetadata() {
+    return {
+      ruleId: 'S054',
+      language: 'dart',
+      delegateTo: 'dart_analyzer'
+    };
+  }
+
+  async analyze(files, language, options) {
+    // Delegated to DartAnalyzer binary via heuristic-engine.js
+    return [];
+  }
+
+  supportsLanguage(language) {
+    return language === 'dart';
+  }
+}
+
+module.exports = DartS054Analyzer;

package/rules/security/S054_no_default_accounts/index.js

@@ -0,0 +1,83 @@
+/**
+ * S054 Rule Router
+ * Routes analysis to the appropriate language-specific analyzer.
+ * Supports: TypeScript, JavaScript, Dart
+ */
+
+const path = require('path');
+
+class S054Router {
+  constructor() {
+    this.analyzers = new Map();
+    this.ruleId = 'S054';
+  }
+
+  getAnalyzer(language) {
+    const normalizedLang = this.normalizeLanguage(language);
+
+    if (!this.analyzers.has(normalizedLang)) {
+      try {
+        const analyzerPath = path.join(__dirname, normalizedLang, 'analyzer.js');
+        const AnalyzerClass = require(analyzerPath);
+        this.analyzers.set(normalizedLang, new AnalyzerClass());
+      } catch (error) {
+        return null;
+      }
+    }
+
+    return this.analyzers.get(normalizedLang);
+  }
+
+  normalizeLanguage(language) {
+    if (typeof language !== 'string') {
+      return 'typescript';
+    }
+    const languageMap = {
+      'typescript': 'typescript',
+      'javascript': 'typescript',
+      'ts': 'typescript',
+      'js': 'typescript',
+      'dart': 'dart'
+    };
+    return languageMap[language.toLowerCase()] || language.toLowerCase();
+  }
+
+  supportsLanguage(language) {
+    if (typeof language !== 'string') return false;
+    const supported = ['typescript', 'javascript', 'ts', 'js', 'dart'];
+    return supported.includes(language.toLowerCase());
+  }
+
+  getSupportedLanguages() {
+    return ['typescript', 'javascript', 'dart'];
+  }
+
+  async analyze(files, language, options = {}) {
+    const analyzer = this.getAnalyzer(language);
+    if (!analyzer) return [];
+    if (typeof analyzer.analyze === 'function') {
+      return analyzer.analyze(files, language, options);
+    }
+    return [];
+  }
+
+  async initialize(semanticEngineOrLanguage = null, semanticEngine = null) {
+    let engine = semanticEngine;
+    let lang = null;
+
+    if (typeof semanticEngineOrLanguage === 'string') {
+      lang = semanticEngineOrLanguage;
+    } else if (semanticEngineOrLanguage && typeof semanticEngineOrLanguage === 'object') {
+      engine = semanticEngineOrLanguage;
+    }
+
+    if (lang) {
+      const analyzer = this.getAnalyzer(lang);
+      if (analyzer && typeof analyzer.initialize === 'function') {
+        await analyzer.initialize(engine);
+      }
+    }
+  }
+}
+
+module.exports = new S054Router();

