@sun-asterisk/sunlint 1.3.39 → 1.3.41

package/skill-assets/sunlint-code-quality/rules/go/S003-open-redirect.md

@@ -0,0 +1,80 @@
+---
+title: URL Redirects Must Be In Allow List
+impact: LOW
+impactDescription: prevents open redirect vulnerabilities
+tags: redirect, url, allow-list, validation, security
+---
+
+## URL Redirects Must Be In Allow List
+
+Open redirect vulnerabilities allow attackers to redirect users to malicious sites, often used in phishing attacks.
+
+**Incorrect (unvalidated redirect URL):**
+
+```go
+// Open redirect vulnerability
+http.HandleFunc("/redirect", func(w http.ResponseWriter, r *http.Request) {
+    url := r.URL.Query().Get("url")
+    http.Redirect(w, r, url, http.StatusFound) // Attacker: ?url=https://evil.com
+})
+
+// Partial validation (can be bypassed)
+http.HandleFunc("/redirect", func(w http.ResponseWriter, r *http.Request) {
+    url := r.URL.Query().Get("url")
+    if strings.Contains(url, "example.com") {
+        http.Redirect(w, r, url, http.StatusFound) // Bypass: evil.com?example.com
+    }
+})
+```
+
+**Correct (allow list validation):**
+
+```go
+var allowedRedirectHosts = []string{
+    "example.com",
+    "app.example.com",
+    "admin.example.com",
+}
+
+func isAllowedHost(host string) bool {
+    for _, h := range allowedRedirectHosts {
+        if h == host {
+            return true
+        }
+    }
+    return false
+}
+
+http.HandleFunc("/redirect", func(w http.ResponseWriter, r *http.Request) {
+    targetURL := r.URL.Query().Get("url")
+    
+    parsed, err := url.Parse(targetURL)
+    if err != nil || !isAllowedHost(parsed.Hostname()) {
+        http.Error(w, "Invalid redirect URL", http.StatusBadRequest)
+        return
+    }
+    
+    http.Redirect(w, r, targetURL, http.StatusFound)
+})
+
+// Or use relative URLs only
+http.HandleFunc("/relative-redirect", func(w http.ResponseWriter, r *http.Request) {
+    path := r.URL.Query().Get("path")
+    
+    // Only allow relative paths starting with /
+    if !strings.HasPrefix(path, "/") || strings.HasPrefix(path, "//") {
+        http.Error(w, "Invalid path", http.StatusBadRequest)
+        return
+    }
+    
+    http.Redirect(w, r, path, http.StatusFound)
+})
+```
+
+**Protection strategies:**
+1. Allow list of trusted domains
+2. Use relative URLs only
+3. Validate URL structure
+4. Warning page before external redirects
+
+**Tools:** SonarQube, Semgrep, Manual Review

package/skill-assets/sunlint-code-quality/rules/go/S004-no-log-credentials.md

@@ -0,0 +1,66 @@
+---
+title: Do Not Log Credentials Or Tokens
+impact: MEDIUM
+impactDescription: prevents credential exposure in logs
+tags: logging, credentials, tokens, secrets, security
+---
+
+## Do Not Log Credentials Or Tokens
+
+Logs are often stored unencrypted and accessed by many people. Credentials in logs can be harvested by attackers or accidentally exposed.
+
+**Incorrect (logging sensitive data):**
+
+```go
+// Logging passwords
+slog.Info("Login attempt",
+    "username", user.Username,
+    "password", user.Password, // NEVER!
+)
+
+// Logging tokens
+slog.Debug("Request headers", "headers", r.Header)
+// Authorization header contains token!
+
+// Logging full request body
+body, _ := io.ReadAll(r.Body)
+slog.Info("Incoming request", "body", string(body))
+// May contain password, credit card, etc.
+```
+
+**Correct (sanitized logging):**
+
+```go
+// Mask or omit sensitive fields
+slog.Info("Login attempt",
+    "username", user.Username,
+    // password omitted
+)
+
+// Sanitize headers
+safeHeader := r.Header.Clone()
+if safeHeader.Get("Authorization") != "" {
+    safeHeader.Set("Authorization", "[REDACTED]")
+}
+slog.Debug("Request headers", "headers", safeHeader)
+
+// Use a sanitizer for request body
+func sanitizeForLog(data map[string]any) map[string]any {
+    sensitiveFields := []string{"password", "token", "secret", "credit_card"}
+    for _, field := range sensitiveFields {
+        if _, ok := data[field]; ok {
+            data[field] = "[REDACTED]"
+        }
+    }
+    return data
+}
+```
+
+**Never log:**
+- Passwords (plaintext or hashed)
+- API keys and tokens
+- Credit card numbers
+- Social Security Numbers
+- Session identifiers
+
+**Tools:** SonarQube, Semgrep, Log Audit

