@sun-asterisk/sunlint 1.3.39 → 1.3.41

package/skill-assets/sunlint-code-quality/rules/go/S052-otp-entropy.md

@@ -0,0 +1,48 @@
+---
+title: OTPs Must Have 20-bit Entropy Minimum
+impact: MEDIUM
+impactDescription: prevents OTP brute-forcing
+tags: otp, entropy, authentication, 2fa, security
+---
+
+## OTPs Must Have 20-bit Entropy Minimum
+
+Low-entropy OTPs (like 4 digits) can be brute-forced easily. 20 bits of entropy requires at least 6 decimal digits.
+
+**Incorrect (low entropy OTPs):**
+
+```go
+// 4 digits = ~13 bits entropy
+otp := fmt.Sprintf("%04d", rand.Intn(10000))
+```
+
+**Correct (high entropy OTPs via crypto/rand):**
+
+```go
+import (
+    "crypto/rand"
+    "math/big"
+)
+
+// 6-digit numeric OTP (≈20 bits entropy)
+func GenerateOTP() string {
+    max := big.NewInt(1000000)
+    n, _ := rand.Int(rand.Reader, max)
+    return fmt.Sprintf("%06d", n)
+}
+
+// 8-digit for higher security (≈26 bits)
+func GenerateStrongOTP() string {
+    max := big.NewInt(100000000)
+    n, _ := rand.Int(rand.Reader, max)
+    return fmt.Sprintf("%08d", n)
+}
+```
+
+**OTP requirements:**
+- Must use `crypto/rand` (CSPRNG).
+- Minimum 6 digits (20 bits).
+- Short expiration (5-10 minutes).
+- Rate limit verification attempts.
+
+**Tools:** Manual Review, Unit Test

package/skill-assets/sunlint-code-quality/rules/go/S053-generic-error-messages.md

@@ -0,0 +1,51 @@
+---
+title: Return Generic Error Messages
+impact: HIGH
+impactDescription: prevents information disclosure
+tags: error-messages, information-disclosure, security
+---
+
+## Return Generic Error Messages
+
+Detailed error messages can help attackers understand your system's internals. Return generic messages to end-users.
+
+**Incorrect (detailed errors to user):**
+
+```go
+func Handler(w http.ResponseWriter, r *http.Request) {
+    err := db.QueryRow("...").Scan(&id)
+    if err != nil {
+        // Exposes database details!
+        http.Error(w, err.Error(), 500)
+        return
+    }
+}
+
+// User enumeration
+if userNotFound {
+    http.Error(w, "User john@example.com dose not exist", 404)
+}
+```
+
+**Correct (generic errors with internal logging):**
+
+```go
+func Handler(w http.ResponseWriter, r *http.Request) {
+    err := db.QueryRow("...").Scan(&id)
+    if err != nil {
+        // Log internally
+        slog.Error("query failed", "error", err, "request_id", r.Header.Get("X-Request-Id"))
+        
+        // Return generic message
+        http.Error(w, "An internal error occurred", 500)
+        return
+    }
+}
+
+// Same message for "user not found" and "wrong password"
+if !userExists || !passwordMatches {
+    http.Error(w, "Invalid credentials", 401)
+}
+```
+
+**Tools:** Global Error Middleware, `slog`

package/skill-assets/sunlint-code-quality/rules/go/S054-no-default-admin.md

@@ -0,0 +1,43 @@
+---
+title: Avoid Default Admin/Root Accounts
+impact: HIGH
+impactDescription: prevents easy initial access by attackers
+tags: admin, default-accounts, credentials, security
+---
+
+## Avoid Default Admin/Root Accounts
+
+Default accounts with known credentials (e.g., admin/admin) are the first thing attackers check.
+
+**Incorrect (default admin in seed):**
+
+```go
+// Seed script
+db.Exec("INSERT INTO users (email, password, role) VALUES ('admin@example.com', 'admin123', 'admin')")
+```
+
+**Correct (secure initial setup):**
+
+```go
+// 1. Setup wizard on first run
+func SetupHandler(w http.ResponseWriter, r *http.Request) {
+    if adminExists() {
+        http.Error(w, "Setup already done", 403)
+        return
+    }
+    // Form to create first admin...
+}
+
+// 2. Or use environment variables for bootstrap
+func BootstrapAdmin() {
+    email := os.Getenv("INITIAL_ADMIN_EMAIL")
+    pass := os.Getenv("INITIAL_ADMIN_PASSWORD")
+    
+    if pass == "" || len(pass) < 16 {
+        log.Fatal("Secure INITIAL_ADMIN_PASSWORD required")
+    }
+    createAdmin(email, pass)
+}
+```
+
+**Tools:** Security Audit, Configuration Review

