@sun-asterisk/sunlint 1.3.39 → 1.3.40

package/skill-assets/sunlint-code-quality/rules/csharp/S051-password-length.md

@@ -0,0 +1,35 @@
+---
+title: Support 12-64 Character Passwords
+impact: MEDIUM
+impactDescription: enables secure passphrase usage
+tags: password, length, passphrase, security, csharp
+---
+
+## Support 12-64 Character Passwords
+
+Allow users to use long passphrases.
+
+**Configuration:**
+
+```csharp
+services.Configure<IdentityOptions>(options =>
+{
+    options.Password.RequiredLength = 12;
+    options.Password.RequireDigit = true;
+    options.Password.RequireLowercase = true;
+    options.Password.RequireNonAlphanumeric = true; 
+    options.Password.RequireUppercase = true; 
+});
+```
+
+**Validation:**
+
+```csharp
+public class RegisterModel
+{
+    [StringLength(100, MinimumLength = 12)]
+    public string Password { get; set; }
+}
+```
+
+**Tools:** ASP.NET Identity

package/skill-assets/sunlint-code-quality/rules/csharp/S052-otp-entropy.md

@@ -0,0 +1,26 @@
+---
+title: OTPs Must Have 20-bit Entropy Minimum
+impact: MEDIUM
+impactDescription: prevents OTP brute-forcing
+tags: otp, entropy, authentication, 2fa, security, csharp
+---
+
+## OTPs Must Have 20-bit Entropy Minimum
+
+Use CSPRNG for OTP generation.
+
+**Incorrect (Random):**
+
+```csharp
+var otp = new Random().Next(1000, 9999);
+```
+
+**Correct (CSPRNG):**
+
+```csharp
+// 6 digits
+int otp = RandomNumberGenerator.GetInt32(0, 1000000);
+string otpString = otp.ToString("D6");
+```
+
+**Tools:** Roslyn Analyzers

package/skill-assets/sunlint-code-quality/rules/csharp/S053-generic-error-messages.md

@@ -0,0 +1,32 @@
+---
+title: Return Generic Error Messages
+impact: HIGH
+impactDescription: prevents information disclosure
+tags: error-messages, information-disclosure, security, csharp
+---
+
+## Return Generic Error Messages
+
+Don't leak stack traces or internal details to users.
+
+**Incorrect (Dev Exception Page in Prod):**
+
+```csharp
+// Startup.cs
+app.UseDeveloperExceptionPage(); // Dangerous in Prod
+```
+
+**Correct (Generic Error Handler):**
+
+```csharp
+if (env.IsDevelopment())
+{
+    app.UseDeveloperExceptionPage();
+}
+else
+{
+    app.UseExceptionHandler("/Error");
+}
+```
+
+**Tools:** ASP.NET Core Middleware

package/skill-assets/sunlint-code-quality/rules/csharp/S054-no-default-admin.md

@@ -0,0 +1,31 @@
+---
+title: Avoid Default Admin/Root Accounts
+impact: HIGH
+impactDescription: prevents easy initial access by attackers
+tags: admin, default-accounts, credentials, security, csharp
+---
+
+## Avoid Default Admin/Root Accounts
+
+Do not seed default admin accounts with known passwords.
+
+**Incorrect:**
+
+```csharp
+// Seeding
+if (!users.Any())
+{
+    userManager.CreateAsync(new User("admin"), "Admin123!"); 
+}
+```
+
+**Correct:**
+
+```csharp
+// Require setup via UI or CLI, or use random password printed to logs on first startup
+var pwd = GenerateRandomPassword();
+logger.LogInformation("Generated Admin Password: {Pwd}", pwd);
+userManager.CreateAsync(new User("admin"), pwd);
+```
+
+**Tools:** Manual Review

package/skill-assets/sunlint-code-quality/rules/csharp/S055-content-type-validation.md