package/rules/security/S054_no_default_accounts/typescript/config.json

@@ -0,0 +1,101 @@
+{
+  "ruleId": "S054",
+  "name": "Disallow Default/Built-in Accounts (admin/root/sa/...)",
+  "description": "Prevent use of default or shared accounts. Enforce per-user identities, initial password change, and disabling well-known built-ins.",
+  "category": "security",
+  "severity": "error",
+  "options": {
+    "blockedUsernames": [
+      "admin","root","sa","test","guest","operator","super","superuser","sys",
+      "postgres","mysql","mssql","oracle","elastic","kibana","grafana",
+      "administrator", "demo", "example", "default", "public", "anonymous",
+      "user", "password", "service", "support", "backup", "monitor"
+    ],
+    "codeCreationPatterns": [
+      "create(User|Account)\\s*\\(",
+      "new\\s+User\\s*\\(",
+      "user(Name|name|_name)\\s*:",
+      "username\\s*=\\s*",
+      "setUser(Name|name)\\s*\\(",
+      "addUser\\s*\\(",
+      "registerUser\\s*\\(",
+      "createAccount\\s*\\("
+    ],
+    "sqlInsertUserPatterns": [
+      "INSERT\\s+INTO\\s+\\w*user\\w*\\s*\\(",
+      "UPSERT\\s+INTO\\s+\\w*user\\w*\\s*\\(",
+      "CREATE\\s+USER\\s+",
+      "GRANT\\s+.+\\s+TO\\s+",
+      "REVOKE\\s+.+\\s+FROM\\s+"
+    ],
+    "infraPatterns": {
+      "terraform": [
+        "username\\s*=\\s*\"(admin|root|sa|test|guest)\"",
+        "user\\s*=\\s*\"(admin|root|sa|test|guest)\"",
+        "admin_username\\s*=\\s*\"(admin|root|sa|test|guest)\""
+      ],
+      "helmValues": [
+        "admin(User|Password)\\s*:",
+        "default(User|Pass)\\s*:",
+        "root(User|Password)\\s*:",
+        "service(User|Account)\\s*:"
+      ],
+      "docker": [
+        "ENV\\s+.*(USER|USERNAME|_ROOT_USERNAME)\\s*=\\s*(admin|root|sa)",
+        "POSTGRES_USER\\s*=\\s*(postgres|admin|root)",
+        "MONGO_INITDB_ROOT_USERNAME\\s*=\\s*(root|admin)",
+        "MYSQL_USER\\s*=\\s*(root|admin|mysql)",
+        "REDIS_USER\\s*=\\s*(redis|admin|root)"
+      ],
+      "kubernetes": [
+        "serviceAccount:\\s*default",
+        "user:\\s*(admin|root|sa|test|guest)",
+        "username:\\s*(admin|root|sa|test|guest)"
+      ]
+    },
+    "docPatterns": [
+      "login\\s*[:=]\\s*(admin|root|sa|test|guest)",
+      "user\\s*[:=]\\s*(admin|root|sa|test|guest)",
+      "username\\s*[:=]\\s*(admin|root|sa|test|guest)",
+      "password\\s*[:=]\\s*(admin|root|sa|test|guest|password|123456)"
+    ],
+    "passwordSmells": [
+      "password", "123456", "admin", "Admin@123", "Password1", "changeme", 
+      "default", "qwerty", "letmein", "welcome", "secret", "pass123",
+      "root", "toor", "administrator", "guest"
+    ],
+    "configFilePatterns": [
+      "database\\.(username|user)\\s*=\\s*(admin|root|sa)",
+      "db\\.(username|user)\\s*=\\s*(admin|root|sa)",
+      "auth\\.(username|user)\\s*=\\s*(admin|root|sa)",
+      "admin\\.(username|user)\\s*=\\s*",
+      "spring\\.datasource\\.username\\s*=\\s*(admin|root|sa)"
+    ],
+    "policy": {
+      "requirePerUserAccount": true,
+      "requireInitialPasswordChange": true,
+      "forbidWellKnownServiceAccountsInAppDB": true,
+      "allowOnlyInEphemeralTests": true,
+      "mustDisableBuiltInsOnInfra": true
+    },
+    "allowlist": {
+      "paths": [
+        "test/", "tests/", "__tests__/", "e2e/", "playground/", 
+        "local-dev/", "demo/", "example/", "mock/", "fixture/",
+        "spec/", ".spec.", ".test."
+      ],
+      "notes": "Vẫn cảnh báo nếu xuất hiện mật khẩu mặc định; cho phép username cấm chỉ khi data giả lập không public và không nối vào môi trường thật."
+    },
+    "thresholds": {
+      "maxFindings": 0,
+      "maxInAllowedPaths": 2,
+      "maxPasswordSmells": 0
+    },
+    "exemptions": {
+      "testDirectories": ["test", "tests", "__tests__", "e2e", "spec"],
+      "configFiles": ["jest.config", "test.config", "local.config"],
+      "allowTestData": true,
+      "allowDocumentationExamples": false
+    }
+  }
+}