package/skill-assets/sunlint-code-quality/rules/go/S005-server-authorization.md

@@ -0,0 +1,55 @@
+---
+title: Enforce Authorization At Trusted Service Layer
+impact: CRITICAL
+impactDescription: prevents client-side authorization bypass
+tags: authorization, server-side, middleware, access-control, security
+---
+
+## Enforce Authorization At Trusted Service Layer
+
+Client-side authorization can be bypassed. All permission checks must occur server-side where they cannot be manipulated.
+
+**Incorrect (client-side or trusting client data):**
+
+```go
+// Trusting client-sent role
+func deleteUserHandler(w http.ResponseWriter, r *http.Request) {
+    userRole := r.FormValue("role") // From client!
+    if userRole == "admin" {
+        deleteUser(r.FormValue("id"))
+    }
+}
+```
+
+**Correct (server-side authorization middleware):**
+
+```go
+func authMiddleware(requiredRole string, next http.HandlerFunc) http.HandlerFunc {
+    return func(w http.ResponseWriter, r *http.Request) {
+        token := r.Header.Get("Authorization")
+        user, err := getUserFromToken(token)
+        if err != nil {
+            http.Error(w, "Unauthorized", http.StatusUnauthorized)
+            return
+        }
+        
+        if !checkPermission(user.ID, requiredRole) {
+            http.Error(w, "Forbidden", http.StatusForbidden)
+            return
+        }
+        
+        next.ServeHTTP(w, r)
+    }
+}
+
+// Router usage
+http.HandleFunc("/users/delete", authMiddleware("admin", deleteUserHandler))
+```
+
+**Never trust:**
+- Client-side JavaScript checks
+- Hidden form fields
+- URL parameters for access control
+- Unvalidated tokens from browser storage
+
+**Tools:** Manual Review, Static Analysis, Penetration Testing

package/skill-assets/sunlint-code-quality/rules/go/S006-default-credentials.md

@@ -0,0 +1,47 @@
+---
+title: Do Not Use Default Credentials
+impact: CRITICAL
+impactDescription: prevents trivial compromise via known credentials
+tags: credentials, default, passwords, configuration, security
+---
+
+## Do Not Use Default Credentials
+
+Default credentials are publicly known. Attackers scan for them automatically, making any system using them trivially compromised.
+
+**Incorrect (default or hardcoded credentials):**
+
+```yaml
+# Docker Compose with defaults
+services:
+  postgres:
+    image: postgres
+    environment:
+      POSTGRES_USER: postgres
+      POSTGRES_PASSWORD: postgres  # Default!
+```
+
+**Correct (environment/secrets management):**
+
+```go
+// Application code
+dbConfig := struct {
+    User     string
+    Password string
+}{
+    User:     os.Getenv("DB_USER"),
+    Password: os.Getenv("DB_PASSWORD"),
+}
+
+// Validate no defaults
+if dbConfig.Password == "admin" || dbConfig.Password == "password" || dbConfig.Password == "postgres" {
+    log.Fatal("Default credentials detected - deployment blocked")
+}
+```
+
+**Blocked defaults:**
+- `admin/admin`, `root/root`, `test/test`
+- `postgres/postgres`, `mysql/mysql`
+- Factory default API keys
+
+**Tools:** Secret Scanner, GitLeaks, TruffleHog, CI/CD checks

package/skill-assets/sunlint-code-quality/rules/go/S007-output-encoding.md

@@ -0,0 +1,50 @@
+---
+title: Output Encoding Before Interpreter Use
+impact: HIGH
+impactDescription: prevents XSS and injection attacks
+tags: xss, encoding, output, html, security
+---
+
+## Output Encoding Before Interpreter Use
+
+XSS and injection attacks occur when unescaped user data is interpreted by browsers or other systems.
+
+**Incorrect (no encoding):**
+
+```go
+// XSS vulnerability
+http.HandleFunc("/search", func(w http.ResponseWriter, r *http.Request) {
+    query := r.URL.Query().Get("q")
+    fmt.Fprintf(w, "<h1>Results for: %s</h1>", query) // XSS!
+})
+```
+
+**Correct (context-aware encoding):**
+
+```go
+import "html"
+
+// HTML context
+http.HandleFunc("/search", func(w http.ResponseWriter, r *http.Request) {
+    query := r.URL.Query().Get("q")
+    // html.EscapeString escapes <, >, &, ', "
+    fmt.Fprintf(w, "<h1>Results for: %s</h1>", html.EscapeString(query))
+})
+
+// Using html/template (auto-escapes by default)
+tmpl := template.Must(template.New("res").Parse("<h1>Results for: {{.}}</h1>"))
+tmpl.Execute(w, query)
+
+// URL context
+safeURL := url.QueryEscape(userInput)
+```
+
+**Encoding by Context:**
+
+| Context | Encoding |
+|---------|----------|
+| HTML body | `html.EscapeString()` |
+| URL | `url.QueryEscape()` |
+| JSON | `json.Marshal()` |
+
+**Tools:** SonarQube, Semgrep, `html/template` (enforced escaping)

