@sun-asterisk/sunlint 1.3.39 → 1.3.41

package/skill-assets/sunlint-code-quality/rules/typescript/S053-generic-error-messages.md

@@ -0,0 +1,61 @@
+---
+title: Return Generic Error Messages
+impact: HIGH
+impactDescription: prevents information disclosure
+tags: error-messages, information-disclosure, security
+---
+
+## Return Generic Error Messages
+
+Detailed error messages help attackers understand your system. Return generic messages to users.
+
+**Incorrect (detailed errors):**
+
+```typescript
+try {
+  const user = await db.query('SELECT * FROM users WHERE id = $1', [id]);
+} catch (error) {
+  // Exposes database structure!
+  res.status(500).json({ 
+    error: error.message,
+    stack: error.stack,
+    query: 'SELECT * FROM users WHERE id = $1'
+  });
+}
+
+// Exposes user enumeration
+if (!user) {
+  return res.status(404).json({ error: 'User john@example.com not found' });
+}
+if (!passwordMatch) {
+  return res.status(401).json({ error: 'Incorrect password for john@example.com' });
+}
+```
+
+**Correct (generic errors):**
+
+```typescript
+try {
+  const user = await db.query('SELECT * FROM users WHERE id = $1', [id]);
+} catch (error) {
+  // Log details internally
+  logger.error('Database query failed', { 
+    error: error.message, 
+    stack: error.stack,
+    requestId: req.id
+  });
+  
+  // Return generic message
+  res.status(500).json({ 
+    error: 'An internal error occurred',
+    requestId: req.id  // For support reference
+  });
+}
+
+// Same message for both cases prevents enumeration
+if (!user || !passwordMatch) {
+  return res.status(401).json({ error: 'Invalid credentials' });
+}
+```
+
+**Tools:** Error Handler Middleware, Security Review

package/skill-assets/sunlint-code-quality/rules/typescript/S054-no-default-admin.md

@@ -0,0 +1,64 @@
+---
+title: Avoid Default Admin/Root Accounts
+impact: HIGH
+impactDescription: prevents easy initial access by attackers
+tags: admin, default-accounts, credentials, security
+---
+
+## Avoid Default Admin/Root Accounts
+
+Default admin accounts with known credentials are automatically scanned by attackers.
+
+**Incorrect (default admin):**
+
+```typescript
+// Seed script with default admin
+await db.insert('users', {
+  email: 'admin@example.com',
+  password: await hash('admin123'),
+  role: 'admin'
+});
+```
+
+**Correct (secure admin setup):**
+
+```typescript
+// Require admin setup on first run
+app.get('/setup', async (req, res) => {
+  const hasAdmin = await db.query('SELECT 1 FROM users WHERE role = $1', ['admin']);
+  
+  if (hasAdmin.length > 0) {
+    return res.status(403).json({ error: 'Setup already completed' });
+  }
+  
+  res.render('admin-setup');
+});
+
+app.post('/setup', async (req, res) => {
+  const { email, password } = req.body;
+  
+  // Validate strong password
+  if (!isStrongPassword(password)) {
+    return res.status(400).json({ error: 'Password too weak' });
+  }
+  
+  await db.insert('users', {
+    email,
+    password: await hash(password),
+    role: 'admin'
+  });
+  
+  logger.security('Admin account created', { email });
+  res.json({ success: true });
+});
+
+// Or use environment variable for initial admin
+const INITIAL_ADMIN_EMAIL = process.env.INITIAL_ADMIN_EMAIL;
+const INITIAL_ADMIN_PASSWORD = process.env.INITIAL_ADMIN_PASSWORD;
+
+if (!INITIAL_ADMIN_PASSWORD || INITIAL_ADMIN_PASSWORD.length < 16) {
+  throw new Error('Strong admin password required');
+}
+```
+
+**Tools:** Security Audit, Configuration Review

package/skill-assets/sunlint-code-quality/rules/typescript/S055-content-type-validation.md

@@ -0,0 +1,64 @@
+---
+title: Validate Content-Type In REST Services
+impact: MEDIUM
+impactDescription: prevents content-type confusion attacks
+tags: rest, content-type, validation, api, security
+---
+
+## Validate Content-Type In REST Services
+
+Accepting unexpected content types can lead to parsing vulnerabilities and bypass security controls.
+
+**Incorrect (accepting any content):**
+
+```typescript
+// No content-type validation
+app.post('/api/data', (req, res) => {
+  // Accepts anything - XML, form data, etc.
+  processData(req.body);
+});
+```
+
+**Correct (strict content-type validation):**
+
+```typescript
+// Express middleware to validate content-type
+const validateContentType = (allowedTypes: string[]) => {
+  return (req: Request, res: Response, next: NextFunction) => {
+    const contentType = req.get('Content-Type');
+    
+    if (!contentType) {
+      return res.status(415).json({ error: 'Content-Type header required' });
+    }
+    
+    const isAllowed = allowedTypes.some(type => 
+      contentType.toLowerCase().includes(type)
+    );
+    
+    if (!isAllowed) {
+      return res.status(415).json({ 
+        error: 'Unsupported Media Type',
+        allowed: allowedTypes
+      });
+    }
+    
+    next();
+  };
+};
+
+app.post('/api/data', 
+  validateContentType(['application/json']),
+  (req, res) => {
+    processData(req.body);
+  }
+);
+
+// For file uploads
+app.post('/api/upload',
+  validateContentType(['multipart/form-data']),
+  upload.single('file'),
+  handleUpload
+);
+```
+
+**Tools:** API Gateway, Manual Review, OWASP ZAP

