@sun-asterisk/sunlint 1.3.39 → 1.3.41

package/skill-assets/sunlint-code-quality/rules/go/S035-app-hostnames.md

@@ -0,0 +1,50 @@
+---
+title: Host Apps On Different Hostnames
+impact: MEDIUM
+impactDescription: provides cookie and origin isolation
+tags: hostname, isolation, same-origin, security
+---
+
+## Host Apps On Different Hostnames
+
+Different applications on the same hostname can access each other's cookies and storage.
+
+**Incorrect (shared hostname):**
+
+```
+https://example.com/admin    # Admin panel
+https://example.com/api      # API
+https://example.com/app      # User app
+# All share cookies and localStorage!
+```
+
+**Correct (separate hostnames):**
+
+```
+https://admin.example.com    # Admin panel
+https://api.example.com      # API
+https://app.example.com      # User app
+# Each has isolated cookies and storage
+```
+
+**Benefits:**
+- Cookie isolation
+- localStorage isolation
+- Same-origin policy protection
+
+**Configuration in Go (CORS example):**
+
+```go
+import "github.com/rs/cors"
+
+mux := http.NewServeMux()
+handler := cors.New(cors.Options{
+    AllowedOrigins: []string{
+        "https://app.example.com",
+        "https://admin.example.com",
+    },
+    AllowCredentials: true,
+}).Handler(mux)
+```
+
+**Tools:** Infrastructure Planning, Security Audit

package/skill-assets/sunlint-code-quality/rules/go/S036-internal-file-paths.md

@@ -0,0 +1,56 @@
+---
+title: Use Internal Data For File Paths
+impact: CRITICAL
+impactDescription: prevents path traversal attacks
+tags: file-path, path-traversal, lfi, input-validation, security
+---
+
+## Use Internal Data For File Paths
+
+Never construct file paths using user input directly. Path traversal attacks can access any file on the system.
+
+**Incorrect (user-controlled paths):**
+
+```go
+// Path traversal vulnerability
+func DownloadHandler(w http.ResponseWriter, r *http.Request) {
+    filename := r.URL.Query().Get("file")
+    http.ServeFile(w, r, "/uploads/"+filename)
+    // Attacker: ?file=../../../etc/passwd
+}
+```
+
+**Correct (validated internal paths):**
+
+```go
+import (
+    "path/filepath"
+    "strings"
+)
+
+func DownloadHandler(w http.ResponseWriter, r *http.Request) {
+    filename := r.URL.Query().Get("file")
+    
+    // 1. Sanitize: get only the filename
+    safeName := filepath.Base(filename)
+    
+    // 2. Validate against allowlist (e.g., from DB)
+    if !isUserFile(r.Context().Value("userId").(string), safeName) {
+        http.Error(w, "File not found", 404)
+        return
+    }
+    
+    // 3. Construct absolute path and verify prefix
+    uploadDir := "/abs/path/to/uploads"
+    finalPath := filepath.Join(uploadDir, safeName)
+    
+    if !strings.HasPrefix(finalPath, uploadDir) {
+        http.Error(w, "Invalid path", 400)
+        return
+    }
+    
+    http.ServeFile(w, r, finalPath)
+}
+```
+
+**Tools:** `filepath.Base`, `filepath.Join`, `gosec` (G304)

package/skill-assets/sunlint-code-quality/rules/go/S037-anti-cache-headers.md

@@ -0,0 +1,43 @@
+---
+title: Set Anti-cache Headers
+impact: MEDIUM
+impactDescription: prevents sensitive data caching
+tags: headers, cache, sensitive-data, security
+---
+
+## Set Anti-cache Headers
+
+Sensitive pages cached in browsers or proxies can be accessed by other users on shared machines.
+
+**Incorrect (no cache control):**
+
+```go
+func AccountHandler(w http.ResponseWriter, r *http.Request) {
+    json.NewEncoder(w).Encode(sensitiveData)
+    // May be cached!
+}
+```
+
+**Correct (anti-cache headers):**
+
+```go
+func noCache(next http.Handler) http.Handler {
+    return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+        w.Header().Set("Cache-Control", "no-store, no-cache, must-revalidate, private")
+        w.Header().Set("Pragma", "no-cache")
+        w.Header().Set("Expires", "0")
+        next.ServeHTTP(w, r)
+    })
+}
+
+// Usage in router
+mux.Handle("/api/account", noCache(http.HandlerFunc(AccountHandler)))
+```
+
+**When to use anti-cache:**
+- Account pages
+- Financial data
+- Personal information (PII)
+- Any authenticated content
+
+**Tools:** Security Headers, Browser DevTools

package/skill-assets/sunlint-code-quality/rules/go/S039-tls-certificate-validation.md