@@ -0,0 +1,44 @@
+---
+title: Validate Content-Type In REST Services
+impact: MEDIUM
+impactDescription: prevents content-type confusion attacks
+tags: rest, content-type, validation, api, security, csharp
+---
+
+## Validate Content-Type In REST Services
+
+Ensure your API only accepts expected content types to avoid parsing vulnerabilities.
+
+**Incorrect (accepting anything):**
+
+```csharp
+[HttpPost]
+public IActionResult Upload(IFormFile file) 
+{
+    // No check on Content-Type or file signature
+}
+```
+
+**Correct (strict validation):**
+
+```csharp
+[HttpPost]
+[Consumes("application/json")] // Force valid Content-Type
+public IActionResult UpdateData([FromBody] DataModel model)
+{
+    return Ok();
+}
+
+// Manual check for files
+public IActionResult Upload(IFormFile file)
+{
+    if (file.ContentType != "image/png" && file.ContentType != "image/jpeg")
+    {
+        return BadRequest("Invalid Content-Type");
+    }
+    // Also validate file signature/magic numbers!
+    return Ok();
+}
+```
+
+**Tools:** Roslyn Analyzers, SonarQube

package/skill-assets/sunlint-code-quality/rules/csharp/S056-log-injection.md

@@ -0,0 +1,33 @@
+---
+title: Protect Against Log Injection
+impact: HIGH
+impactDescription: prevents log forging and exploitation
+tags: logging, injection, sanitization, security, csharp
+---
+
+## Protect Against Log Injection
+
+Attackers can inject newlines to forge log entries or confuse monitoring systems.
+
+**Incorrect (raw logging):**
+
+```csharp
+_logger.LogInformation("User logged in: " + username); 
+// Attacker: "admin\n[ERROR] System failure"
+```
+
+**Correct (structured logging or sanitization):**
+
+```csharp
+// Structured Logging (Serilog/MEL) - Safe by default as it treats data as properties
+_logger.LogInformation("User logged in: {Username}", username);
+
+// If using simple text logging, sanitize
+string SanitizeLog(string input)
+{
+    return input.Replace("\n", "_").Replace("\r", "_");
+}
+_logger.LogInformation($"User logged in: {SanitizeLog(username)}");
+```
+
+**Tools:** Serilog, Roslyn Analyzers, SonarQube

package/skill-assets/sunlint-code-quality/rules/csharp/S057-synchronized-time.md

@@ -0,0 +1,27 @@
+---
+title: Use Synchronized Time (UTC) In Logs
+impact: MEDIUM
+impactDescription: enables accurate incident correlation
+tags: logging, time, utc, synchronization, security, csharp
+---
+
+## Use Synchronized Time (UTC) In Logs
+
+Always use UTC time for logs and database records.
+
+**Incorrect (local time):**
+
+```csharp
+_logger.LogInformation("Action at {Time}", DateTime.Now); // Depends on server timezone
+```
+
+**Correct (UTC):**
+
+```csharp
+_logger.LogInformation("Action at {Time}", DateTime.UtcNow); 
+
+// Configure Serilog to output UTC
+// .WriteTo.Console(outputTemplate: "{Timestamp:u} ...")
+```
+
+**Tools:** Roslyn Analyzers, SonarQube

