@sun-asterisk/sunlint 1.3.39 → 1.3.41

package/skill-assets/sunlint-code-quality/rules/typescript/S006-default-credentials.md

@@ -0,0 +1,69 @@
+---
+title: Do Not Use Default Credentials
+impact: CRITICAL
+impactDescription: prevents trivial compromise via known credentials
+tags: credentials, default, passwords, configuration, security
+---
+
+## Do Not Use Default Credentials
+
+Default credentials are publicly known. Attackers scan for them automatically, making any system using them trivially compromised.
+
+**Incorrect (default or hardcoded credentials):**
+
+```yaml
+# Docker Compose with defaults
+services:
+  postgres:
+    image: postgres
+    environment:
+      POSTGRES_USER: postgres
+      POSTGRES_PASSWORD: postgres  # Default!
+      
+  redis:
+    image: redis
+    # No password = default open
+
+# Application config
+database:
+  user: admin
+  password: admin  # Default!
+```
+
+**Correct (environment/secrets management):**
+
+```yaml
+# Docker Compose with secrets
+services:
+  postgres:
+    image: postgres
+    environment:
+      POSTGRES_USER: ${DB_USER}  # From env/secrets
+      POSTGRES_PASSWORD_FILE: /run/secrets/db_password
+    secrets:
+      - db_password
+
+secrets:
+  db_password:
+    external: true  # Managed by orchestrator
+```
+
+```typescript
+// Application code
+const dbConfig = {
+  user: process.env.DB_USER,
+  password: await secretManager.getSecret('db-password'),
+};
+
+// Validate no defaults
+if (dbConfig.password === 'admin' || dbConfig.password === 'password') {
+  throw new Error('Default credentials detected - deployment blocked');
+}
+```
+
+**Blocked defaults:**
+- `admin/admin`, `root/root`, `test/test`
+- `postgres/postgres`, `mysql/mysql`, `sa/sa`
+- Factory default API keys
+
+**Tools:** Secret Scanner, GitLeaks, TruffleHog, CI/CD checks

package/skill-assets/sunlint-code-quality/rules/typescript/S007-output-encoding.md

@@ -0,0 +1,60 @@
+---
+title: Output Encoding Before Interpreter Use
+impact: HIGH
+impactDescription: prevents XSS and injection attacks
+tags: xss, encoding, output, html, security
+---
+
+## Output Encoding Before Interpreter Use
+
+XSS and injection attacks occur when unescaped user data is interpreted by browsers or other systems.
+
+**Incorrect (no encoding):**
+
+```typescript
+// XSS vulnerability
+app.get('/search', (req, res) => {
+  const query = req.query.q;
+  res.send(`<h1>Results for: ${query}</h1>`);  // XSS!
+});
+
+// React dangerouslySetInnerHTML without sanitization
+<div dangerouslySetInnerHTML={{ __html: userContent }} />
+```
+
+**Correct (context-aware encoding):**
+
+```typescript
+import { escape } from 'html-escaper';
+import DOMPurify from 'dompurify';
+
+// HTML context
+app.get('/search', (req, res) => {
+  const query = escape(req.query.q);
+  res.send(`<h1>Results for: ${query}</h1>`);
+});
+
+// React - use JSX (auto-escapes)
+<h1>Results for: {query}</h1>
+
+// If HTML is needed, sanitize first
+const cleanHtml = DOMPurify.sanitize(userContent);
+<div dangerouslySetInnerHTML={{ __html: cleanHtml }} />
+
+// URL context
+const safeUrl = encodeURIComponent(userInput);
+
+// JavaScript context
+const safeJson = JSON.stringify(userData);
+```
+
+**Encoding by Context:**
+
+| Context | Encoding |
+|---------|----------|
+| HTML body | `&lt;`, `&gt;`, `&amp;` |
+| HTML attribute | Encode quotes |
+| JavaScript | JSON.stringify() |
+| URL | encodeURIComponent() |
+
+**Tools:** SonarQube (S5131), Semgrep, ESLint

package/skill-assets/sunlint-code-quality/rules/typescript/S009-approved-crypto.md

