@sun-asterisk/sunlint 1.3.39 → 1.3.40

package/skill-assets/sunlint-code-quality/rules/csharp/C018-generic-errors.md

@@ -0,0 +1,38 @@
+---
+title: Do Not Throw Generic Errors
+impact: HIGH
+impactDescription: enables proper error handling and monitoring
+tags: error-handling, exceptions, custom-errors, debugging, quality, csharp
+---
+
+## Do Not Throw Generic Errors
+
+Throwing specific exceptions allows callers to handle specific error cases.
+
+**Incorrect (generic exception):**
+
+```csharp
+if (user == null)
+{
+    throw new Exception("User not found"); // Generic
+}
+```
+
+**Correct (specific exception):**
+
+```csharp
+if (user == null)
+{
+    throw new KeyNotFoundException($"User {id} not found"); // Built-in specific
+}
+
+// Or custom exception
+public class UserNotFoundException : Exception { ... }
+
+if (user == null)
+{
+    throw new UserNotFoundException(id);
+}
+```
+
+**Tools:** Roslyn Analyzers (CA2201), SonarQube

package/skill-assets/sunlint-code-quality/rules/csharp/C019-error-log-level.md

@@ -0,0 +1,29 @@
+---
+title: Do Not Use Error Log For Non-critical
+impact: HIGH
+impactDescription: prevents alert fatigue and log noise
+tags: logging, log-levels, error, observability, quality, csharp
+---
+
+## Do Not Use Error Log For Non-critical
+
+Reserve `LogError` for system failures requiring intervention. Use `LogWarning` or `LogInformation` for business flows.
+
+**Incorrect (wrong level):**
+
+```csharp
+// Not an error - just invalid input
+_logger.LogError("User entered invalid email"); 
+```
+
+**Correct (appropriate level):**
+
+```csharp
+// Business logic flow
+_logger.LogWarning("Login failed for user {UserId}", userId);
+
+// System failure
+_logger.LogError(ex, "Database connection failed");
+```
+
+**Tools:** Manual Review

package/skill-assets/sunlint-code-quality/rules/csharp/C020-no-unused-imports.md

@@ -0,0 +1,30 @@
+---
+title: Do Not Import Unused Namespaces
+impact: LOW
+impactDescription: reduces clutter
+tags: imports, cleanup, quality, csharp
+---
+
+## Do Not Import Unused Namespaces
+
+Unused `using` directives clutter the file.
+
+**Incorrect:**
+
+```csharp
+using System;
+using System.Text; // Unused
+using System.Linq; // Unused
+
+public class User { }
+```
+
+**Correct:**
+
+```csharp
+using System;
+
+public class User { }
+```
+
+**Tools:** Visual Studio "Remove Unused Usings", Roslyn Analyzers (IDE0005)

package/skill-assets/sunlint-code-quality/rules/csharp/C022-no-unused-variables.md

@@ -0,0 +1,33 @@
+---
+title: Remove Unused Variables
+impact: MEDIUM
+impactDescription: improves code maintainability and reduces clutter
+tags: csharp, clean-code, maintainability
+---
+
+## Remove Unused Variables
+
+Unused variables reduce code readability and may indicate logic errors.
+
+**Incorrect:**
+
+```csharp
+public void CalculateTotal()
+{
+    int unused = 10; // C022: variable 'unused' is assigned but its value is never used
+    var total = 100;
+    Console.WriteLine($"Total: {total}");
+}
+```
+
+**Correct:**
+
+```csharp
+public void CalculateTotal()
+{
+    var total = 100;
+    Console.WriteLine($"Total: {total}");
+}
+```
+
+**Tools:** Roslyn Analyzers, SonarQube (S1481)

package/skill-assets/sunlint-code-quality/rules/csharp/C023-no-duplicate-names.md