package/skill-assets/sunlint-code-quality/rules/csharp/S058-ssrf-protection.md

@@ -0,0 +1,54 @@
+---
+title: Protect Against SSRF Attacks
+impact: MEDIUM
+impactDescription: prevents internal network access from user input
+tags: ssrf, url, network, internal, security, csharp
+---
+
+## Protect Against SSRF Attacks
+
+Server-Side Request Forgery occurs when the server fetches a URL provided by the attacker.
+
+**Incorrect (fetching user URL):**
+
+```csharp
+public async Task<string> FetchUrl(string url)
+{
+    using var client = new HttpClient();
+    return await client.GetStringAsync(url); // Attacker can access internal metadata/localhost
+}
+```
+
+**Correct (validation):**
+
+```csharp
+public async Task<string> SafeFetchUrl(string inputUrl)
+{
+    if (!Uri.TryCreate(inputUrl, UriKind.Absolute, out var uri))
+        throw new ArgumentException("Invalid URL");
+
+    if (uri.Scheme != "http" && uri.Scheme != "https")
+        throw new ArgumentException("Invalid Scheme");
+
+    // Block non-standard ports
+    if (!uri.IsDefaultPort) throw new ArgumentException("Port not allowed");
+
+    // Resolve IP and check blocklist (simplified)
+    var ipAddresses = await Dns.GetHostAddressesAsync(uri.DnsSafeHost);
+    foreach (var ip in ipAddresses)
+    {
+        if (IsPrivateIp(ip)) throw new Exception("SSRF Detected: Private IP");
+    }
+
+    using var client = new HttpClient();
+    return await client.GetStringAsync(uri);
+}
+
+private bool IsPrivateIp(IPAddress ip)
+{
+    // Check for 127.0.0.1, 10.x.x.x, 192.168.x.x, etc.
+    return IPAddress.IsLoopback(ip) || ip.ToString().StartsWith("10.") || ip.ToString().StartsWith("192.168.");
+}
+```
+
+**Tools:** Security Code Scan, SonarQube

package/skill-assets/sunlint-code-quality/rules/java/C006-verb-noun-functions.md

@@ -0,0 +1,36 @@
+---
+title: Function Names Verb-Noun Pattern
+impact: MEDIUM
+impactDescription: improves code readability and maintainability
+tags: readability, naming, best-practice, java
+---
+
+## Function Names Verb-Noun Pattern
+
+Method names should clearly state what they do. Following a `verbNoun` pattern (camelCase) makes the code more intuitive and easier to scan.
+
+**Incorrect (vague or reverse naming):**
+
+```java
+public void userData(User user) { ... }
+public List<User> usersGet() { ... }
+public void process() { ... }
+```
+
+**Correct (verb-noun naming):**
+
+```java
+public void saveUser(User user) { ... }
+public List<User> getAllUsers() { ... }
+public void processPayment() { ... }
+public boolean isValidEmail(String email) { ... }
+```
+
+**Common Verbs:**
+- `get` / `find`: Retrieve data.
+- `save` / `create` / `update`: Modify data.
+- `is` / `has`: Boolean checks.
+- `validate`: Check constraints.
+- `calculate`: Perform computations.
+
+**Tools:** Checkstyle, IntelliJ Inspections, Manual Review