package/skill-assets/sunlint-code-quality/rules/go/S055-content-type-validation.md

@@ -0,0 +1,52 @@
+---
+title: Validate Content-Type In REST Services
+impact: MEDIUM
+impactDescription: prevents content-type confusion attacks
+tags: rest, content-type, validation, api, security
+---
+
+## Validate Content-Type In REST Services
+
+Accepting unexpected content types can lead to parsing vulnerabilities or bypass security controls.
+
+**Incorrect (accepting any content):**
+
+```go
+func Handler(w http.ResponseWriter, r *http.Request) {
+    // No check on Content-Type header
+    var data map[string]interface{}
+    json.NewDecoder(r.Body).Decode(&data)
+}
+```
+
+**Correct (strict content-type validation):**
+
+```go
+func validateContentType(allowed ...string) func(http.Handler) http.Handler {
+    return func(next http.Handler) http.Handler {
+        return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+            ct := r.Header.Get("Content-Type")
+            
+            isValid := false
+            for _, a := range allowed {
+                if strings.Contains(strings.ToLower(ct), strings.ToLower(a)) {
+                    isValid = true
+                    break
+                }
+            }
+            
+            if !isValid {
+                http.Error(w, "Unsupported Media Type", http.StatusUnsupportedMediaType)
+                return
+            }
+            
+            next.ServeHTTP(w, r)
+        })
+    }
+}
+
+// Router usage
+mux.Handle("/api/data", validateContentType("application/json")(http.HandlerFunc(Handler)))
+```
+
+**Tools:** API Gateway, Middleware, OWASP ZAP

package/skill-assets/sunlint-code-quality/rules/go/S056-log-injection.md

@@ -0,0 +1,40 @@
+---
+title: Protect Against Log Injection
+impact: HIGH
+impactDescription: prevents log forging and exploitation
+tags: logging, injection, sanitization, security
+---
+
+## Protect Against Log Injection
+
+Log injection allows attackers to forge log entries, hide their tracks, or inject malicious control characters.
+
+**Incorrect (unsanitized logging):**
+
+```go
+func Handler(w http.ResponseWriter, r *http.Request) {
+    user := r.FormValue("user")
+    slog.Info("User logged in: " + user)
+    // Attacker: "admin\n[ERROR] Payment failed for user: victim"
+}
+```
+
+**Correct (sanitized structured logging):**
+
+```go
+// 1. Use structured logging (automatically handles quotes/escaping in key-value pairs)
+slog.Info("User logged in", "username", sanitizeForLog(user))
+
+// 2. Sanitize input
+func sanitizeForLog(input string) string {
+    // Replace CRLF/tabs with space
+    replacer := strings.NewReplacer("\r", " ", "\n", " ", "\t", " ")
+    return replacer.Replace(input)
+}
+
+// 3. Recommended: Use JSON logger in production
+logger := slog.New(slog.NewJSONHandler(os.Stdout, nil))
+logger.Info("User logged in", "username", user)
+```
+
+**Tools:** `log/slog`, `zap`, `gosec`

