@sun-asterisk/sunlint 1.3.39 → 1.3.41

package/skill-assets/sunlint-code-quality/rules/python/S058-ssrf-protection.md

@@ -0,0 +1,57 @@
+---
+title: Protect Against SSRF Attacks
+impact: CRITICAL
+impactDescription: prevents attackers from making requests to internal infrastructure
+tags: security, ssrf, networking, python, pyspark
+---
+
+## Protect Against SSRF Attacks
+
+Server-Side Request Forgery (SSRF) allows an attacker to force the server to make requests to internal services, metadata APIs (like AWS/GCP metadata), or other restricted targets.
+
+**Incorrect (unvalidated URL/target):**
+
+```python
+import requests
+
+# Unsafe: user controls the URL directly
+data_url = request.args.get('url')
+response = requests.get(data_url)
+# Attacker could pass: http://169.254.169.254/latest/meta-data/
+```
+
+**Correct (validation and allow-listing):**
+
+```python
+import requests
+from urllib.parse import urlparse
+
+ALLOWED_DOMAINS = ['trusted-source.com', 'api.company.com']
+
+def safe_fetch(url):
+    parsed = urlparse(url)
+    if parsed.scheme not in ['http', 'https']:
+        raise ValueError("Invalid scheme")
+    
+    if parsed.netloc not in ALLOWED_DOMAINS:
+        raise ValueError("Domain not allowed")
+    
+    # Also check if IP is internal (optional but recommended)
+    # ... IP validation logic ...
+    
+    return requests.get(url, timeout=5)
+
+# PySpark Context: When reading from remote sources
+# Ensure the source URL is validated or comes from a trusted configuration
+trusted_s3_path = config.get('SOURCE_BUCKET_URL')
+df = spark.read.parquet(f"{trusted_s3_path}/data.parquet")
+```
+
+**Prevention Strategies:**
+- Use an allow-list of domains/IPs
+- Validate URL scheme (enforce `https`)
+- Block requests to internal/private IP ranges
+- Disable HTTP redirections if possible
+- Use dedicated service accounts with minimal permissions
+
+**Tools:** Bandit, SonarQube, Semgrep

package/skill-assets/sunlint-code-quality/rules/typescript/C006-verb-noun-functions.md

@@ -0,0 +1,45 @@
+---
+title: Function Names Verb-Noun
+impact: LOW
+impactDescription: makes code self-documenting
+tags: naming, functions, readability, conventions, quality
+---
+
+## Function Names Verb-Noun
+
+Functions do things. Action verbs make purpose clear.
+
+**Incorrect (vague names):**
+
+```typescript
+function user() { }           // Noun only
+function userData() { }       // Noun only
+function doSomething() { }    // Vague
+function handleStuff() { }    // Vague
+function manager() { }        // Noun only
+```
+
+**Correct (action verbs):**
+
+```typescript
+function getUser() { }
+function createUserAccount() { }
+function validateEmailFormat() { }
+function calculateTotalPrice() { }
+function sendConfirmationEmail() { }
+function convertCurrencyToUSD() { }
+```
+
+**Verb categories:**
+
+| Category | Verbs |
+|----------|-------|
+| Retrieval | `get`, `fetch`, `find`, `load`, `query` |
+| Creation | `create`, `build`, `make`, `generate` |
+| Modification | `set`, `update`, `modify`, `change` |
+| Deletion | `delete`, `remove`, `destroy`, `clear` |
+| Validation | `validate`, `verify`, `check`, `ensure` |
+| Computation | `calculate`, `compute`, `parse`, `format` |
+| Boolean | `is`, `has`, `can`, `should`, `will` |
+
+**Tools:** PR review, Linter

package/skill-assets/sunlint-code-quality/rules/typescript/C013-no-dead-code.md

@@ -0,0 +1,51 @@
+---
+title: Do Not Use Dead Code
+impact: LOW
+impactDescription: reduces codebase noise and bundle size
+tags: dead-code, cleanup, maintenance, quality
+---
+
+## Do Not Use Dead Code
+
+Dead code confuses readers and increases bundle size. Git history preserves deleted code.
+
+**Incorrect (keeping dead code):**
+
+```typescript
+function processOrder(order: Order) {
+  // Old implementation - keeping for reference
+  // const total = order.items.reduce((sum, item) => {
+  //   return sum + item.price * item.quantity;
+  // }, 0);
+  
+  const total = calculateTotal(order);
+  return total;
+}
+
+// Unused function - someone might need it later
+function legacyCalculation() { }
+
+import { unusedHelper } from './utils';  // Never used
+```
+
+**Correct (clean code):**
+
+```typescript
+function processOrder(order: Order) {
+  const total = calculateTotal(order);
+  return total;
+}
+
+// Delete unused functions - git history preserves them
+// Delete commented code - git history preserves it
+// Remove unused imports
+```
+
+**Types of dead code:**
+- Commented-out code
+- Unused functions/classes
+- Unused imports
+- Unreachable code
+- Unused variables
+
+**Tools:** ESLint, TypeScript strict, Tree shaking

package/skill-assets/sunlint-code-quality/rules/typescript/C014-dependency-injection.md