package/skill-assets/sunlint-code-quality/rules/java/C013-no-dead-code.md

@@ -0,0 +1,175 @@
+---
+title: Do Not Commit Dead Code
+impact: MEDIUM
+impactDescription: reduces codebase clutter and potential for bugs
+tags: readability, clean-code, maintainability, java
+---
+
+## Do Not Commit Dead Code
+
+Dead code (commented-out code, unused methods, unreachable branches) increases technical debt and makes the codebase harder to maintain and understand. 
+
+**Incorrect (commented code or unreachable blocks):**
+
+```java
+public void calculate() {
+    int x = 10;
+    // int y = 20; // DEAD CODE
+    // if (x > 5) { ... } // DEAD CODE
+    System.out.println(x);
+}
+```
+
+**Correct (clean code):**
+
+```java
+public void calculate() {
+    int x = 10;
+    System.out.println(x);
+}
+```
+
+**Tools:** IntelliJ Inspections, PMD, SonarQube (S1144), Checkstyle
+---
+title: Use Dependency Injection
+impact: HIGH
+impactDescription: improves testability and decouples components
+tags: dependency-injection, spring, testing, java
+---
+
+## Use Dependency Injection
+
+Hardcoding dependencies (using `new`) makes components tightly coupled and difficult to test. Dependency Injection (DI) allows the framework to manage object lifecycles and permits easy mocking during unit tests.
+
+**Incorrect (tight coupling):**
+
+```java
+public class UserService {
+    private final UserRepository repo = new UserRepository(); // VULNERABLE to tight coupling
+    
+    public void save(User user) {
+        repo.save(user);
+    }
+}
+```
+
+**Correct (constructor injection):**
+
+```java
+@Service
+public class UserService {
+    private final UserRepository repo;
+
+    // SECURE: Dependency is injected via constructor
+    public UserService(UserRepository repo) {
+        this.repo = repo;
+    }
+    
+    public void save(User user) {
+        repo.save(user);
+    }
+}
+```
+
+**Tools:** Spring Framework, Dagger, Guice, SonarQube (S3306)
+---
+title: No Business Logic In Constructors
+impact: MEDIUM
+impactDescription: prevents side effects during object instantiation and improves testability
+tags: clean-code, best-practice, java
+---
+
+## No Business Logic In Constructors
+
+Constructors should only be used for initialized fields. Performing business logic (database calls, network requests) inside a constructor makes the object hard to test and can lead to unexpected side effects during initialization.
+
+**Incorrect (logic in constructor):**
+
+```java
+public class OrderService {
+    public OrderService() {
+        // VULNERABLE: Side effects during new OrderService()
+        loadConfiguration();
+        connectToDatabase();
+    }
+}
+```
+
+**Correct (separate initialization):**
+
+```java
+public class OrderService {
+    public OrderService() {
+        // Only simple field assignments
+    }
+
+    @PostConstruct
+    public void init() {
+        // Business logic or heavy setup here
+    }
+}
+```
+
+**Tools:** Manual Review, SonarQube (S1699)
+---
+title: Do Not Throw Generic Errors
+impact: MEDIUM
+impactDescription: makes error handling difficult for the caller
+tags: error-handling, exceptions, java
+---
+
+## Do Not Throw Generic Errors
+
+Throwing `Exception` or `RuntimeException` provides no context to the caller. Always throw specific, meaningful exceptions.
+
+**Incorrect (generic throws):**
+
+```java
+public void findUser(String id) throws Exception {
+    if (id == null) throw new Exception("ID missing");
+}
+```
+
+**Correct (specific throws):**
+
+```java
+public void findUser(String id) {
+    if (id == null) throw new IllegalArgumentException("User ID cannot be null");
+}
+```
+
+**Tools:** SonarQube (S2221), Manual Review
+---
+title: Do Not Use Error Log Level For Non-Critical Issues
+impact: MEDIUM
+impactDescription: prevents log noise and ensures relevant alerts
+tags: logging, best-practice, java
+---
+
+## Do Not Use Error Log Level For Non-Critical Issues
+
+The `ERROR` level should be reserved for issues that require immediate developer attention. For expected failures (like invalid user input), use `WARN` or `INFO`.
+
+**Incorrect (error for everything):**
+
+```java
+if (user == null) {
+    log.error("User not found: {}", id); // Should be WARN or INFO
+}
+```
+
+**Correct (appropriate log levels):**
+
+```java
+if (user == null) {
+    log.warn("Attempt to access non-existent user: {}", id);
+}
+
+try {
+    db.save(data);
+} catch (SQLException e) {
+    log.error("Critical database failure", e); // TRUE ERROR
+}
+```
+
+**Tools:** Manual Review

package/skill-assets/sunlint-code-quality/rules/java/C014-dependency-injection.md

@@ -0,0 +1,42 @@
+---
+title: Use Dependency Injection
+impact: HIGH
+impactDescription: improves testability and decouples components
+tags: dependency-injection, spring, testing, java
+---
+
+## Use Dependency Injection
+
+Hardcoding dependencies (using `new`) makes components tightly coupled and difficult to test. Dependency Injection (DI) allows the framework to manage object lifecycles and permits easy mocking during unit tests.
+
+**Incorrect (tight coupling):**
+
+```java
+public class UserService {
+    private final UserRepository repo = new UserRepository(); // VULNERABLE to tight coupling
+    
+    public void save(User user) {
+        repo.save(user);
+    }
+}
+```
+
+**Correct (constructor injection):**
+
+```java
+@Service
+public class UserService {
+    private final UserRepository repo;
+
+    // SECURE: Dependency is injected via constructor
+    public UserService(UserRepository repo) {
+        this.repo = repo;
+    }
+    
+    public void save(User user) {
+        repo.save(user);
+    }
+}
+```
+
+**Tools:** Spring Framework, Dagger, Guice, SonarQube (S3306)

package/skill-assets/sunlint-code-quality/rules/java/C017-no-constructor-logic.md