package/skill-assets/sunlint-code-quality/rules/go/S057-synchronized-time.md

@@ -0,0 +1,40 @@
+---
+title: Use Synchronized Time (UTC) In Logs
+impact: MEDIUM
+impactDescription: enables accurate incident correlation
+tags: logging, time, utc, synchronization, security
+---
+
+## Use Synchronized Time (UTC) In Logs
+
+Inconsistent timestamps across servers/services make incident investigation difficult. Use UTC and ISO 8601 format.
+
+**Incorrect (local time/custom formats):**
+
+```go
+// Local time - depends on server TZ
+log.Printf("Event time: %v", time.Now())
+
+// Different formats
+fmt.Println(time.Now().Unix())
+fmt.Println(time.Now().Format("2006-01-02"))
+```
+
+**Correct (UTC, ISO 8601):**
+
+```go
+// Use .UTC() and .Format(time.RFC3339)
+slog.Info("User action", 
+    "timestamp", time.Now().UTC().Format(time.RFC3339Nano), 
+    "action", "login",
+)
+
+// Output: {"timestamp":"2024-01-15T10:30:00.123456Z", "level":"INFO", "message":"User action", "action":"login"}
+```
+
+**Requirements:**
+- Use UTC timezone externally.
+- Use ISO 8601 (RFC 3339) with nanosecond/millisecond precision.
+- Ensure servers are NTP-synchronized.
+
+**Tools:** `time` (Standard Library), `slog`, NTP

package/skill-assets/sunlint-code-quality/rules/go/S058-ssrf-protection.md

@@ -0,0 +1,70 @@
+---
+title: Protect Against SSRF Attacks
+impact: MEDIUM
+impactDescription: prevents internal network access from user input
+tags: ssrf, url, network, internal, security
+---
+
+## Protect Against SSRF Attacks
+
+SSRF allows attackers to make requests from your server to internal services, local files, or cloud metadata endpoints.
+
+**Incorrect (accepting user URLs without validation):**
+
+```go
+func Handler(w http.ResponseWriter, r *http.Request) {
+    url := r.URL.Query().Get("url")
+    resp, _ := http.Get(url) // Attacker controls URL!
+    io.Copy(w, resp.Body)
+}
+// Attacker: ?url=http://169.254.169.254/latest/meta-data/
+```
+
+**Correct (URL validation and IP blocking):**
+
+```go
+import (
+    "net"
+    "net/url"
+)
+
+var allowedHosts = []string{"api.example.com", "cdn.example.com"}
+
+func SafeFetch(userURL string) (*http.Response, error) {
+    parsed, err := url.Parse(userURL)
+    if err != nil {
+        return nil, err
+    }
+
+    // 1. Protocol whitelist
+    if parsed.Scheme != "http" && parsed.Scheme != "https" {
+        return nil, errors.New("protocol not allowed")
+    }
+
+    // 2. Host whitelist
+    isAllowed := false
+    for _, h := range allowedHosts {
+        if parsed.Hostname() == h {
+            isAllowed = true
+            break
+        }
+    }
+    
+    // 3. Resolve IP and block internal ranges
+    ips, _ := net.LookupIP(parsed.Hostname())
+    for _, ip := range ips {
+        if ip.IsLoopback() || ip.IsPrivate() || ip.IsUnspecified() {
+            return nil, errors.New("internal IP blocked")
+        }
+    }
+
+    client := &http.Client{
+        CheckRedirect: func(req *http.Request, via []*http.Request) error {
+            return http.ErrUseLastResponse // Disable redirects
+        },
+    }
+    return client.Get(userURL)
+}
+```
+
+**Tools:** `net/url`, `net.LookupIP`, `gosec` (G107)

package/skill-assets/sunlint-code-quality/rules/java/C006-verb-noun-functions.md

@@ -0,0 +1,36 @@
+---
+title: Function Names Verb-Noun Pattern
+impact: MEDIUM
+impactDescription: improves code readability and maintainability
+tags: readability, naming, best-practice, java
+---
+
+## Function Names Verb-Noun Pattern
+
+Method names should clearly state what they do. Following a `verbNoun` pattern (camelCase) makes the code more intuitive and easier to scan.
+
+**Incorrect (vague or reverse naming):**
+
+```java
+public void userData(User user) { ... }
+public List<User> usersGet() { ... }
+public void process() { ... }
+```
+
+**Correct (verb-noun naming):**
+
+```java
+public void saveUser(User user) { ... }
+public List<User> getAllUsers() { ... }
+public void processPayment() { ... }
+public boolean isValidEmail(String email) { ... }
+```
+
+**Common Verbs:**
+- `get` / `find`: Retrieve data.
+- `save` / `create` / `update`: Modify data.
+- `is` / `has`: Boolean checks.
+- `validate`: Check constraints.
+- `calculate`: Perform computations.
+
+**Tools:** Checkstyle, IntelliJ Inspections, Manual Review