package/skill-assets/sunlint-code-quality/rules/go/S009-approved-crypto.md

@@ -0,0 +1,63 @@
+---
+title: Use Only Approved Crypto Algorithms
+impact: MEDIUM
+impactDescription: ensures cryptographic strength
+tags: cryptography, algorithms, hashing, encryption, security
+---
+
+## Use Only Approved Crypto Algorithms
+
+Weak algorithms are broken. MD5, SHA1, DES, and ECB mode have known vulnerabilities.
+
+**Incorrect (weak algorithms):**
+
+```go
+import (
+    "crypto/md5"
+    "crypto/des"
+    "crypto/cipher"
+)
+
+// WEAK hash
+h := md5.New()
+h.Write([]byte(password))
+hash := h.Sum(nil)
+
+// WEAK algorithm
+block, _ := des.NewCipher(key)
+```
+
+**Correct (approved algorithms):**
+
+```go
+import (
+    "crypto/aes"
+    "crypto/cipher"
+    "crypto/sha256"
+    "golang.org/x/crypto/bcrypt"
+)
+
+// STRONG hash (for data integrity)
+h := sha256.New()
+h.Write(data)
+hash := h.Sum(nil)
+
+// STRONG authenticated encryption (GCM mode)
+block, _ := aes.NewCipher(key)
+aesGCM, _ := cipher.NewGCM(block)
+ciphertext := aesGCM.Seal(nil, nonce, plaintext, associatedData)
+
+// For passwords - use specialized functions
+hashedPassword, _ := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
+err := bcrypt.CompareHashAndPassword(hashedPassword, []byte(password))
+```
+
+**Approved vs Prohibited:**
+
+| Purpose | Approved | Prohibited |
+|---------|----------|------------|
+| Hash | SHA-256, SHA-3, BLAKE2 | MD5, SHA-1 |
+| Encryption | AES-GCM, ChaCha20-Poly1305 | DES, 3DES, AES-ECB |
+| Password | bcrypt, Argon2, scrypt | MD5, SHA-*, plain AES |
+
+**Tools:** SonarQube, Semgrep, `crypto` (standard library)

package/skill-assets/sunlint-code-quality/rules/go/S010-csprng.md

@@ -0,0 +1,53 @@
+---
+title: Use CSPRNG For Security Purposes
+impact: HIGH
+impactDescription: prevents predictable tokens and session hijacking
+tags: random, csprng, tokens, session, cryptography, security
+---
+
+## Use CSPRNG For Security Purposes
+
+Non-cryptographic random generators are predictable. Attackers can guess session tokens, OTPs, and password reset links generated with weak random sources.
+
+**Incorrect (predictable random):**
+
+```go
+import "math/rand"
+
+// INSECURE - predictable!
+sessionId := fmt.Sprintf("%d", rand.Intn(1000000))
+
+// INSECURE - Seeded with time isn't enough for security tokens
+rand.Seed(time.Now().UnixNano())
+token := rand.Int63()
+```
+
+**Correct (cryptographically secure):**
+
+```go
+import (
+    "crypto/rand"
+    "encoding/hex"
+    "math/big"
+)
+
+// Cryptographically secure session ID
+b := make([]byte, 32)
+rand.Read(b)
+sessionId := hex.EncodeToString(b) // 256-bit entropy
+
+// Secure OTP generation
+func generateOTP(length int) string {
+    max := big.NewInt(int64(math.Pow10(length)))
+    n, _ := rand.Int(rand.Reader, max)
+    return fmt.Sprintf("%0*d", length, n)
+}
+```
+
+**CSPRNG by language:**
+
+| Language | Secure | Insecure |
+|----------|--------|----------|
+| Go | `crypto/rand` | `math/rand` |
+
+**Tools:** SonarQube, Semgrep, `crypto/rand`

package/skill-assets/sunlint-code-quality/rules/go/S011-encrypted-client-hello.md