@@ -0,0 +1,41 @@
+---
+title: TLS Clients Must Validate Server Certificates
+impact: CRITICAL
+impactDescription: prevents man-in-the-middle attacks
+tags: tls, certificates, validation, mitm, security
+---
+
+## TLS Clients Must Validate Server Certificates
+
+Disabling certificate validation makes TLS useless - attackers can intercept all traffic using self-signed or forged certificates.
+
+**Incorrect (disabled validation):**
+
+```go
+// DANGEROUS: Skipping verification
+tr := &http.Transport{
+    TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
+}
+client := &http.Client{Transport: tr}
+```
+
+**Correct (proper validation):**
+
+```go
+// Default behavior - validates certificates against system root CAs
+resp, err := http.Get("https://api.example.com")
+
+// Custom CA for internal services
+caCert, _ := os.ReadFile("internal-ca.crt")
+caCertPool := x509.NewCertPool()
+caCertPool.AppendCertsFromPEM(caCert)
+
+tr := &http.Transport{
+    TLSClientConfig: &tls.Config{
+        RootCAs: caCertPool,
+    },
+}
+client := &http.Client{Transport: tr}
+```
+
+**Tools:** `crypto/tls`, `crypto/x509`, `gosec` (G402)

package/skill-assets/sunlint-code-quality/rules/go/S041-logout-invalidation.md

@@ -0,0 +1,46 @@
+---
+title: Invalidate Session On Logout
+impact: MEDIUM
+impactDescription: ensures logout actually terminates access
+tags: session, logout, invalidation, security
+---
+
+## Invalidate Session On Logout
+
+If sessions/tokens persist after logout, they can be stolen and used by attackers.
+
+**Incorrect (client-only logout):**
+
+```go
+// Server doesn't invalidate session - just returns success
+func LogoutHandler(w http.ResponseWriter, r *http.Request) {
+    w.WriteHeader(http.StatusOK) // Token/Session still valid on server!
+}
+```
+
+**Correct (server-side invalidation):**
+
+```go
+func LogoutHandler(w http.ResponseWriter, r *http.Request) {
+    // 1. Destroy server-side session (e.g., in Redis)
+    sessionID := getSessionID(r)
+    sessionStore.Delete(sessionID)
+    
+    // 2. Clear cookie
+    cookie := &http.Cookie{
+        Name:     "session",
+        Value:    "",
+        Path:     "/",
+        HttpOnly: true,
+        Secure:   true,
+        MaxAge:   -1, // Delete immediately
+    }
+    http.SetCookie(w, cookie)
+    
+    // 3. Prevent caching of sensitive logout confirmation
+    w.Header().Set("Cache-Control", "no-store, no-cache, must-revalidate")
+    w.WriteHeader(http.StatusOK)
+}
+```
+
+**Tools:** Session management libraries, JWT Blacklisting

