@sun-asterisk/sunlint 1.3.39 → 1.3.40

package/skill-assets/sunlint-code-quality/rules/csharp/S007-output-encoding.md

@@ -0,0 +1,36 @@
+---
+title: Output Encoding Before Interpreter Use
+impact: HIGH
+impactDescription: prevents XSS and injection attacks
+tags: xss, encoding, output, html, security, csharp, razor
+---
+
+## Output Encoding Before Interpreter Use
+
+XSS attacks occur when unescaped user data is rendered in the browser. In ASP.NET Core, Razor automatically encodes output, but using `Html.Raw` or unsafe rendering bypasses this.
+
+**Incorrect (no encoding):**
+
+```csharp
+// Razor View - XSS Vulnerability
+@Html.Raw(Model.UserDescription) 
+
+// Returning raw HTML from Controller
+return Content($"<h1>Hello {userInput}</h1>", "text/html");
+```
+
+**Correct (context-aware encoding):**
+
+```csharp
+// Razor - Auto-encoded (Safe)
+@Model.UserDescription
+
+// If you MUST use Html.Raw, sanitize first
+@Html.Raw(_sanitizer.Sanitize(Model.UserDescription))
+
+// Controller - Use libraries
+using System.Text.Encodings.Web;
+var safeHtml = HtmlEncoder.Default.Encode(userInput);
+```
+
+**Tools:** Roslyn Analyzers, SonarQube (S5131)

package/skill-assets/sunlint-code-quality/rules/csharp/S009-approved-crypto.md

@@ -0,0 +1,37 @@
+---
+title: Use Only Approved Cryptographic Algorithms
+impact: HIGH
+impactDescription: prevents use of broken cryptography
+tags: cryptography, crypto, hashing, encryption, security, csharp
+---
+
+## Use Only Approved Cryptographic Algorithms
+
+Obsolete algorithms (MD5, SHA1, DES) are vulnerable to collision and pre-image attacks.
+
+**Incorrect (broken algorithms):**
+
+```csharp
+using System.Security.Cryptography;
+
+// MD5 is broken
+var md5 = MD5.Create(); 
+// SHA1 is broken
+var sha1 = SHA1.Create(); 
+// DES is broken
+var des = DES.Create();
+```
+
+**Correct (strong algorithms):**
+
+```csharp
+// SHA-256 or higher for hashing
+using var sha256 = SHA256.Create();
+
+// AES for encryption (GCM recommended)
+using var aes = Aes.Create();
+aes.KeySize = 256;
+aes.Mode = CipherMode.CBC; // Or GCM via AesGcm class
+```
+
+**Tools:** Roslyn Analyzers (CA5350, CA5351), SonarQube

package/skill-assets/sunlint-code-quality/rules/csharp/S010-csprng.md

@@ -0,0 +1,32 @@
+---
+title: Use CSPRNG For Security Purposes
+impact: HIGH
+impactDescription: prevents predictable random numbers
+tags: crypto, random, entropy, csprng, security, csharp
+---
+
+## Use CSPRNG For Security Purposes
+
+`System.Random` is not cryptographically secure and should not be used for tokens, keys, or passwords.
+
+**Incorrect (predictable):**
+
+```csharp
+var random = new Random();
+var token = random.Next(100000, 999999); // Predictable!
+```
+
+**Correct (CSPRNG):**
+
+```csharp
+using System.Security.Cryptography;
+
+// Generate secure bytes
+var bytes = new byte[32];
+RandomNumberGenerator.Fill(bytes);
+
+// Or for integers
+var secureInt = RandomNumberGenerator.GetInt32(100000, 999999);
+```
+
+**Tools:** Roslyn Analyzers (CA5394), SonarQube

package/skill-assets/sunlint-code-quality/rules/csharp/S011-encrypted-client-hello.md