@@ -0,0 +1,53 @@
+---
+title: Use Only Approved Crypto Algorithms
+impact: MEDIUM
+impactDescription: ensures cryptographic strength
+tags: cryptography, algorithms, hashing, encryption, security
+---
+
+## Use Only Approved Crypto Algorithms
+
+Weak algorithms are broken. MD5, SHA1, DES, and ECB mode have known vulnerabilities.
+
+**Incorrect (weak algorithms):**
+
+```typescript
+// WEAK hash
+const hash = crypto.createHash('md5').update(password).digest('hex');
+
+// WEAK cipher mode (ECB shows patterns)
+const cipher = crypto.createCipheriv('aes-256-ecb', key, '');
+
+// WEAK algorithm
+const cipher = crypto.createCipheriv('des', key, iv);
+```
+
+**Correct (approved algorithms):**
+
+```typescript
+import crypto from 'crypto';
+import bcrypt from 'bcrypt';
+
+// STRONG hash (for data integrity)
+const hash = crypto.createHash('sha256').update(data).digest('hex');
+
+// STRONG authenticated encryption (GCM mode)
+const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);
+cipher.setAAD(associatedData);
+const encrypted = cipher.update(plaintext);
+const authTag = cipher.getAuthTag();
+
+// For passwords - use specialized functions
+const hashedPassword = await bcrypt.hash(password, 12);
+const isValid = await bcrypt.compare(password, hashedPassword);
+```
+
+**Approved vs Prohibited:**
+
+| Purpose | Approved | Prohibited |
+|---------|----------|------------|
+| Hash | SHA-256, SHA-3, BLAKE2 | MD5, SHA-1 |
+| Encryption | AES-GCM, ChaCha20-Poly1305 | DES, 3DES, AES-ECB |
+| Password | bcrypt, Argon2, scrypt | MD5, SHA-*, plain AES |
+
+**Tools:** SonarQube (S2070, S4790), Semgrep

package/skill-assets/sunlint-code-quality/rules/typescript/S010-csprng.md

@@ -0,0 +1,53 @@
+---
+title: Use CSPRNG For Security Purposes
+impact: HIGH
+impactDescription: prevents predictable tokens and session hijacking
+tags: random, csprng, tokens, session, cryptography, security
+---
+
+## Use CSPRNG For Security Purposes
+
+Non-cryptographic random generators are predictable. Attackers can guess session tokens, OTPs, and password reset links generated with weak random sources.
+
+**Incorrect (predictable random):**
+
+```typescript
+// INSECURE - predictable!
+const sessionId = Math.random().toString(36);
+
+// INSECURE - Date-based
+const resetToken = Date.now().toString(36) + Math.random().toString(36);
+
+// INSECURE - UUID v1 (time-based, guessable)
+const otp = uuidv1().substring(0, 6);
+```
+
+**Correct (cryptographically secure):**
+
+```typescript
+import { randomBytes } from 'crypto';
+
+// Cryptographically secure session ID
+const sessionId = randomBytes(32).toString('hex');  // 256-bit entropy
+
+// Secure OTP generation
+function generateOTP(length: number = 6): string {
+  const bytes = randomBytes(4);
+  const num = bytes.readUInt32BE(0) % Math.pow(10, length);
+  return num.toString().padStart(length, '0');
+}
+
+// Secure token for password reset
+const resetToken = randomBytes(32).toString('base64url');
+```
+
+**CSPRNG by language:**
+
+| Language | Secure | Insecure |
+|----------|--------|----------|
+| Node.js | `crypto.randomBytes()` | `Math.random()` |
+| Python | `secrets`, `os.urandom()` | `random` |
+| Java | `SecureRandom` | `Random` |
+| Go | `crypto/rand` | `math/rand` |
+
+**Tools:** SonarQube (S2245), Semgrep

package/skill-assets/sunlint-code-quality/rules/typescript/S011-encrypted-client-hello.md

@@ -0,0 +1,45 @@
+---
+title: Enable Encrypted Client Hello (ECH)
+impact: MEDIUM
+impactDescription: protects SNI from eavesdropping
+tags: tls, ech, sni, privacy, security
+---
+
+## Enable Encrypted Client Hello (ECH)
+
+ECH encrypts the Server Name Indication (SNI) to prevent network observers from seeing which site you're connecting to.
+
+**About ECH:**
+
+Encrypted Client Hello (formerly ESNI) is a TLS extension that encrypts the ClientHello message, hiding the destination hostname from network observers.
+
+**Implementation:**
+
+```nginx
+# Nginx with ECH (when supported)
+ssl_ech on;
+ssl_ech_key /path/to/ech-private-key.pem;
+```
+
+**DNS Configuration:**
+
+```
+# HTTPS DNS record for ECH
+_https.example.com. IN HTTPS 1 . alpn="h2,h3" ipv4hint=192.0.2.1 ech="..."
+```
+
+**Client-side (where supported):**
+
+```typescript
+// Browser support detection
+if ('ECH' in navigator) {
+  console.log('ECH is supported');
+}
+```
+
+**Current status:**
+- Experimental in most browsers
+- Cloudflare supports ECH
+- Requires DNS HTTPS records
+
+**Tools:** Cloudflare ECH, DNS Configuration