package/skill-assets/sunlint-code-quality/rules/go/S042-long-lived-sessions.md

@@ -0,0 +1,58 @@
+---
+title: Re-authenticate For Long-lived Sessions
+impact: MEDIUM
+impactDescription: ensures continuous user identity verification
+tags: session, authentication, timeout, reauthentication, security
+---
+
+## Re-authenticate For Long-lived Sessions
+
+Long-running sessions may be hijacked. Periodic re-authentication ensures the original user is still present.
+
+**Incorrect (sessions never expire or stay valid indefinitely):**
+
+```go
+// Session cookie created without expiry or with extremely long duration
+cookie := &http.Cookie{
+    Name:  "session",
+    Value: token,
+} // Defaults to session-only browsers, but logic may never check "age" on server
+```
+
+**Correct (periodic re-authentication/expiry):**
+
+```go
+const SessionMaxAge = 24 * time.Hour
+const ReauthInterval = 4 * time.Hour
+
+func authMiddleware(next http.Handler) http.Handler {
+    return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+        session := getSession(r)
+        
+        // Check if session is too old
+        if time.Since(session.CreatedAt) > SessionMaxAge {
+            http.Error(w, "Session expired", 401)
+            return
+        }
+        
+        // Check if re-authentication is required for sensitive routes
+        if time.Since(session.LastAuthenticatedAt) > ReauthInterval {
+            session.RequireReauth = true
+        }
+        
+        next.ServeHTTP(w, r)
+    })
+}
+
+// Handler for sensitive operation
+func SensitiveHandler(w http.ResponseWriter, r *http.Request) {
+    session := getSession(r)
+    if session.RequireReauth {
+         http.Error(w, "Re-authentication required", 401)
+         return
+    }
+    // ...
+}
+```
+
+**Tools:** Session libraries (e.g., `scs`, `gorilla/sessions`), Manual review

package/skill-assets/sunlint-code-quality/rules/go/S044-critical-changes-reauth.md

@@ -0,0 +1,53 @@
+---
+title: Re-authenticate Before Critical Changes
+impact: MEDIUM
+impactDescription: prevents unauthorized critical operations
+tags: authentication, critical, reauthentication, security
+---
+
+## Re-authenticate Before Critical Changes
+
+Critical actions like password change, email change, or account deletion require fresh authentication.
+
+**Incorrect (no re-authentication):**
+
+```go
+// Dangerous - no password confirmation
+func DeleteAccountHandler(w http.ResponseWriter, r *http.Request) {
+    userID := r.Context().Value("userID").(string)
+    deleteAccount(userID)
+    w.Write([]byte(`{"success": true}`))
+}
+```
+
+**Correct (require password confirmation):**
+
+```go
+func DeleteAccountHandler(w http.ResponseWriter, r *http.Request) {
+    userID := r.Context().Value("userID").(string)
+    currentPassword := r.FormValue("password")
+    
+    // 1. Verify current password
+    if !verifyPassword(userID, currentPassword) {
+        http.Error(w, "Invalid password", 401)
+        return
+    }
+    
+    // 2. Perform critical action
+    deleteAccount(userID)
+    
+    // 3. Log the security event
+    slog.Info("Account deleted", "user_id", userID)
+    
+    w.Write([]byte(`{"success": true}`))
+}
+```
+
+**Critical actions requiring re-auth:**
+- Password change
+- Email change
+- Phone number change
+- Account deletion
+- Major security settings changes
+
+**Tools:** Manual Review, Security Audit

package/skill-assets/sunlint-code-quality/rules/go/S045-brute-force-protection.md

@@ -0,0 +1,55 @@
+---
+title: Implement Brute-force Protection
+impact: MEDIUM
+impactDescription: prevents password guessing attacks
+tags: brute-force, rate-limiting, authentication, security
+---
+
+## Implement Brute-force Protection
+
+Without rate limiting, attackers can try millions of password combinations.
+
+**Incorrect (no protection):**
+
+```go
+func LoginHandler(w http.ResponseWriter, r *http.Request) {
+    user, err := authenticate(r.FormValue("email"), r.FormValue("password"))
+    // No limit on attempts!
+    if err != nil {
+        http.Error(w, "Invalid credentials", 401)
+        return
+    }
+}
+```
+
+**Correct (rate limiting with middleware):**
+
+```go
+import "golang.org/x/time/rate"
+
+var loginLimiter = rate.NewLimiter(rate.Every(3*time.Minute), 5) // 5 attempts per window
+
+func LoginHandler(w http.ResponseWriter, r *http.Request) {
+    if !loginLimiter.Allow() {
+        http.Error(w, "Too many login attempts", 429)
+        return
+    }
+
+    user, err := authenticate(r.FormValue("email"), r.FormValue("password"))
+    // ...
+}
+
+// Better: persistent rate limiting via Redis
+func RateLimitMiddleware(next http.Handler) http.Handler {
+    return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+        key := "login_limit:" + r.RemoteAddr
+        if isRateLimited(key) {
+            http.Error(w, "Too many attempts", 429)
+            return
+        }
+        next.ServeHTTP(w, r)
+    })
+}
+```
+
+**Tools:** `golang.org/x/time/rate`, Redis, WAF