@@ -0,0 +1,36 @@
+---
+title: No Duplicate Variable Names In Scope (Shadowing)
+impact: HIGH
+impactDescription: prevents shadowing bugs
+tags: variables, shadowing, scope, quality, csharp
+---
+
+## No Duplicate Variable Names In Scope (Shadowing)
+
+Variable shadowing occurs when an inner scope variable has the same name as an outer scope variable.
+
+**Incorrect (shadowing):**
+
+```csharp
+var name = "Main";
+
+public void Process()
+{
+    var name = "Inner"; // Shadows class member or outer variable
+    Console.WriteLine(name);
+}
+```
+
+**Correct (unique names):**
+
+```csharp
+var appName = "Main";
+
+public void Process()
+{
+    var processName = "Inner";
+    Console.WriteLine(processName);
+}
+```
+
+**Tools:** Roslyn Analyzers, SonarQube

package/skill-assets/sunlint-code-quality/rules/csharp/C024-centralize-constants.md

@@ -0,0 +1,33 @@
+---
+title: Centralize Constants
+impact: HIGH
+impactDescription: makes values easy to find and update
+tags: constants, magic-numbers, configuration, quality, csharp
+---
+
+## Centralize Constants
+
+Avoid magic numbers and strings. Use `const` fields or configuration.
+
+**Incorrect (magic strings/numbers):**
+
+```csharp
+if (status == "Active") { }
+if (count > 5) { }
+```
+
+**Correct (centralized):**
+
+```csharp
+public static class Constants
+{
+    public const string StatusActive = "Active";
+    public const int MaxRetries = 5;
+}
+
+// Usage
+if (status == Constants.StatusActive) { }
+if (count > Constants.MaxRetries) { }
+```
+
+**Tools:** Roslyn Analyzers, SonarQube

package/skill-assets/sunlint-code-quality/rules/csharp/C029-catch-log-root-cause.md

@@ -0,0 +1,40 @@
+---
+title: Ensure Exceptions Log Root Cause
+impact: CRITICAL
+impactDescription: enables debugging of root causes
+tags: error-handling, logging, debugging, quality, csharp
+---
+
+## Ensure Exceptions Log Root Cause
+
+When catching an exception, always log the full exception object, not just the message.
+
+**Incorrect (swallowing stack trace):**
+
+```csharp
+try 
+{
+    // ...
+}
+catch (Exception ex)
+{
+    // Lost stack trace and inner exception!
+    _logger.LogError("Error: " + ex.Message); 
+}
+```
+
+**Correct (logging exception):**
+
+```csharp
+try
+{
+    // ...
+}
+catch (Exception ex)
+{
+    // Pass exception object as first argument
+    _logger.LogError(ex, "Error processing order {OrderId}", orderId);
+}
+```
+
+**Tools:** Roslyn Analyzers, SonarQube

package/skill-assets/sunlint-code-quality/rules/csharp/C030-custom-error-classes.md

@@ -0,0 +1,38 @@
+---
+title: Use Custom Error Classes
+impact: MEDIUM
+impactDescription: improves error handling granularity
+tags: error-handling, exceptions, design, quality, csharp
+---
+
+## Use Custom Error Classes
+
+Use specific, typed exceptions instead of generic `Exception`.
+
+**Incorrect (throwing generic):**
+
+```csharp
+throw new Exception("Validation failed");
+```
+
+**Correct (custom business exceptions):**
+
+```csharp
+public class InsufficientFundsException : Exception
+{
+    public decimal Available { get; }
+    public decimal Required { get; }
+
+    public InsufficientFundsException(decimal available, decimal required)
+        : base($"Insufficient funds. Required: {required}, Available: {available}")
+    {
+        Available = available;
+        Required = required;
+    }
+}
+
+// Usage
+throw new InsufficientFundsException(100, 200);
+```
+
+**Tools:** Roslyn Analyzers

package/skill-assets/sunlint-code-quality/rules/csharp/C033-separate-data-access.md