@@ -0,0 +1,36 @@
+---
+title: Enable Encrypted Client Hello (ECH)
+impact: HIGH
+impactDescription: protects privacy of connection metadata
+tags: tls, ech, privacy, encryption, security, csharp
+---
+
+## Enable Encrypted Client Hello (ECH)
+
+ECH encrypts the initial TLS handshake (SNI) to prevent ISPs from seeing which domain you are connecting to.
+
+**Status:**
+- Support in .NET is dependent on the underlying OS (OpenSSL 3+ on Linux, Windows 11+).
+- Requires DNS configuration (HTTPS records).
+
+**Implementation:**
+
+```csharp
+// Kestrel configuration (mostly transparent if OS supports it)
+// Ensure you are using HTTP/3 (QUIC) and latest TLS
+webBuilder.ConfigureKestrel(options =>
+{
+    options.ListenAnyIP(443, listenOptions =>
+    {
+        listenOptions.UseHttps();
+        listenOptions.Protocols = HttpProtocols.Http1AndHttp2AndHttp3;
+    });
+});
+```
+
+**Checklist:**
+- [ ] Configure DNS HTTPS records
+- [ ] Use Cloudflare or ECH-enabled CDN
+- [ ] Ensure underlying OS supports ECH
+
+**Tools:** SSL Labs, Wireshark

package/skill-assets/sunlint-code-quality/rules/csharp/S012-secrets-management.md

@@ -0,0 +1,35 @@
+---
+title: Use Secrets Management For Backend Secrets
+impact: CRITICAL
+impactDescription: centralizes and secures credential storage
+tags: secrets, vault, credentials, configuration, security, csharp
+---
+
+## Use Secrets Management For Backend Secrets
+
+Avoid hardcoding secrets or committing them to source control. Use standard mechanisms like User Secrets (dev) and KeyVault/Environment Variables (prod).
+
+**Incorrect (hardcoded):**
+
+```csharp
+public void ConfigureServices(IServiceCollection services)
+{
+    var apiKey = "sk-1234567890"; // Hardcoded secret
+}
+```
+
+**Correct (secrets management):**
+
+```csharp
+// Development: dotnet user-secrets set "ApiKey" "..."
+// Production: Azure Key Vault or Environment Variables
+
+public void ConfigureServices(IServiceCollection services)
+{
+    var apiKey = Configuration["ApiKey"]; // Loaded from secure source
+    
+    if (string.IsNullOrEmpty(apiKey)) throw new Exception("ApiKey missing");
+}
+```
+
+**Tools:** Azure Key Vault, AWS Secrets Manager, dotnet user-secrets

package/skill-assets/sunlint-code-quality/rules/csharp/S013-tls-connections.md

@@ -0,0 +1,36 @@
+---
+title: Always Use TLS For All Connections
+impact: HIGH
+impactDescription: protects data in transit from eavesdropping
+tags: tls, https, encryption, transport, security, csharp
+---
+
+## Always Use TLS For All Connections
+
+Force HTTPS in your application and ensure all external connections use TLS.
+
+**Incorrect (HTTP):**
+
+```csharp
+// Unencrypted HttpClient
+var client = new HttpClient { BaseAddress = new Uri("http://api.example.com") };
+```
+
+**Correct (HTTPS Enforcement):**
+
+```csharp
+// Startup.cs / Program.cs
+public void Configure(IApplicationBuilder app)
+{
+    // Force HTTPS Redirection
+    app.UseHttpsRedirection();
+    
+    // HSTS (Strict Transport Security)
+    app.UseHsts();
+}
+
+// Secure HttpClient
+var client = new HttpClient { BaseAddress = new Uri("https://api.example.com") };
+```
+
+**Tools:** SSLyze, OWASP ZAP

package/skill-assets/sunlint-code-quality/rules/csharp/S016-no-sensitive-query-string.md

@@ -0,0 +1,39 @@
+---
+title: Do Not Pass Sensitive Data In Query String
+impact: HIGH
+impactDescription: prevents sensitive data leakage in logs
+tags: sensitive-data, query-string, logging, privacy, security, csharp
+---
+
+## Do Not Pass Sensitive Data In Query String
+
+Query strings are logged by servers, proxies, and browsers. Never put passwords, tokens, or PII in URL parameters.
+
+**Incorrect (sensitive data in URL):**
+
+```csharp
+[HttpGet]
+// DANGEROUS: /login?password=secret
+public IActionResult Login(string username, string password) 
+{
+    // ...
+}
+
+var url = $"https://api.example.com/reset?token={resetToken}";
+```
+
+**Correct (POST body or Headers):**
+
+```csharp
+[HttpPost]
+public IActionResult Login([FromBody] LoginModel model)
+{
+    // Password is in body, not URL
+    // ...
+}
+
+// Pass tokens in Headers
+client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", token);
+```
+
+**Tools:** Roslyn Analyzers, SonarQube

package/skill-assets/sunlint-code-quality/rules/csharp/S017-parameterized-queries.md