@@ -0,0 +1,69 @@
+---
+title: Use Dependency Injection
+impact: HIGH
+impactDescription: enables testability and loose coupling
+tags: dependency-injection, testing, coupling, architecture, quality
+---
+
+## Use Dependency Injection
+
+Direct instantiation creates tight coupling, making testing difficult and changes risky. DI enables mockability, replaceability, and testability.
+
+**Incorrect (hardcoded dependencies):**
+
+```typescript
+class OrderService {
+  private db = new DatabaseConnection(); // Hardcoded dependency
+  private mailer = new EmailService();   // Hardcoded dependency
+
+  async createOrder(data: OrderData) {
+    const order = await this.db.insert('orders', data);
+    await this.mailer.send(data.email, 'Order created');
+    return order;
+  }
+}
+```
+
+**Correct (injected dependencies):**
+
+```typescript
+interface IDatabase {
+  insert(table: string, data: unknown): Promise<unknown>;
+}
+
+interface IMailer {
+  send(to: string, message: string): Promise<void>;
+}
+
+class OrderService {
+  constructor(
+    private db: IDatabase,
+    private mailer: IMailer
+  ) {}
+
+  async createOrder(data: OrderData) {
+    const order = await this.db.insert('orders', data);
+    await this.mailer.send(data.email, 'Order created');
+    return order;
+  }
+}
+
+// Usage
+const service = new OrderService(
+  new PostgresDatabase(connectionString),
+  new SendGridMailer(apiKey)
+);
+
+// Testing
+const mockDb = { insert: jest.fn() };
+const mockMailer = { send: jest.fn() };
+const testService = new OrderService(mockDb, mockMailer);
+```
+
+**Benefits:**
+- Easy mocking for unit tests
+- Swappable implementations
+- Clear dependencies visible in constructor
+- Supports interface-based design
+
+**Tools:** Static analyzer, PR review

package/skill-assets/sunlint-code-quality/rules/typescript/C017-no-constructor-logic.md

@@ -0,0 +1,60 @@
+---
+title: No Business Logic In Constructors
+impact: HIGH
+impactDescription: ensures predictable object initialization
+tags: constructor, initialization, side-effects, patterns, quality
+---
+
+## No Business Logic In Constructors
+
+Constructors should only initialize state. Side effects in constructors are unexpected and make testing difficult.
+
+**Incorrect (logic in constructor):**
+
+```typescript
+class UserService {
+  private config: Config;
+  
+  constructor(configPath: string) {
+    // BAD: Reading files in constructor
+    const rawConfig = fs.readFileSync(configPath);
+    this.config = JSON.parse(rawConfig);
+    
+    // BAD: API calls in constructor
+    const response = await fetch('/api/init');
+    
+    // BAD: Logging/side effects
+    logger.info('UserService initialized');
+  }
+}
+```
+
+**Correct (factory method pattern):**
+
+```typescript
+class UserService {
+  constructor(
+    private readonly config: Config,
+    private readonly httpClient: HttpClient
+  ) {
+    // Only assignment - no side effects
+  }
+
+  // Factory method for complex initialization
+  static async create(configPath: string): Promise<UserService> {
+    const rawConfig = await fs.readFile(configPath);
+    const config = JSON.parse(rawConfig);
+    
+    const httpClient = new HttpClient(config.baseUrl);
+    await httpClient.initialize();
+    
+    logger.info('UserService initialized');
+    return new UserService(config, httpClient);
+  }
+}
+
+// Usage
+const service = await UserService.create('./config.json');
+```
+
+**Tools:** Static analyzer, Manual review

package/skill-assets/sunlint-code-quality/rules/typescript/C018-generic-errors.md

@@ -0,0 +1,47 @@
+---
+title: Do Not Throw Generic Errors
+impact: HIGH
+impactDescription: enables proper error handling and monitoring
+tags: error-handling, exceptions, custom-errors, debugging, quality
+---
+
+## Do Not Throw Generic Errors
+
+Generic errors lack context needed for debugging. They make it impossible to distinguish between error types for proper handling.
+
+**Incorrect (generic errors):**
+
+```typescript
+if (!user) {
+  throw new Error("error");
+}
+
+if (!isValid) {
+  throw new RuntimeException();
+}
+```
+
+**Correct (specific custom errors):**
+
+```typescript
+if (!user) {
+  throw new UserNotFoundError(`User with ID ${userId} not found in database`);
+}
+
+if (!isValid) {
+  throw new ValidationError({
+    field: 'email',
+    message: 'Email format is invalid',
+    value: email,
+    code: 'INVALID_EMAIL_FORMAT'
+  });
+}
+```
+
+Custom errors should include:
+- Descriptive message with context
+- Error code for programmatic handling
+- Relevant data for debugging
+- Appropriate HTTP status mapping
+
+**Tools:** Linter, Manual review

package/skill-assets/sunlint-code-quality/rules/typescript/C019-error-log-level.md