@@ -0,0 +1,34 @@
+---
+title: Enable Encrypted Client Hello (ECH)
+impact: MEDIUM
+impactDescription: protects SNI from eavesdropping
+tags: tls, ech, sni, privacy, security
+---
+
+## Enable Encrypted Client Hello (ECH)
+
+ECH encrypts the Server Name Indication (SNI) to prevent network observers from seeing which site you're connecting to.
+
+**About ECH:**
+
+Encrypted Client Hello (formerly ESNI) is a TLS extension that encrypts the ClientHello message, hiding the destination hostname from network observers.
+
+**Implementation:**
+
+```nginx
+# Nginx with ECH (when supported)
+ssl_ech on;
+ssl_ech_key /path/to/ech-private-key.pem;
+```
+
+**DNS Configuration:**
+
+```
+# HTTPS DNS record for ECH
+_https.example.com. IN HTTPS 1 . alpn="h2,h3" ipv4hint=192.0.2.1 ech="..."
+```
+
+**Go Support:**
+Go's `crypto/tls` currently (as of Go 1.22) has limited native support for ECH, but it can be implemented via specialized packages or handled at the infrastructure level (e.g., Cloudflare).
+
+**Tools:** Cloudflare ECH, DNS Configuration

package/skill-assets/sunlint-code-quality/rules/go/S012-secrets-management.md

@@ -0,0 +1,49 @@
+---
+title: Use Secrets Management For Backend Secrets
+impact: CRITICAL
+impactDescription: centralizes and secures credential storage
+tags: secrets, vault, credentials, configuration, security
+---
+
+## Use Secrets Management For Backend Secrets
+
+Hardcoded secrets are exposed in version control and can be accessed by anyone with code access. Use dedicated secrets management systems.
+
+**Incorrect (hardcoded or plain env files):**
+
+```go
+// Hardcoded in code
+const APIKey = "sk-abc123xyz789"
+
+// .env file committed to repo
+DATABASE_URL=postgres://admin:password@localhost/db
+```
+
+**Correct (secrets management):**
+
+```go
+// Using secrets manager (AWS, HashiCorp Vault, etc.)
+dbPassword, _ := secretManager.GetSecret(ctx, "production/db-password")
+
+// Kubernetes secrets
+secret := os.Getenv("DB_PASSWORD") // Mounted from K8s secret
+
+// Environment-specific with validation
+config := struct {
+    DBPassword string
+}{
+    DBPassword: os.Getenv("DB_PASSWORD"),
+}
+
+if config.DBPassword == "" {
+    log.Fatal("DB_PASSWORD environment variable required")
+}
+```
+
+**Best practices:**
+- Never commit secrets to version control
+- Use secrets rotation
+- Audit secret access
+- Use different secrets per environment
+
+**Tools:** HashiCorp Vault, AWS Secrets Manager, Azure Key Vault

package/skill-assets/sunlint-code-quality/rules/go/S013-tls-connections.md

@@ -0,0 +1,61 @@
+---
+title: Always Use TLS For All Connections
+impact: HIGH
+impactDescription: protects data in transit from eavesdropping
+tags: tls, https, encryption, transport, security
+---
+
+## Always Use TLS For All Connections
+
+Unencrypted traffic exposes data to anyone on the network path - ISPs, WiFi operators, and attackers.
+
+**Incorrect (unencrypted connections):**
+
+```go
+// HTTP API calls
+resp, _ := http.Get("http://api.example.com/users")
+
+// Unencrypted database
+db, _ := sql.Open("postgres", "postgres://user:pass@localhost/db?sslmode=disable")
+
+// Redis without TLS
+client := redis.NewClient(&redis.Options{
+    Addr: "localhost:6379",
+})
+```
+
+**Correct (TLS everywhere):**
+
+```go
+// HTTPS for all APIs
+resp, _ := http.Get("https://api.example.com/users")
+
+// TLS for database
+db, _ := sql.Open("postgres", "postgres://user:pass@localhost/db?sslmode=verify-full")
+
+// Redis with TLS
+client := redis.NewClient(&redis.Options{
+    Addr: "localhost:6380",
+    TLSConfig: &tls.Config{...},
+})
+
+// Force HTTPS in a Go web server
+func enforceHTTPS(next http.Handler) http.Handler {
+    return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+        if r.Header.Get("X-Forwarded-Proto") != "https" && os.Getenv("ENV") == "production" {
+            http.Redirect(w, r, "https://"+r.Host+r.RequestURI, http.StatusMovedPermanently)
+            return
+        }
+        next.ServeHTTP(w, r)
+    })
+}
+```
+
+**Checklist:**
+- [ ] All HTTP → HTTPS
+- [ ] Database connections encrypted (sslmode=verify-full)
+- [ ] Redis/memcached TLS
+- [ ] Message queues TLS
+- [ ] HSTS headers enabled
+
+**Tools:** OWASP ZAP, SSLyze, `crypto/tls`

package/skill-assets/sunlint-code-quality/rules/go/S016-no-sensitive-query-string.md