@@ -0,0 +1,47 @@
+---
+title: Always Use Parameterized Queries
+impact: CRITICAL
+impactDescription: prevents SQL and NoSQL injection attacks
+tags: injection, sql, nosql, database, parameterized, security, csharp
+---
+
+## Always Use Parameterized Queries
+
+SQL injection is one of the top security vulnerabilities. Direct string concatenation allows attackers to execute arbitrary database commands, steal data, or destroy databases.
+
+**Incorrect (string concatenation):**
+
+```csharp
+// SQL Injection vulnerability with ADO.NET
+string userId = Request.QueryString["id"];
+string query = "SELECT * FROM Users WHERE Id = '" + userId + "'";
+SqlCommand cmd = new SqlCommand(query, connection);
+var reader = cmd.ExecuteReader(); 
+
+// Vulnerability with EF Core (FromSqlRaw)
+var user = context.Users
+    .FromSqlRaw($"SELECT * FROM Users WHERE Id = '{userId}'")
+    .FirstOrDefault();
+```
+
+**Correct (parameterized queries):**
+
+```csharp
+// Parameterized query - ADO.NET
+string userId = Request.QueryString["id"];
+string query = "SELECT * FROM Users WHERE Id = @Id";
+SqlCommand cmd = new SqlCommand(query, connection);
+cmd.Parameters.AddWithValue("@Id", userId); // Safe
+var reader = cmd.ExecuteReader();
+
+// EF Core - Automatically parameterized
+var user = context.Users
+    .FirstOrDefault(u => u.Id == userId);
+
+// EF Core - Interpolated SQL (Safe)
+var user = context.Users
+    .FromSqlInterpolated($"SELECT * FROM Users WHERE Id = {userId}")
+    .FirstOrDefault();
+```
+
+**Tools:** Roslyn Analyzers (CA2100), SonarQube (S2077, S3649), Security Code Scan

package/skill-assets/sunlint-code-quality/rules/csharp/S019-email-input-sanitization.md

@@ -0,0 +1,35 @@
+---
+title: Sanitize Input Before Sending Emails
+impact: MEDIUM
+impactDescription: prevents email header injection
+tags: email, injection, sanitization, input-validation, security, csharp
+---
+
+## Sanitize Input Before Sending Emails
+
+Email header injection allows attackers to inject headers (Bcc, From) by including CRLF characters in input fields.
+
+**Incorrect (unsanitized inputs):**
+
+```csharp
+// Vulnerable to Header Injection
+var message = new MailMessage();
+message.Subject = userInput; // "Subject\r\nBcc: victim@example.com"
+```
+
+**Correct (sanitized email fields):**
+
+```csharp
+public string SanitizeEmailHeader(string input)
+{
+    if (string.IsNullOrEmpty(input)) return input;
+    // Remove newlines to prevent header injection
+    return Regex.Replace(input, @"[\r\n]", ""); // Simple removal
+}
+
+var message = new MailMessage();
+message.Subject = SanitizeEmailHeader(userInput);
+message.Body = userInput; // Body is usually safe from header injection, but beware XSS if HTML
+```
+
+**Tools:** Security Code Scan, SonarQube

package/skill-assets/sunlint-code-quality/rules/csharp/S020-eval-code-execution.md

@@ -0,0 +1,56 @@
+---
+title: Avoid Eval Or Dynamic Code Execution
+impact: HIGH
+impactDescription: prevents remote code execution vulnerabilities
+tags: eval, code-execution, rce, injection, security, csharp
+---
+
+## Avoid Eval Or Dynamic Code Execution
+
+Dynamic code execution functions allow attackers to execute arbitrary code on the server. In C#, this often involves `Assembly.Load`, `Process.Start` with user input, or dynamic compilation tools like Roslyn scripting.
+
+**Incorrect (dynamic code execution):**
+
+```csharp
+// Executing user input as code
+using Microsoft.CodeAnalysis.CSharp.Scripting;
+
+string userCode = Request.Form["code"];
+var result = await CSharpScript.EvaluateAsync(userCode); // RCE Vulnerability!
+
+// Loading arbitrary assembly
+var assembly = Assembly.LoadFile(userInputPath); // Dangerous
+
+// Command Injection via Process.Start
+Process.Start("cmd.exe", "/c " + userInput); 
+```
+
+**Correct (safe alternatives):**
+
+```csharp
+// Use a math parser library for formulas
+var result = new DataTable().Compute("1 + 2", null); // Simple math only
+
+// Use Strategy Pattern or Dictionary for dynamic logic
+var actions = new Dictionary<string, Action>
+{
+    { "start", StartService },
+    { "stop", StopService }
+};
+
+if (actions.TryGetValue(userInput, out var action))
+{
+    action();
+}
+
+// Process.Start with explicit arguments (no shell execute)
+var startInfo = new ProcessStartInfo
+{
+    FileName = "git",
+    ArgumentList = { "status" }, // Safe list
+    UseShellExecute = false
+};
+Process.Start(startInfo);
+```
+
+**Tools:** Roslyn Analyzers, SonarQube (S1523), Security Code Scan