package/skill-assets/sunlint-code-quality/rules/typescript/S012-secrets-management.md

@@ -0,0 +1,47 @@
+---
+title: Use Secrets Management For Backend Secrets
+impact: CRITICAL
+impactDescription: centralizes and secures credential storage
+tags: secrets, vault, credentials, configuration, security
+---
+
+## Use Secrets Management For Backend Secrets
+
+Hardcoded secrets are exposed in version control and can be accessed by anyone with code access. Use dedicated secrets management systems.
+
+**Incorrect (hardcoded or plain env files):**
+
+```typescript
+// Hardcoded in code
+const API_KEY = 'sk-abc123xyz789';
+
+// .env file committed to repo
+DATABASE_URL=postgres://admin:password@localhost/db
+```
+
+**Correct (secrets management):**
+
+```typescript
+// Using secrets manager (AWS, HashiCorp Vault, etc.)
+const dbPassword = await secretManager.getSecret('production/db-password');
+
+// Kubernetes secrets
+const secret = process.env.DB_PASSWORD; // Mounted from K8s secret
+
+// Environment-specific with validation
+const config = {
+  dbPassword: process.env.DB_PASSWORD,
+};
+
+if (!config.dbPassword) {
+  throw new Error('DB_PASSWORD environment variable required');
+}
+```
+
+**Best practices:**
+- Never commit secrets to version control
+- Use secrets rotation
+- Audit secret access
+- Use different secrets per environment
+
+**Tools:** HashiCorp Vault, AWS Secrets Manager, Azure Key Vault

package/skill-assets/sunlint-code-quality/rules/typescript/S013-tls-connections.md

@@ -0,0 +1,70 @@
+---
+title: Always Use TLS For All Connections
+impact: HIGH
+impactDescription: protects data in transit from eavesdropping
+tags: tls, https, encryption, transport, security
+---
+
+## Always Use TLS For All Connections
+
+Unencrypted traffic exposes data to anyone on the network path - ISPs, WiFi operators, and attackers.
+
+**Incorrect (unencrypted connections):**
+
+```typescript
+// HTTP API calls
+fetch('http://api.example.com/users');
+
+// Unencrypted database
+mongoose.connect('mongodb://db.example.com:27017/app');
+
+// Redis without TLS
+const redis = new Redis({ host: 'redis.example.com', port: 6379 });
+```
+
+**Correct (TLS everywhere):**
+
+```typescript
+// HTTPS for all APIs
+fetch('https://api.example.com/users');
+
+// TLS for database
+mongoose.connect('mongodb://db.example.com:27017/app', {
+  tls: true,
+  tlsCAFile: '/path/to/ca.pem'
+});
+
+// Redis with TLS
+const redis = new Redis({
+  host: 'redis.example.com',
+  port: 6380,
+  tls: {
+    ca: fs.readFileSync('/path/to/ca.pem')
+  }
+});
+
+// Force HTTPS in Express
+app.use((req, res, next) => {
+  if (!req.secure && process.env.NODE_ENV === 'production') {
+    return res.redirect(301, `https://${req.headers.host}${req.url}`);
+  }
+  next();
+});
+
+// HSTS header
+app.use(helmet.hsts({
+  maxAge: 31536000,  // 1 year
+  includeSubDomains: true,
+  preload: true
+}));
+```
+
+**Checklist:**
+- [ ] All HTTP → HTTPS
+- [ ] Database connections encrypted
+- [ ] Redis/memcached TLS
+- [ ] Message queues TLS
+- [ ] HSTS headers enabled
+- [ ] No localhost exceptions in production
+
+**Tools:** OWASP ZAP, SSLyze, Lighthouse

package/skill-assets/sunlint-code-quality/rules/typescript/S016-no-sensitive-query-string.md