@@ -0,0 +1,42 @@
+---
+title: Do Not Pass Sensitive Data In Query String
+impact: HIGH
+impactDescription: prevents credential leakage in logs and history
+tags: url, query-string, sensitive-data, leakage, security
+---
+
+## Do Not Pass Sensitive Data In Query String
+
+Query strings appear in server logs, browser history, referrer headers, and can be cached by proxies and CDNs.
+
+**Incorrect (sensitive data in URL):**
+
+```go
+// Tokens in URL
+http.Get(fmt.Sprintf("https://api.example.com/data?token=%s", accessToken))
+
+// Password in URL
+http.Post(fmt.Sprintf("https://api.example.com/login?user=admin&pass=%s", password), "application/json", nil)
+```
+
+**Correct (sensitive data in body/headers):**
+
+```go
+// Token in header
+req, _ := http.NewRequest("GET", "https://api.example.com/data", nil)
+req.Header.Set("Authorization", "Bearer "+accessToken)
+client.Do(req)
+
+// Credentials in body
+payload := map[string]string{"user": "admin", "pass": password}
+jsonPayload, _ := json.Marshal(payload)
+http.Post("https://api.example.com/login", "application/json", bytes.NewBuffer(jsonPayload))
+```
+
+**Where query strings leak:**
+- Server access logs
+- Browser history
+- Referrer headers
+- Proxy/CDN logs
+
+**Tools:** Semgrep, Manual Review, Proxy log scanner

package/skill-assets/sunlint-code-quality/rules/go/S017-parameterized-queries.md

@@ -0,0 +1,36 @@
+---
+title: Always Use Parameterized Queries
+impact: CRITICAL
+impactDescription: prevents SQL and NoSQL injection attacks
+tags: injection, sql, nosql, database, parameterized, security
+---
+
+## Always Use Parameterized Queries
+
+SQL injection allows attackers to execute arbitrary database commands, steal data, or destroy databases.
+
+**Incorrect (string concatenation):**
+
+```go
+// SQL Injection vulnerability
+userId := r.URL.Query().Get("id")
+query := fmt.Sprintf("SELECT * FROM users WHERE id = '%s'", userId)
+db.Query(query)
+
+// Attacker input: ' OR '1'='1
+// Resulting query: SELECT * FROM users WHERE id = '' OR '1'='1'
+```
+
+**Correct (parameterized queries):**
+
+```go
+// Parameterized query using database/sql
+userId := r.URL.Query().Get("id")
+db.Query("SELECT * FROM users WHERE id = ?", userId) // Postgres uses $1, $2
+
+// Using GORM (safely handles parameters)
+var user User
+db.First(&user, "id = ?", userId)
+```
+
+**Tools:** SonarQube, Semgrep, `sqlclosecheck`, `gosec` (G201, G202)

package/skill-assets/sunlint-code-quality/rules/go/S019-email-input-sanitization.md

@@ -0,0 +1,44 @@
+---
+title: Sanitize Input Before Sending Emails
+impact: MEDIUM
+impactDescription: prevents email header injection
+tags: email, injection, sanitization, input-validation, security
+---
+
+## Sanitize Input Before Sending Emails
+
+Email header injection allows attackers to add recipients, change headers, or send spam through your system.
+
+**Incorrect (unsanitized email input):**
+
+```go
+// Email injection vulnerability
+subject := r.FormValue("subject") // "Hello\r\nBcc: spam@evil.com"
+msg := []byte("Subject: " + subject + "\r\n\r\n" + "Body")
+smtp.SendMail("smtp.example.com:25", auth, from, to, msg)
+```
+
+**Correct (sanitized email fields):**
+
+```go
+func sanitizeEmailField(input string) string {
+    // Remove CRLF characters that could inject headers
+    return strings.NewReplacer("\r", "", "\n", "").Replace(input)
+}
+
+func validateEmail(email string) bool {
+    // Use a robust regex or net/mail
+    _, err := mail.ParseAddress(email)
+    return err == nil && !strings.ContainsAny(email, "\r\n")
+}
+
+// In handler
+subject := sanitizeEmailField(r.FormValue("subject"))
+to := r.FormValue("to")
+if !validateEmail(to) {
+    http.Error(w, "Invalid email", 400)
+    return
+}
+```
+
+**Tools:** Email Libraries with Built-in Protection, Manual Review, `net/mail`