@@ -0,0 +1,53 @@
+---
+title: Separate Data Access Logic
+impact: HIGH
+impactDescription: improves testability and maintainability
+tags: architecture, repository, layering, quality, csharp
+---
+
+## Separate Data Access Logic
+
+Keep database logic out of Controllers and Business Services. Use Repositories or Query handlers.
+
+**Incorrect (DB usage in controller):**
+
+```csharp
+[HttpPost]
+public IActionResult CreateUser(User user)
+{
+    // Direct EF context usage in controller
+    using (var context = new DbContext())
+    {
+        context.Users.Add(user);
+        context.SaveChanges();
+    }
+    return Ok();
+}
+```
+
+**Correct (Repository/Service pattern):**
+
+```csharp
+// Controller
+public IActionResult CreateUser(UserDto dto)
+{
+    _userService.RegisterUser(dto);
+    return Ok();
+}
+
+// Service
+public void RegisterUser(UserDto dto)
+{
+    var user = _mapper.Map<User>(dto);
+    _userRepository.Add(user);
+}
+
+// Repository
+public void Add(User user)
+{
+    _context.Users.Add(user);
+    _context.SaveChanges();
+}
+```
+
+**Tools:** Architecture Tests, SonarQube

package/skill-assets/sunlint-code-quality/rules/csharp/C035-error-context-logging.md

@@ -0,0 +1,31 @@
+---
+title: Log All Relevant Context On Errors
+impact: HIGH
+impactDescription: enables quick debugging and incident response
+tags: error-handling, logging, context, debugging, quality, csharp
+---
+
+## Log All Relevant Context On Errors
+
+Structured logging should include all IDs and state relevant to the error.
+
+**Incorrect (message only):**
+
+```csharp
+_logger.LogError("Payment failed");
+```
+
+**Correct (structured context):**
+
+```csharp
+_logger.LogError(ex, "Payment failed for User {UserId} Order {OrderId} Amount {Amount}", 
+    userId, orderId, amount);
+
+// Or using scopes
+using (_logger.BeginScope(new Dictionary<string, object> { ["UserId"] = userId }))
+{
+    _logger.LogError(ex, "Payment failed");
+}
+```
+
+**Tools:** Serilog, MEL

package/skill-assets/sunlint-code-quality/rules/csharp/C041-no-hardcoded-secrets.md

@@ -0,0 +1,25 @@
+---
+title: No Hardcoded Secrets In Repo
+impact: HIGH
+impactDescription: prevents credential exposure
+tags: secrets, credentials, security, git, quality, csharp
+---
+
+## No Hardcoded Secrets In Repo
+
+Never commit API keys or passwords.
+
+**Incorrect:**
+
+```csharp
+private const string ServiceKey = "sk_live_123";
+```
+
+**Correct:**
+
+```csharp
+// Load from configuration
+var key = _configuration["ServiceKey"];
+```
+
+**Tools:** GitLeaks, Security Code Scan

package/skill-assets/sunlint-code-quality/rules/csharp/C042-boolean-naming.md

@@ -0,0 +1,27 @@
+---
+title: Boolean Names Is/Has/Should
+impact: HIGH
+impactDescription: makes conditions instantly readable
+tags: naming, booleans, readability, quality, csharp
+---
+
+## Boolean Names Is/Has/Should
+
+Prefix boolean properties and variables with `Is`, `Has`, `Can`, `Should`.
+
+**Incorrect:**
+
+```csharp
+public bool Active { get; set; }
+public bool Validate { get; set; } // is this a flag or a method?
+```
+
+**Correct:**
+
+```csharp
+public bool IsActive { get; set; }
+public bool ShouldValidate { get; set; }
+public bool HasAccess { get; set; }
+```
+
+**Tools:** StyleCop, Code Review

package/skill-assets/sunlint-code-quality/rules/csharp/C052-controller-parsing.md