@@ -0,0 +1,50 @@
+---
+title: Do Not Use Error Log For Non-critical
+impact: HIGH
+impactDescription: prevents alert fatigue and log noise
+tags: logging, log-levels, error, observability, quality
+---
+
+## Do Not Use Error Log For Non-critical
+
+Incorrect log levels cause alert fatigue and hide real issues. When everything is an "error", nothing is.
+
+**Incorrect (overusing error level):**
+
+```typescript
+// NOT an error - expected business case
+logger.error('User entered wrong password');
+
+// NOT an error - validation failure
+logger.error('Email format invalid');
+
+// NOT an error - temporary network issue
+logger.error('Retry attempt 2 of 5');
+```
+
+**Correct (appropriate log levels):**
+
+```typescript
+// WARN - recoverable, may need attention
+logger.warn('Payment retry attempt', { attempt: 2, maxAttempts: 5 });
+
+// INFO - normal business events
+logger.info('Login failed - invalid password', { userId, attempts: 3 });
+
+// DEBUG - detailed troubleshooting
+logger.debug('Validation failed', { field: 'email', value: maskedEmail });
+
+// ERROR - only for actual system failures
+logger.error('Database connection lost', { host: dbHost, error });
+```
+
+**Log Level Guide:**
+
+| Level | Use For |
+|-------|---------|
+| ERROR | System failures, crashes, unrecoverable |
+| WARN | Potential issues, degraded performance |
+| INFO | Business events, state changes |
+| DEBUG | Detailed troubleshooting |
+
+**Tools:** Log linter, Custom rule

package/skill-assets/sunlint-code-quality/rules/typescript/C020-no-unused-imports.md

@@ -0,0 +1,55 @@
+---
+title: Do Not Import Unused Modules
+impact: LOW
+impactDescription: reduces bundle size and improves clarity
+tags: imports, cleanup, bundle-size, quality
+---
+
+## Do Not Import Unused Modules
+
+Unused imports add noise and increase bundle sizes.
+
+**Incorrect (unused imports):**
+
+```typescript
+import { User, Order, Product, Category } from './models';
+import { formatDate, parseDate } from 'date-utils';
+import _ from 'lodash';
+
+// Only User is actually used
+function getUser(id: string): User {
+  return db.findById(id);
+}
+```
+
+**Correct (only needed imports):**
+
+```typescript
+import { User } from './models';
+
+function getUser(id: string): User {
+  return db.findById(id);
+}
+```
+
+**Auto-removal:**
+
+```json
+// tsconfig.json
+{
+  "compilerOptions": {
+    "noUnusedLocals": true,
+    "noUnusedParameters": true
+  }
+}
+
+// .eslintrc
+{
+  "rules": {
+    "no-unused-vars": "error",
+    "@typescript-eslint/no-unused-vars": "error"
+  }
+}
+```
+
+**Tools:** ESLint, TypeScript, IDE auto-organize

package/skill-assets/sunlint-code-quality/rules/typescript/C022-no-unused-variables.md

@@ -0,0 +1,59 @@
+---
+title: Do Not Leave Unused Variables
+impact: LOW
+impactDescription: reduces code noise and potential bugs
+tags: variables, cleanup, quality
+---
+
+## Do Not Leave Unused Variables
+
+Unused variables suggest incomplete refactoring or bugs.
+
+**Incorrect (unused variables):**
+
+```typescript
+function processOrder(order: Order) {
+  const user = order.user;      // Never used
+  const total = order.total;    // Never used
+  const items = order.items;
+  
+  return items.map(i => i.name);
+}
+```
+
+**Correct (only needed variables):**
+
+```typescript
+function processOrder(order: Order) {
+  return order.items.map(i => i.name);
+}
+
+// If destructuring, use underscore prefix for intentionally ignored
+function handleEvent({ type, _payload }: Event) {
+  console.log(`Event: ${type}`);
+  // _payload intentionally unused
+}
+```
+
+**Configuration:**
+
+```json
+// tsconfig.json
+{
+  "compilerOptions": {
+    "noUnusedLocals": true
+  }
+}
+
+// ESLint
+{
+  "rules": {
+    "@typescript-eslint/no-unused-vars": ["error", {
+      "argsIgnorePattern": "^_",
+      "varsIgnorePattern": "^_"
+    }]
+  }
+}
+```
+
+**Tools:** ESLint, TypeScript compiler

package/skill-assets/sunlint-code-quality/rules/typescript/C023-no-duplicate-names.md