package/skill-assets/sunlint-code-quality/rules/java/C013-no-dead-code.md

@@ -0,0 +1,175 @@
+---
+title: Do Not Commit Dead Code
+impact: MEDIUM
+impactDescription: reduces codebase clutter and potential for bugs
+tags: readability, clean-code, maintainability, java
+---
+
+## Do Not Commit Dead Code
+
+Dead code (commented-out code, unused methods, unreachable branches) increases technical debt and makes the codebase harder to maintain and understand. 
+
+**Incorrect (commented code or unreachable blocks):**
+
+```java
+public void calculate() {
+    int x = 10;
+    // int y = 20; // DEAD CODE
+    // if (x > 5) { ... } // DEAD CODE
+    System.out.println(x);
+}
+```
+
+**Correct (clean code):**
+
+```java
+public void calculate() {
+    int x = 10;
+    System.out.println(x);
+}
+```
+
+**Tools:** IntelliJ Inspections, PMD, SonarQube (S1144), Checkstyle
+---
+title: Use Dependency Injection
+impact: HIGH
+impactDescription: improves testability and decouples components
+tags: dependency-injection, spring, testing, java
+---
+
+## Use Dependency Injection
+
+Hardcoding dependencies (using `new`) makes components tightly coupled and difficult to test. Dependency Injection (DI) allows the framework to manage object lifecycles and permits easy mocking during unit tests.
+
+**Incorrect (tight coupling):**
+
+```java
+public class UserService {
+    private final UserRepository repo = new UserRepository(); // VULNERABLE to tight coupling
+    
+    public void save(User user) {
+        repo.save(user);
+    }
+}
+```
+
+**Correct (constructor injection):**
+
+```java
+@Service
+public class UserService {
+    private final UserRepository repo;
+
+    // SECURE: Dependency is injected via constructor
+    public UserService(UserRepository repo) {
+        this.repo = repo;
+    }
+    
+    public void save(User user) {
+        repo.save(user);
+    }
+}
+```
+
+**Tools:** Spring Framework, Dagger, Guice, SonarQube (S3306)
+---
+title: No Business Logic In Constructors
+impact: MEDIUM
+impactDescription: prevents side effects during object instantiation and improves testability
+tags: clean-code, best-practice, java
+---
+
+## No Business Logic In Constructors
+
+Constructors should only be used for initialized fields. Performing business logic (database calls, network requests) inside a constructor makes the object hard to test and can lead to unexpected side effects during initialization.
+
+**Incorrect (logic in constructor):**
+
+```java
+public class OrderService {
+    public OrderService() {
+        // VULNERABLE: Side effects during new OrderService()
+        loadConfiguration();
+        connectToDatabase();
+    }
+}
+```
+
+**Correct (separate initialization):**
+
+```java
+public class OrderService {
+    public OrderService() {
+        // Only simple field assignments
+    }
+
+    @PostConstruct
+    public void init() {
+        // Business logic or heavy setup here
+    }
+}
+```
+
+**Tools:** Manual Review, SonarQube (S1699)
+---
+title: Do Not Throw Generic Errors
+impact: MEDIUM
+impactDescription: makes error handling difficult for the caller
+tags: error-handling, exceptions, java
+---
+
+## Do Not Throw Generic Errors
+
+Throwing `Exception` or `RuntimeException` provides no context to the caller. Always throw specific, meaningful exceptions.
+
+**Incorrect (generic throws):**
+
+```java
+public void findUser(String id) throws Exception {
+    if (id == null) throw new Exception("ID missing");
+}
+```
+
+**Correct (specific throws):**
+
+```java
+public void findUser(String id) {
+    if (id == null) throw new IllegalArgumentException("User ID cannot be null");
+}
+```
+
+**Tools:** SonarQube (S2221), Manual Review
+---
+title: Do Not Use Error Log Level For Non-Critical Issues
+impact: MEDIUM
+impactDescription: prevents log noise and ensures relevant alerts
+tags: logging, best-practice, java
+---
+
+## Do Not Use Error Log Level For Non-Critical Issues
+
+The `ERROR` level should be reserved for issues that require immediate developer attention. For expected failures (like invalid user input), use `WARN` or `INFO`.
+
+**Incorrect (error for everything):**
+
+```java
+if (user == null) {
+    log.error("User not found: {}", id); // Should be WARN or INFO
+}
+```
+
+**Correct (appropriate log levels):**
+
+```java
+if (user == null) {
+    log.warn("Attempt to access non-existent user: {}", id);
+}
+
+try {
+    db.save(data);
+} catch (SQLException e) {
+    log.error("Critical database failure", e); // TRUE ERROR
+}
+```
+
+**Tools:** Manual Review