package/skill-assets/sunlint-code-quality/rules/csharp/S022-context-escaping.md

@@ -0,0 +1,50 @@
+---
+title: Escape Data By Output Context
+impact: MEDIUM
+impactDescription: ensures correct encoding for each output context
+tags: xss, escaping, context, encoding, security, csharp
+---
+
+## Escape Data By Output Context
+
+Different output contexts (HTML, JavaScript, URL, Header) require different encoding methods.
+
+**Incorrect (wrong context encoding):**
+
+```csharp
+// Razor View - Script Context
+<script>
+    // XSS: If userInput contains quotes, it breaks the string
+    var userData = "@Model.UserInput"; 
+</script>
+
+// Header Injection
+Response.Headers.Add("X-Custom", userInput);
+```
+
+**Correct (context-appropriate encoding):**
+
+```csharp
+using System.Text.Encodings.Web;
+
+// JavaScript Context in Razor
+<script>
+    var userData = @Json.Serialize(Model.UserInput); // Safe JSON encoding
+</script>
+
+// Explicit JS Encoder
+var safeJs = JavaScriptEncoder.Default.Encode(userInput);
+
+// URL Context
+var safeUrl = UrlEncoder.Default.Encode(userInput);
+// or
+var safeUrl = Uri.EscapeDataString(userInput);
+
+// Header - Strip CRLF
+if (!userInput.Contains('\r') && !userInput.Contains('\n'))
+{
+    Response.Headers.Add("X-Custom", userInput);
+}
+```
+
+**Tools:** Roslyn Analyzers, SonarQube

package/skill-assets/sunlint-code-quality/rules/csharp/S023-dynamic-js-encoding.md

@@ -0,0 +1,34 @@
+---
+title: Output Encoding For Dynamic JS/JSON
+impact: HIGH
+impactDescription: prevents injection in JavaScript contexts
+tags: xss, javascript, json, encoding, security, csharp
+---
+
+## Output Encoding For Dynamic JS/JSON
+
+Embedding user data in JavaScript or JSON blocks in Razor pages requires proper encoding.
+
+**Incorrect (unescaped data in JS):**
+
+```csharp
+// XSS in Razor
+<script>
+    var user = "@Model.Username"; // Vulnerable if Username contains quotes
+</script>
+```
+
+**Correct (proper JSON encoding):**
+
+```csharp
+// Use Json.Serialize in Razor
+<script>
+    var user = @Json.Serialize(Model.Username); // Encodes quotes and special chars
+</script>
+
+// Or encode explicitly in C#
+var safeJson = JsonConvert.SerializeObject(userData); // Newtonsoft
+var safeJson = JsonSerializer.Serialize(userData); // System.Text.Json
+```
+
+**Tools:** Roslyn Analyzers, SonarQube

package/skill-assets/sunlint-code-quality/rules/csharp/S025-server-validation.md

@@ -0,0 +1,56 @@
+---
+title: Always Validate Client Data Server-side
+impact: MEDIUM
+impactDescription: ensures input validation cannot be bypassed
+tags: validation, server-side, input, sanitization, security, csharp
+---
+
+## Always Validate Client Data Server-side
+
+Client-side validation is for UX only and can be bypassed. Always validate in your C# Controllers or Services.
+
+**Incorrect (trusting client):**
+
+```csharp
+[HttpPost]
+public IActionResult Transfer(TransferRequest request)
+{
+    // trusting that frontend sent valid data
+    _service.Transfer(request.Amount, request.ToAccount);
+    return Ok();
+}
+```
+
+**Correct (comprehensive server validation):**
+
+```csharp
+// Using FluentValidation
+public class TransferRequestValidator : AbstractValidator<TransferRequest>
+{
+    public TransferRequestValidator()
+    {
+        RuleFor(x => x.Amount).GreaterThan(0).LessThan(10000);
+        RuleFor(x => x.ToAccount).Matches(@"^[A-Z]{2}\d{18}$");
+    }
+}
+
+[HttpPost]
+public IActionResult Transfer(TransferRequest request)
+{
+    if (!ModelState.IsValid) 
+    {
+        return BadRequest(ModelState);
+    }
+    
+    // Business validation
+    if (!_service.AccountExists(request.ToAccount)) 
+    {
+        return NotFound("Account not found");
+    }
+
+    _service.Transfer(request.Amount, request.ToAccount);
+    return Ok();
+}
+```
+
+**Tools:** FluentValidation, DataAnnotations, SonarQube