package/rules/security/S055_content_type_validation/dart/analyzer.js

@@ -0,0 +1,30 @@
+/**
+ * S055 Dart Analyzer
+ * JS wrapper that delegates to DartAnalyzer binary.
+ */
+
+class DartS055Analyzer {
+  constructor() {
+    this.ruleId = 'S055';
+    this.language = 'dart';
+  }
+
+  getMetadata() {
+    return {
+      ruleId: 'S055',
+      language: 'dart',
+      delegateTo: 'dart_analyzer'
+    };
+  }
+
+  async analyze(files, language, options) {
+    // Delegated to DartAnalyzer binary via heuristic-engine.js
+    return [];
+  }
+
+  supportsLanguage(language) {
+    return language === 'dart';
+  }
+}
+
+module.exports = DartS055Analyzer;

package/rules/security/S055_content_type_validation/index.js

@@ -0,0 +1,83 @@
+/**
+ * S055 Rule Router
+ * Routes analysis to the appropriate language-specific analyzer.
+ * Supports: TypeScript, JavaScript, Dart
+ */
+
+const path = require('path');
+
+class S055Router {
+  constructor() {
+    this.analyzers = new Map();
+    this.ruleId = 'S055';
+  }
+
+  getAnalyzer(language) {
+    const normalizedLang = this.normalizeLanguage(language);
+
+    if (!this.analyzers.has(normalizedLang)) {
+      try {
+        const analyzerPath = path.join(__dirname, normalizedLang, 'analyzer.js');
+        const AnalyzerClass = require(analyzerPath);
+        this.analyzers.set(normalizedLang, new AnalyzerClass());
+      } catch (error) {
+        return null;
+      }
+    }
+
+    return this.analyzers.get(normalizedLang);
+  }
+
+  normalizeLanguage(language) {
+    if (typeof language !== 'string') {
+      return 'typescript';
+    }
+    const languageMap = {
+      'typescript': 'typescript',
+      'javascript': 'typescript',
+      'ts': 'typescript',
+      'js': 'typescript',
+      'dart': 'dart'
+    };
+    return languageMap[language.toLowerCase()] || language.toLowerCase();
+  }
+
+  supportsLanguage(language) {
+    if (typeof language !== 'string') return false;
+    const supported = ['typescript', 'javascript', 'ts', 'js', 'dart'];
+    return supported.includes(language.toLowerCase());
+  }
+
+  getSupportedLanguages() {
+    return ['typescript', 'javascript', 'dart'];
+  }
+
+  async analyze(files, language, options = {}) {
+    const analyzer = this.getAnalyzer(language);
+    if (!analyzer) return [];
+    if (typeof analyzer.analyze === 'function') {
+      return analyzer.analyze(files, language, options);
+    }
+    return [];
+  }
+
+  async initialize(semanticEngineOrLanguage = null, semanticEngine = null) {
+    let engine = semanticEngine;
+    let lang = null;
+
+    if (typeof semanticEngineOrLanguage === 'string') {
+      lang = semanticEngineOrLanguage;
+    } else if (semanticEngineOrLanguage && typeof semanticEngineOrLanguage === 'object') {
+      engine = semanticEngineOrLanguage;
+    }
+
+    if (lang) {
+      const analyzer = this.getAnalyzer(lang);
+      if (analyzer && typeof analyzer.initialize === 'function') {
+        await analyzer.initialize(engine);
+      }
+    }
+  }
+}
+
+module.exports = new S055Router();

package/rules/security/S056_log_injection_protection/dart/analyzer.js

@@ -0,0 +1,30 @@
+/**
+ * S056 Dart Analyzer
+ * JS wrapper that delegates to DartAnalyzer binary.
+ */
+
+class DartS056Analyzer {
+  constructor() {
+    this.ruleId = 'S056';
+    this.language = 'dart';
+  }
+
+  getMetadata() {
+    return {
+      ruleId: 'S056',
+      language: 'dart',
+      delegateTo: 'dart_analyzer'
+    };
+  }
+
+  async analyze(files, language, options) {
+    // Delegated to DartAnalyzer binary via heuristic-engine.js
+    return [];
+  }
+
+  supportsLanguage(language) {
+    return language === 'dart';
+  }
+}
+
+module.exports = DartS056Analyzer;