package/skill-assets/sunlint-code-quality/rules/java/C014-dependency-injection.md

@@ -0,0 +1,42 @@
+---
+title: Use Dependency Injection
+impact: HIGH
+impactDescription: improves testability and decouples components
+tags: dependency-injection, spring, testing, java
+---
+
+## Use Dependency Injection
+
+Hardcoding dependencies (using `new`) makes components tightly coupled and difficult to test. Dependency Injection (DI) allows the framework to manage object lifecycles and permits easy mocking during unit tests.
+
+**Incorrect (tight coupling):**
+
+```java
+public class UserService {
+    private final UserRepository repo = new UserRepository(); // VULNERABLE to tight coupling
+    
+    public void save(User user) {
+        repo.save(user);
+    }
+}
+```
+
+**Correct (constructor injection):**
+
+```java
+@Service
+public class UserService {
+    private final UserRepository repo;
+
+    // SECURE: Dependency is injected via constructor
+    public UserService(UserRepository repo) {
+        this.repo = repo;
+    }
+    
+    public void save(User user) {
+        repo.save(user);
+    }
+}
+```
+
+**Tools:** Spring Framework, Dagger, Guice, SonarQube (S3306)

package/skill-assets/sunlint-code-quality/rules/java/C017-no-constructor-logic.md

@@ -0,0 +1,39 @@
+---
+title: No Business Logic In Constructors
+impact: MEDIUM
+impactDescription: prevents side effects during object instantiation and improves testability
+tags: clean-code, best-practice, java
+---
+
+## No Business Logic In Constructors
+
+Constructors should only be used for initialized fields. Performing business logic (database calls, network requests) inside a constructor makes the object hard to test and can lead to unexpected side effects during initialization.
+
+**Incorrect (logic in constructor):**
+
+```java
+public class OrderService {
+    public OrderService() {
+        // VULNERABLE: Side effects during new OrderService()
+        loadConfiguration();
+        connectToDatabase();
+    }
+}
+```
+
+**Correct (separate initialization):**
+
+```java
+public class OrderService {
+    public OrderService() {
+        // Only simple field assignments
+    }
+
+    @PostConstruct
+    public void init() {
+        // Business logic or heavy setup here
+    }
+}
+```
+
+**Tools:** Manual Review, SonarQube (S1699)

package/skill-assets/sunlint-code-quality/rules/java/C018-generic-errors.md

@@ -0,0 +1,28 @@
+---
+title: Do Not Throw Generic Errors
+impact: MEDIUM
+impactDescription: makes error handling difficult for the caller
+tags: error-handling, exceptions, java
+---
+
+## Do Not Throw Generic Errors
+
+Throwing `Exception` or `RuntimeException` provides no context to the caller. Always throw specific, meaningful exceptions.
+
+**Incorrect (generic throws):**
+
+```java
+public void findUser(String id) throws Exception {
+    if (id == null) throw new Exception("ID missing");
+}
+```
+
+**Correct (specific throws):**
+
+```java
+public void findUser(String id) {
+    if (id == null) throw new IllegalArgumentException("User ID cannot be null");
+}
+```
+
+**Tools:** SonarQube (S2221), Manual Review