@@ -0,0 +1,58 @@
+---
+title: No Duplicate Variable Names In Scope
+impact: HIGH
+impactDescription: prevents shadowing bugs
+tags: variables, shadowing, scope, quality
+---
+
+## No Duplicate Variable Names In Scope
+
+Variable shadowing causes subtle bugs where inner variables hide outer ones.
+
+**Incorrect (shadowed variables):**
+
+```typescript
+const user = getCurrentUser();
+
+function processOrder(order: Order) {
+  const user = order.user;  // Shadows outer user!
+  
+  // Which user is this?
+  console.log(user.name);
+}
+
+// Same name in nested scope
+for (const item of items) {
+  const item = transform(item);  // Shadows loop variable!
+}
+```
+
+**Correct (unique names):**
+
+```typescript
+const currentUser = getCurrentUser();
+
+function processOrder(order: Order) {
+  const orderUser = order.user;  // Clear distinction
+  
+  console.log(orderUser.name);
+}
+
+// Different names in nested scope
+for (const item of items) {
+  const transformedItem = transform(item);
+}
+```
+
+**ESLint configuration:**
+
+```json
+{
+  "rules": {
+    "no-shadow": "error",
+    "@typescript-eslint/no-shadow": "error"
+  }
+}
+```
+
+**Tools:** ESLint (no-shadow), TypeScript

package/skill-assets/sunlint-code-quality/rules/typescript/C024-centralize-constants.md

@@ -0,0 +1,56 @@
+---
+title: Centralize Constants
+impact: HIGH
+impactDescription: makes values easy to find and update
+tags: constants, magic-numbers, configuration, quality
+---
+
+## Centralize Constants
+
+Magic numbers scattered throughout code are hard to find and change.
+
+**Incorrect (magic numbers):**
+
+```typescript
+if (password.length < 8) { }
+if (retryCount > 3) { }
+if (status === 1) { }
+setTimeout(callback, 300000);
+if (user.role === 'admin') { }
+```
+
+**Correct (centralized constants):**
+
+```typescript
+// constants.ts
+export const PASSWORD_MIN_LENGTH = 8;
+export const MAX_RETRY_ATTEMPTS = 3;
+export const SESSION_TIMEOUT_MS = 5 * 60 * 1000;  // 5 minutes
+
+export const OrderStatus = {
+  PENDING: 1,
+  APPROVED: 2,
+  SHIPPED: 3,
+} as const;
+
+export const UserRole = {
+  ADMIN: 'admin',
+  USER: 'user',
+  GUEST: 'guest',
+} as const;
+
+// Usage
+if (password.length < PASSWORD_MIN_LENGTH) { }
+if (retryCount > MAX_RETRY_ATTEMPTS) { }
+if (status === OrderStatus.PENDING) { }
+setTimeout(callback, SESSION_TIMEOUT_MS);
+if (user.role === UserRole.ADMIN) { }
+```
+
+**Benefits:**
+- Single source of truth
+- Self-documenting
+- Easy to update
+- Type safety with `as const`
+
+**Tools:** Linter, Code Review

package/skill-assets/sunlint-code-quality/rules/typescript/C029-catch-log-root-cause.md

@@ -0,0 +1,53 @@
+---
+title: All Catch Blocks Must Log Root Cause
+impact: HIGH
+impactDescription: enables debugging and incident response
+tags: error-handling, logging, debugging, observability, quality
+---
+
+## All Catch Blocks Must Log Root Cause
+
+Silent failures make debugging impossible. Without proper logging, you cannot trace issues in production.
+
+**Incorrect (silent or minimal logging):**
+
+```typescript
+try {
+  await processPayment(order);
+} catch (e) {
+  // Empty catch - silent failure!
+}
+
+try {
+  await saveUser(user);
+} catch (e) {
+  return null; // No logging, no context
+}
+```
+
+**Correct (comprehensive error logging):**
+
+```typescript
+try {
+  await processPayment(order);
+} catch (error) {
+  logger.error('Payment processing failed', {
+    orderId: order.id,
+    userId: order.userId,
+    amount: order.amount,
+    error: error.message,
+    stack: error.stack,
+    requestId: context.requestId
+  });
+  throw new PaymentFailedError('Payment could not be processed', { cause: error });
+}
+```
+
+**Log context should include:**
+- Error message and stack trace
+- Relevant entity IDs (order, user, etc.)
+- Request/correlation ID
+- Input that caused the error
+- Timing information
+
+**Tools:** Static analyzer, ESLint, PR review