@@ -0,0 +1,41 @@
+---
+title: Separate Parsing From Controllers
+impact: HIGH
+impactDescription: keeps controllers thin and focused
+tags: controller, parsing, transformation, patterns, quality, csharp
+---
+
+## Separate Parsing From Controllers
+
+Controllers should handle HTTP, not data transformation. Use AutoMapper or Mappers.
+
+**Incorrect (mapping in controller):**
+
+```csharp
+[HttpGet]
+public IActionResult GetUser(int id)
+{
+    var user = _repo.Get(id);
+    // Manual mapping logic cluttering controller
+    var dto = new UserDto 
+    {
+        FullName = user.FirstName + " " + user.LastName,
+        Age = DateTime.Now.Year - user.Dob.Year
+    };
+    return Ok(dto);
+}
+```
+
+**Correct (AutoMapper or dedicated mapper):**
+
+```csharp
+[HttpGet]
+public IActionResult GetUser(int id)
+{
+    var user = _repo.Get(id);
+    var dto = _mapper.Map<UserDto>(user);
+    return Ok(dto);
+}
+```
+
+**Tools:** AutoMapper, Mapster

package/skill-assets/sunlint-code-quality/rules/csharp/C060-superclass-logic.md

@@ -0,0 +1,33 @@
+---
+title: Do Not Ignore Superclass Logic
+impact: HIGH
+impactDescription: ensures proper inheritance behavior
+tags: inheritance, override, superclass, oop, quality, csharp
+---
+
+## Do Not Ignore Superclass Logic
+
+When overriding `virtual` methods, consider if you need to call `base.Method()`.
+
+**Incorrect (breaking chain):**
+
+```csharp
+protected override void OnInitialized()
+{
+    // Missing base.OnInitialized();
+    // Might break component initialization in frameworks like Blazor/WPF
+    MyInit();
+}
+```
+
+**Correct:**
+
+```csharp
+protected override void OnInitialized()
+{
+    base.OnInitialized();
+    MyInit();
+}
+```
+
+**Tools:** Roslyn Analyzers, SonarQube

package/skill-assets/sunlint-code-quality/rules/csharp/C067-no-hardcoded-config.md

@@ -0,0 +1,24 @@
+---
+title: Do Not Hardcode Configuration
+impact: HIGH
+impactDescription: enables environment-specific deployments
+tags: configuration, environment, deployment, quality, csharp
+---
+
+## Do Not Hardcode Configuration
+
+Use `appsettings.json` and `IConfiguration`.
+
+**Incorrect:**
+
+```csharp
+var client = new HttpClient { BaseAddress = new Uri("http://localhost:5000") };
+```
+
+**Correct:**
+
+```csharp
+var client = new HttpClient { BaseAddress = new Uri(_config["ApiUrl"]) };
+```
+
+**Tools:** Roslyn Analyzers

package/skill-assets/sunlint-code-quality/rules/csharp/S003-open-redirect.md

@@ -0,0 +1,47 @@
+---
+title: Protect Against Open Redirects
+impact: MEDIUM
+impactDescription: prevents phishing redirect attacks
+tags: redirect, phishing, url, security, csharp
+---
+
+## Protect Against Open Redirects
+
+Open redirects allow attackers to use your domain to redirect users to malicious sites, facilitating phishing attacks.
+
+**Incorrect (unvalidated redirect):**
+
+```csharp
+[HttpGet]
+public IActionResult Login(string returnUrl)
+{
+    // ... login logic ...
+    return Redirect(returnUrl); // Attacker can send ?returnUrl=http://evil.com
+}
+```
+
+**Correct (validated redirect):**
+
+```csharp
+[HttpGet]
+public IActionResult Login(string returnUrl)
+{
+    // ... login logic ...
+
+    // Use LocalRedirect to enforce local URLs
+    if (Url.IsLocalUrl(returnUrl))
+    {
+        return LocalRedirect(returnUrl);
+    }
+    
+    // Or validate against allow list
+    if (IsAllowedUrl(returnUrl))
+    {
+        return Redirect(returnUrl);
+    }
+
+    return RedirectToAction("Index", "Home");
+}
+```
+
+**Tools:** Roslyn Analyzers, SonarQube

package/skill-assets/sunlint-code-quality/rules/csharp/S004-no-log-credentials.md