package/skill-assets/sunlint-code-quality/rules/csharp/S026-tls-encryption.md

@@ -0,0 +1,28 @@
+---
+title: TLS Encryption For All Connections (Database)
+impact: CRITICAL
+impactDescription: protects data in transit from interception
+tags: tls, encryption, https, transport, security, csharp
+---
+
+## TLS Encryption For All Connections (Database)
+
+Database connections must be encrypted.
+
+**Incorrect (unencrypted connection string):**
+
+```
+Server=myServerAddress;Database=myDataBase;User Id=myUsername;Password=myPassword;
+```
+
+**Correct (encrypted):**
+
+```
+// SQL Server
+Server=myServerAddress;...;Encrypt=True;TrustServerCertificate=False;
+
+// PostgreSQL (Npgsql)
+Server=...;SSL Mode=Require;
+```
+
+**Tools:** Connection String validation

package/skill-assets/sunlint-code-quality/rules/csharp/S027-mtls-validation.md

@@ -0,0 +1,40 @@
+---
+title: Validate mTLS Certificates Before Auth
+impact: CRITICAL
+impactDescription: ensures mutual authentication between services
+tags: mtls, certificates, authentication, service-mesh, security, csharp
+---
+
+## Validate mTLS Certificates Before Auth
+
+Use Mutual TLS for service-to-service authentication.
+
+**Configuration (Kestrel):**
+
+```csharp
+webBuilder.ConfigureKestrel(options =>
+{
+    options.ConfigureHttpsDefaults(httpsOptions =>
+    {
+        httpsOptions.ClientCertificateMode = ClientCertificateMode.RequireCertificate;
+        
+        // Custom validation logic
+        httpsOptions.ClientCertificateValidation = (cert, chain, errors) =>
+        {
+            return cert.Issuer == "CN=MyInternalCA";
+        };
+    });
+});
+```
+
+**Authorization:**
+
+```csharp
+services.AddAuthentication(CertificateAuthenticationDefaults.AuthenticationScheme)
+    .AddCertificate();
+
+[Authorize]
+public IActionResult InternalApi() { }
+```
+
+**Tools:** Kestrel Configuration, OpenSSL

package/skill-assets/sunlint-code-quality/rules/csharp/S028-upload-limits.md

@@ -0,0 +1,50 @@
+---
+title: Limit Upload File Size And Count
+impact: HIGH
+impactDescription: prevents DoS via resource exhaustion
+tags: upload, dos, resource-limits, files, security, csharp
+---
+
+## Limit Upload File Size And Count
+
+Unrestricted file uploads can exhaust server disk space and memory (DoS).
+
+**Incorrect (unlimited):**
+
+```csharp
+[HttpPost]
+public async Task<IActionResult> Upload(List<IFormFile> files)
+{
+    foreach (var file in files)
+    {
+        // No size check!
+        await file.CopyToAsync(stream);
+    }
+}
+```
+
+**Correct (limits):**
+
+```csharp
+// Global limit in Startup
+services.Configure<FormOptions>(options =>
+{
+    options.MultipartBodyLengthLimit = 10 * 1024 * 1024; // 10MB
+});
+
+// Action-specific limit
+[HttpPost]
+[RequestSizeLimit(10 * 1024 * 1024)]
+public async Task<IActionResult> Upload(List<IFormFile> files)
+{
+    if (files.Count > 5) return BadRequest("Too many files");
+
+    foreach (var file in files)
+    {
+        if (file.Length > 2 * 1024 * 1024) return BadRequest("File too large");
+        // ...
+    }
+}
+```
+
+**Tools:** ASP.NET Core Middleware, IIS Request Filtering