@@ -0,0 +1,53 @@
+---
+title: Do Not Pass Sensitive Data In Query String
+impact: HIGH
+impactDescription: prevents credential leakage in logs and history
+tags: url, query-string, sensitive-data, leakage, security
+---
+
+## Do Not Pass Sensitive Data In Query String
+
+Query strings appear in logs, browser history, referrer headers, and can be cached.
+
+**Incorrect (sensitive data in URL):**
+
+```typescript
+// Tokens in URL
+fetch(`/api/data?token=${accessToken}`);
+
+// Password in URL
+fetch(`/api/login?user=admin&pass=${password}`);
+
+// PII in URL
+fetch(`/api/search?ssn=${socialSecurityNumber}`);
+```
+
+**Correct (sensitive data in body/headers):**
+
+```typescript
+// Token in header
+fetch('/api/data', {
+  headers: { 'Authorization': `Bearer ${accessToken}` }
+});
+
+// Credentials in body
+fetch('/api/login', {
+  method: 'POST',
+  headers: { 'Content-Type': 'application/json' },
+  body: JSON.stringify({ user: 'admin', pass: password })
+});
+
+// Reset token via POST
+<form method="POST" action="/reset-password">
+  <input type="hidden" name="token" value="abc123">
+</form>
+```
+
+**Where query strings leak:**
+- Server access logs
+- Browser history
+- Referrer headers
+- Proxy/CDN logs
+- Shared URLs
+
+**Tools:** Semgrep, Manual Review, Proxy log scanner

package/skill-assets/sunlint-code-quality/rules/typescript/S017-parameterized-queries.md

@@ -0,0 +1,55 @@
+---
+title: Always Use Parameterized Queries
+impact: CRITICAL
+impactDescription: prevents SQL and NoSQL injection attacks
+tags: injection, sql, nosql, database, parameterized, security
+---
+
+## Always Use Parameterized Queries
+
+SQL injection is one of the top security vulnerabilities. Direct string concatenation allows attackers to execute arbitrary database commands, steal data, or destroy databases.
+
+**Incorrect (string concatenation):**
+
+```typescript
+// SQL Injection vulnerability
+const userId = req.params.id;
+const query = `SELECT * FROM users WHERE id = '${userId}'`;
+const user = await db.query(query);
+
+// Attacker input: ' OR '1'='1
+// Resulting query: SELECT * FROM users WHERE id = '' OR '1'='1'
+// Returns ALL users!
+```
+
+```javascript
+// NoSQL Injection in MongoDB
+const user = await User.findOne({ 
+  username: req.body.username,
+  password: req.body.password  // Attacker can pass { "$gt": "" }
+});
+```
+
+**Correct (parameterized queries):**
+
+```typescript
+// Parameterized query - SQL
+const userId = req.params.id;
+const user = await db.query(
+  'SELECT * FROM users WHERE id = $1',
+  [userId]
+);
+
+// Using ORM with type safety
+const user = await userRepository.findOne({ 
+  where: { id: userId }
+});
+
+// Safe MongoDB query
+const user = await User.findOne({ 
+  username: String(req.body.username),
+  password: String(req.body.password)
+}).exec();
+```
+
+**Tools:** SonarQube (S2077, S3649), Semgrep, CodeQL

package/skill-assets/sunlint-code-quality/rules/typescript/S019-email-input-sanitization.md

@@ -0,0 +1,56 @@
+---
+title: Sanitize Input Before Sending Emails
+impact: MEDIUM
+impactDescription: prevents email header injection
+tags: email, injection, sanitization, input-validation, security
+---
+
+## Sanitize Input Before Sending Emails
+
+Email header injection allows attackers to add recipients, change headers, or send spam through your system.
+
+**Incorrect (unsanitized email input):**
+
+```typescript
+// Email injection vulnerability
+const subject = req.body.subject;  // "Hello\r\nBcc: spam@evil.com"
+await sendEmail({
+  to: user.email,
+  subject: subject,  // Injects headers!
+  body: 'Your message'
+});
+```
+
+**Correct (sanitized email fields):**
+
+```typescript
+function sanitizeEmailField(input: string): string {
+  // Remove CRLF characters that could inject headers
+  return input.replace(/[\r\n]/g, '').trim();
+}
+
+function validateEmail(email: string): boolean {
+  const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+  return emailRegex.test(email) && !email.includes('\n');
+}
+
+app.post('/contact', async (req, res) => {
+  const { to, subject, body } = req.body;
+  
+  // Validate email address
+  if (!validateEmail(to)) {
+    return res.status(400).json({ error: 'Invalid email address' });
+  }
+  
+  // Sanitize all text fields
+  await sendEmail({
+    to: sanitizeEmailField(to),
+    subject: sanitizeEmailField(subject),
+    body: body  // Body can contain newlines, but sanitize if templating
+  });
+  
+  res.json({ success: true });
+});
+```
+
+**Tools:** Email Libraries with Built-in Protection, Manual Review