package/skill-assets/sunlint-code-quality/rules/go/S047-oauth-csrf-protection.md

@@ -0,0 +1,51 @@
+---
+title: Protect OAuth Code Flow Vs CSRF
+impact: HIGH
+impactDescription: prevents OAuth authorization code theft
+tags: oauth, csrf, state, authorization, security
+---
+
+## Protect OAuth Code Flow Vs CSRF
+
+Without state parameter validation, attackers can use their own authorization codes to link their accounts to a victim's session.
+
+**Incorrect (no state parameter):**
+
+```go
+func OAuthInitHandler(w http.ResponseWriter, r *http.Request) {
+    url := fmt.Sprintf("https://accounts.google.com/o/oauth2/auth?client_id=%s&redirect_uri=%s&response_type=code", clientID, redirectURI)
+    // No state parameter!
+    http.Redirect(w, r, url, http.StatusFound)
+}
+```
+
+**Correct (state parameter validation):**
+
+```go
+func OAuthInitHandler(w http.ResponseWriter, r *http.Request) {
+    state := generateRandomState() // CSPRNG
+    
+    // Store in session (cookie or DB)
+    session := getSession(r)
+    session.Values["oauth_state"] = state
+    session.Save(r, w)
+    
+    url := googleConfig.AuthCodeURL(state)
+    http.Redirect(w, r, url, http.StatusFound)
+}
+
+func OAuthCallbackHandler(w http.ResponseWriter, r *http.Request) {
+    queryState := r.URL.Query().Get("state")
+    session := getSession(r)
+    
+    // Validate state
+    if queryState == "" || queryState != session.Values["oauth_state"] {
+        http.Error(w, "Invalid state", 403)
+        return
+    }
+    
+    // Exchange code for token
+}
+```
+
+**Tools:** `golang.org/x/oauth2`, Security Audit

package/skill-assets/sunlint-code-quality/rules/go/S048-oauth-redirect-validation.md

@@ -0,0 +1,58 @@
+---
+title: Validate OAuth Redirect URIs Exactly
+impact: CRITICAL
+impactDescription: prevents OAuth redirect hijacking
+tags: oauth, redirect, uri, validation, security
+---
+
+## Validate OAuth Redirect URIs Exactly
+
+Loose redirect URI validation allows attackers to steal authorization codes by redirecting users to malicious sites.
+
+**Incorrect (partial/loose validation):**
+
+```go
+// Dangerous - substring match
+if strings.Contains(redirectURI, "example.com") {
+    // Allows attacker.com?example.com
+}
+
+// Dangerous - prefix match
+if strings.HasPrefix(redirectURI, "https://example.com") {
+    // Allows https://example.com.attacker.com
+}
+```
+
+**Correct (exact match against registered URIs):**
+
+```go
+var registeredRedirectURIs = []string{
+    "https://app.example.com/callback",
+}
+
+func isValidRedirect(uri string) bool {
+    // Exact match required
+    for _, r := range registeredRedirectURIs {
+        if r == uri {
+            return true
+        }
+    }
+    return false
+}
+
+func AuthorizeHandler(w http.ResponseWriter, r *http.Request) {
+    redirectURI := r.URL.Query().Get("redirect_uri")
+    if !isValidRedirect(redirectURI) {
+        http.Error(w, "Invalid redirect URI", 400)
+        return
+    }
+    // ...
+}
+```
+
+**Requirements:**
+- Exact string match for redirect URIs.
+- No wildcards or pattern matching.
+- HTTPS required for production.
+
+**Tools:** OAuth Security Testing, `golang.org/x/oauth2`