@@ -0,0 +1,28 @@
+---
+title: Do Not Log Credentials Or Tokens
+impact: MEDIUM
+impactDescription: prevents credential exposure in logs
+tags: logging, credentials, tokens, secrets, security, csharp
+---
+
+## Do Not Log Credentials Or Tokens
+
+Never log passwords or raw tokens.
+
+**Incorrect:**
+
+```csharp
+_logger.LogInformation("Login attempt with password {Password}", password);
+```
+
+**Correct:**
+
+```csharp
+_logger.LogInformation("Login attempt for User {User}", username);
+
+// Use Redaction in newer .NET
+[LoggerMessage(Level = LogLevel.Information, Message = "Login for {User}")]
+partial void LogLogin(string user, [NotLogged] string password);
+```
+
+**Tools:** Roslyn Analyzers

package/skill-assets/sunlint-code-quality/rules/csharp/S005-server-authorization.md

@@ -0,0 +1,51 @@
+---
+title: Enforce Authorization At Trusted Service Layer
+impact: CRITICAL
+impactDescription: prevents client-side authorization bypass
+tags: authorization, server-side, middleware, access-control, security, csharp
+---
+
+## Enforce Authorization At Trusted Service Layer
+
+Client-side checks (hiding buttons) are not security checks. Authorization must be enforced on the server for every privileged action.
+
+**Incorrect (client-side only or trusting inputs):**
+
+```csharp
+// Trusting a parameter from the client
+[HttpPost]
+public IActionResult DeleteUser(int id, bool isAdmin) 
+{
+    if (isAdmin) // Attacker can toggle this!
+    {
+        _repo.Delete(id);
+    }
+    return Ok();
+}
+```
+
+**Correct (server-side authorization):**
+
+```csharp
+[Authorize(Roles = "Admin")] // Declarative check
+[HttpPost]
+public IActionResult DeleteUser(int id)
+{
+    _repo.Delete(id);
+    return Ok();
+}
+
+// Resource-based authorization
+[HttpPost]
+public async Task<IActionResult> EditDocument(int id)
+{
+    var document = _repo.Get(id);
+    var result = await _authorizationService.AuthorizeAsync(User, document, "EditPolicy");
+
+    if (!result.Succeeded) return Forbid();
+
+    // Proceed...
+}
+```
+
+**Tools:** Roslyn Analyzers, SonarQube

package/skill-assets/sunlint-code-quality/rules/csharp/S006-default-credentials.md

@@ -0,0 +1,42 @@
+---
+title: Do Not Use Default Credentials
+impact: CRITICAL
+impactDescription: prevents trivial compromise via known credentials
+tags: credentials, default, passwords, configuration, security, csharp
+---
+
+## Do Not Use Default Credentials
+
+Default credentials in configuration files or code allow attackers trivial access.
+
+**Incorrect (hardcoded defaults):**
+
+```json
+// appsettings.json
+{
+  "ConnectionStrings": {
+    "DefaultConnection": "Server=...;User Id=sa;Password=sa;" 
+  }
+}
+```
+
+**Correct (secure configuration):**
+
+```csharp
+// Use Environment Variables or User Secrets
+// appsettings.json should use placeholders or be overridden
+{
+  "ConnectionStrings": {
+    "DefaultConnection": "Server=...;User Id=${DB_USER};Password=${DB_PASS};"
+  }
+}
+
+// Code validation
+var password = configuration["DbPassword"];
+if (password == "admin" || password == "password") 
+{
+    throw new SecurityException("Default credentials detected");
+}
+```
+
+**Tools:** Secret Scanners, Configuration Validation