package/skill-assets/sunlint-code-quality/rules/typescript/S020-eval-code-execution.md

@@ -0,0 +1,58 @@
+---
+title: Avoid Eval Or Dynamic Code Execution
+impact: HIGH
+impactDescription: prevents remote code execution vulnerabilities
+tags: eval, code-execution, rce, injection, security
+---
+
+## Avoid Eval Or Dynamic Code Execution
+
+`eval()` and similar functions execute arbitrary code, making them extremely dangerous with user input. Attackers can run any code on your server.
+
+**Incorrect (dynamic code execution):**
+
+```typescript
+// eval() with user input
+const formula = req.body.formula;
+const result = eval(formula);  // RCE vulnerability!
+
+// new Function() with user input
+const fn = new Function('x', userCode);
+
+// setTimeout with string
+setTimeout(userInput, 1000);  // Executes as code!
+
+// Dynamic require
+const module = require(userInput);  // Path traversal + RCE
+```
+
+**Correct (safe alternatives):**
+
+```typescript
+// Use a safe expression parser
+import { evaluate } from 'mathjs';
+const result = evaluate(formula, { x: 10 }); // Limited to math
+
+// Use switch/object mapping for dynamic behavior
+const operations: Record<string, (a: number, b: number) => number> = {
+  add: (a, b) => a + b,
+  subtract: (a, b) => a - b,
+  multiply: (a, b) => a * b,
+};
+
+const operation = operations[req.body.operation];
+if (!operation) throw new Error('Invalid operation');
+const result = operation(a, b);
+
+// Use JSON.parse for data (not eval)
+const data = JSON.parse(jsonString);
+
+// Allowlist for dynamic imports
+const allowedModules = ['module-a', 'module-b'];
+if (!allowedModules.includes(moduleName)) {
+  throw new Error('Module not allowed');
+}
+const module = require(`./${moduleName}`);
+```
+
+**Tools:** ESLint (`no-eval`), Semgrep, SonarQube (S1523)

package/skill-assets/sunlint-code-quality/rules/typescript/S022-context-escaping.md

@@ -0,0 +1,48 @@
+---
+title: Escape Data By Output Context
+impact: MEDIUM
+impactDescription: ensures correct encoding for each output context
+tags: xss, escaping, context, encoding, security
+---
+
+## Escape Data By Output Context
+
+Different contexts require different escaping strategies. Using HTML encoding in a JavaScript context doesn't prevent XSS.
+
+**Incorrect (wrong encoding for context):**
+
+```typescript
+// Wrong: same escape for all contexts
+const escaped = htmlEscape(userInput);
+res.send(`<script>var x = "${escaped}";</script>`);  // Still vulnerable!
+
+// Wrong: no header injection protection
+res.setHeader('X-Custom', userInput);  // Header injection!
+```
+
+**Correct (context-appropriate encoding):**
+
+```typescript
+import { escape as htmlEscape } from 'html-escaper';
+
+// HTML content context
+const htmlContent = htmlEscape(userInput);
+res.send(`<p>${htmlContent}</p>`);
+
+// JavaScript context
+const jsData = JSON.stringify(userInput);
+res.send(`<script>var x = ${jsData};</script>`);
+
+// URL parameter context
+const urlParam = encodeURIComponent(userInput);
+res.redirect(`/search?q=${urlParam}`);
+
+// HTTP header context - strip CRLF
+const safeHeader = userInput.replace(/[\r\n]/g, '');
+res.setHeader('X-Custom', safeHeader);
+
+// Email context - prevent injection
+const safeSubject = emailInput.replace(/[\r\n]/g, '');
+```
+
+**Tools:** ESLint, SonarQube, DOMPurify