@@ -0,0 +1,39 @@
+---
+title: No Business Logic In Constructors
+impact: MEDIUM
+impactDescription: prevents side effects during object instantiation and improves testability
+tags: clean-code, best-practice, java
+---
+
+## No Business Logic In Constructors
+
+Constructors should only be used for initialized fields. Performing business logic (database calls, network requests) inside a constructor makes the object hard to test and can lead to unexpected side effects during initialization.
+
+**Incorrect (logic in constructor):**
+
+```java
+public class OrderService {
+    public OrderService() {
+        // VULNERABLE: Side effects during new OrderService()
+        loadConfiguration();
+        connectToDatabase();
+    }
+}
+```
+
+**Correct (separate initialization):**
+
+```java
+public class OrderService {
+    public OrderService() {
+        // Only simple field assignments
+    }
+
+    @PostConstruct
+    public void init() {
+        // Business logic or heavy setup here
+    }
+}
+```
+
+**Tools:** Manual Review, SonarQube (S1699)

package/skill-assets/sunlint-code-quality/rules/java/C018-generic-errors.md

@@ -0,0 +1,28 @@
+---
+title: Do Not Throw Generic Errors
+impact: MEDIUM
+impactDescription: makes error handling difficult for the caller
+tags: error-handling, exceptions, java
+---
+
+## Do Not Throw Generic Errors
+
+Throwing `Exception` or `RuntimeException` provides no context to the caller. Always throw specific, meaningful exceptions.
+
+**Incorrect (generic throws):**
+
+```java
+public void findUser(String id) throws Exception {
+    if (id == null) throw new Exception("ID missing");
+}
+```
+
+**Correct (specific throws):**
+
+```java
+public void findUser(String id) {
+    if (id == null) throw new IllegalArgumentException("User ID cannot be null");
+}
+```
+
+**Tools:** SonarQube (S2221), Manual Review

package/skill-assets/sunlint-code-quality/rules/java/C019-error-log-level.md

@@ -0,0 +1,34 @@
+---
+title: Do Not Use Error Log Level For Non-Critical Issues
+impact: MEDIUM
+impactDescription: prevents log noise and ensures relevant alerts
+tags: logging, best-practice, java
+---
+
+## Do Not Use Error Log Level For Non-Critical Issues
+
+The `ERROR` level should be reserved for issues that require immediate developer attention. For expected failures (like invalid user input), use `WARN` or `INFO`.
+
+**Incorrect (error for everything):**
+
+```java
+if (user == null) {
+    log.error("User not found: {}", id); // Should be WARN or INFO
+}
+```
+
+**Correct (appropriate log levels):**
+
+```java
+if (user == null) {
+    log.warn("Attempt to access non-existent user: {}", id);
+}
+
+try {
+    db.save(data);
+} catch (SQLException e) {
+    log.error("Critical database failure", e); // TRUE ERROR
+}
+```
+
+**Tools:** Manual Review

package/skill-assets/sunlint-code-quality/rules/java/C020-no-unused-imports.md

@@ -0,0 +1,34 @@
+---
+title: Do Not Import Unused Modules
+impact: MEDIUM
+impactDescription: reduces compilation time and avoids namespace pollution
+tags: readability, clean-code, java
+---
+
+## Do Not Import Unused Modules
+
+Unused imports clutter the code and can lead to confusion if multiple classes have the same name in different packages.
+
+**Incorrect (unused imports):**
+
+```java
+import java.util.List;
+import java.util.ArrayList; // UNUSED
+import java.util.stream.Collectors; // UNUSED
+
+public class MyClass {
+    public void run(List<String> list) { ... }
+}
+```
+
+**Correct (clean imports):**
+
+```java
+import java.util.List;
+
+public class MyClass {
+    public void run(List<String> list) { ... }
+}
+```
+
+**Tools:** IntelliJ "Optimize Imports", Checkstyle (UnusedImports), PMD