package/skill-assets/sunlint-code-quality/rules/go/S049-auth-code-expiry.md

@@ -0,0 +1,52 @@
+---
+title: Authentication Codes Must Expire Quickly
+impact: MEDIUM
+impactDescription: limits window for code interception attacks
+tags: authentication, codes, expiry, otp, security
+---
+
+## Authentication Codes Must Expire Quickly
+
+Long-lived codes give attackers more time to intercept and use them. Short expiry limits the attack window.
+
+**Incorrect (codes last too long):**
+
+```go
+// Code valid for 24 hours
+db.SaveToken(userID, token, time.Now().Add(24 * time.Hour))
+```
+
+**Correct (short expiry with proper handling):**
+
+```go
+const CodeExpiry = 5 * time.Minute
+
+func GenerateAuthCode(userID string) (string, error) {
+    code := generateOTP() // 6-digit CSPRNG
+    
+    // Store in Redis with TTL
+    err := redisClient.Set(ctx, "otp:"+userID, code, CodeExpiry).Err()
+    return code, err
+}
+
+func VerifyAuthCode(userID, inputCode string) (bool, error) {
+    storedCode, err := redisClient.Get(ctx, "otp:"+userID).Result()
+    if err == redis.Nil {
+        return false, nil // Expired or not found
+    }
+    
+    if storedCode == inputCode {
+        redisClient.Del(ctx, "otp:"+userID) // Single use!
+        return true, nil
+    }
+    
+    return false, nil
+}
+```
+
+**Recommended expiry times:**
+- 2FA/OTP: 5-10 minutes
+- Password reset: 15-60 minutes
+- Email verification: 24 hours
+
+**Tools:** Redis (TTL), Database (expiry column), Manual Review

package/skill-assets/sunlint-code-quality/rules/go/S050-token-entropy.md

@@ -0,0 +1,53 @@
+---
+title: Reference Tokens 128-bit Entropy CSPRNG
+impact: HIGH
+impactDescription: prevents token brute-forcing
+tags: tokens, entropy, csprng, session, security
+---
+
+## Reference Tokens 128-bit Entropy CSPRNG
+
+Low-entropy tokens can be brute-forced. 128 bits of entropy makes attacks computationally infeasible.
+
+**Incorrect (low entropy tokens):**
+
+```go
+// Low entropy
+token := fmt.Sprintf("%d", rand.Int63())
+
+// Predictable
+token := "session_" + strconv.Itoa(counter)
+```
+
+**Correct (high entropy tokens via crypto/rand):**
+
+```go
+import (
+    "crypto/rand"
+    "encoding/base64"
+)
+
+func GenerateToken(length int) string {
+    b := make([]byte, length)
+    if _, err := rand.Read(b); err != nil {
+        panic(err)
+    }
+    return base64.URLEncoding.EncodeToString(b)
+}
+
+// 128-bit minimum entropy (16 bytes)
+sessionToken := GenerateToken(16)
+
+// 256-bit recommended (32 bytes)
+refreshToken := GenerateToken(32)
+```
+
+**Entropy levels:**
+
+| Bytes | Bits | Security Level |
+|-------|------|----------------|
+| 8 | 64 | Weak |
+| 16 | 128 | Minimum |
+| 32 | 256 | Recommended |
+
+**Tools:** `crypto/rand`, Security Audit

package/skill-assets/sunlint-code-quality/rules/go/S051-password-length.md

@@ -0,0 +1,49 @@
+---
+title: Support 12-64 Character Passwords
+impact: MEDIUM
+impactDescription: enables secure passphrase usage
+tags: password, length, passphrase, security
+---
+
+## Support 12-64 Character Passwords
+
+Long passwords/passphrases are more secure than complex short ones. Don't impose restrictive limits that prevent users from using passphrases.
+
+**Incorrect (restrictive limits):**
+
+```go
+// Too restrictive max length
+if len(password) < 8 || len(password) > 16 {
+    return errors.New("password must be 8-16 characters")
+}
+```
+
+**Correct (reasonable limits):**
+
+```go
+func ValidatePassword(password string) error {
+    length := utf8.RuneCountInString(password)
+    
+    if length < 12 {
+        return errors.New("password too short (min 12)")
+    }
+    
+    if length > 64 {
+        return errors.New("password too long (max 64)")
+    }
+    
+    // For long passwords (e.g., 20+), complexity rules can be relaxed
+    if length < 20 {
+        // check for symbols, numbers, etc.
+    }
+    
+    return nil
+}
+```
+
+**NIST Guidelines:**
+- Minimum 8-12+ characters.
+- Maximum 64+ characters.
+- Allow space and all printable Unicode characters.
+
+**Tools:** Password Policy logic, Manual Review