package/skill-assets/sunlint-code-quality/rules/typescript/S056-log-injection.md

@@ -0,0 +1,48 @@
+---
+title: Protect Against Log Injection
+impact: HIGH
+impactDescription: prevents log forging and exploitation
+tags: logging, injection, sanitization, security
+---
+
+## Protect Against Log Injection
+
+Log injection allows attackers to forge log entries, hide their tracks, or inject malicious content.
+
+**Incorrect (unsanitized logging):**
+
+```typescript
+// Log injection vulnerability
+const username = req.body.username;
+logger.info(`User logged in: ${username}`);
+// Attacker: "admin\n[ERROR] Payment failed for user: victim"
+```
+
+**Correct (sanitized structured logging):**
+
+```typescript
+// Use structured logging
+logger.info('User logged in', { 
+  username: sanitizeForLog(username),
+  ip: req.ip,
+  timestamp: new Date().toISOString()
+});
+
+// Sanitize log input
+function sanitizeForLog(input: string): string {
+  return input
+    .replace(/[\r\n\t]/g, ' ')  // Remove control chars
+    .replace(/[^\x20-\x7E]/g, '')  // ASCII only
+    .substring(0, 200);  // Limit length
+}
+
+// JSON structured logs (harder to forge)
+console.log(JSON.stringify({
+  level: 'info',
+  message: 'User action',
+  data: { username: sanitizeForLog(username) },
+  timestamp: new Date().toISOString()
+}));
+```
+
+**Tools:** SonarQube, Semgrep, Manual Review

package/skill-assets/sunlint-code-quality/rules/typescript/S057-synchronized-time.md

@@ -0,0 +1,57 @@
+---
+title: Use Synchronized Time (UTC) In Logs
+impact: MEDIUM
+impactDescription: enables accurate incident correlation
+tags: logging, time, utc, synchronization, security
+---
+
+## Use Synchronized Time (UTC) In Logs
+
+Inconsistent timestamps make incident investigation difficult. Use UTC and NTP-synchronized time.
+
+**Incorrect (local time, inconsistent format):**
+
+```typescript
+// Local timezone - inconsistent across servers
+logger.info(`Action at ${new Date()}`);
+
+// Different formats
+console.log(`[${Date.now()}] Event`);
+console.log(`[${new Date().toLocaleDateString()}] Event`);
+```
+
+**Correct (UTC, ISO 8601 format):**
+
+```typescript
+// Always use UTC with ISO 8601 format
+logger.info('User action', {
+  timestamp: new Date().toISOString(),  // 2024-01-15T10:30:00.000Z
+  userId: user.id,
+  action: 'login'
+});
+
+// Configure logger to use UTC
+const logger = createLogger({
+  format: combine(
+    timestamp({ format: 'YYYY-MM-DDTHH:mm:ss.SSSZ' }),
+    json()
+  )
+});
+
+// Structured log output
+{
+  "timestamp": "2024-01-15T10:30:00.000Z",
+  "level": "info",
+  "message": "User action",
+  "userId": "123",
+  "action": "login"
+}
+```
+
+**Requirements:**
+- Use UTC timezone
+- ISO 8601 format (YYYY-MM-DDTHH:mm:ss.SSSZ)
+- NTP-synchronized servers
+- Millisecond precision
+
+**Tools:** NTP, Log aggregators, Winston/Pino

package/skill-assets/sunlint-code-quality/rules/typescript/S058-ssrf-protection.md

@@ -0,0 +1,63 @@
+---
+title: Protect Against SSRF Attacks
+impact: MEDIUM
+impactDescription: prevents internal network access from user input
+tags: ssrf, url, network, internal, security
+---
+
+## Protect Against SSRF Attacks
+
+SSRF allows attackers to make requests from your server to internal services or cloud metadata endpoints.
+
+**Incorrect (accepting user URLs without validation):**
+
+```typescript
+app.get('/fetch', async (req, res) => {
+  const url = req.query.url;
+  const response = await fetch(url);  // Attacker controls URL!
+  res.send(await response.text());
+});
+// Attacker: ?url=http://169.254.169.254/latest/meta-data/
+```
+
+**Correct (URL validation and blocking):**
+
+```typescript
+import { URL } from 'url';
+import ipRangeCheck from 'ip-range-check';
+
+const BLOCKED_IPS = [
+  '127.0.0.0/8',      // Localhost
+  '10.0.0.0/8',       // Private
+  '172.16.0.0/12',    // Private
+  '192.168.0.0/16',   // Private
+  '169.254.0.0/16',   // Link-local (AWS metadata!)
+];
+
+const ALLOWED_HOSTS = ['api.example.com', 'cdn.example.com'];
+
+async function safeFetch(userUrl: string): Promise<Response> {
+  const parsed = new URL(userUrl);
+  
+  // Protocol whitelist
+  if (!['http:', 'https:'].includes(parsed.protocol)) {
+    throw new Error('Protocol not allowed');
+  }
+  
+  // Host whitelist (preferred)
+  if (!ALLOWED_HOSTS.includes(parsed.hostname)) {
+    throw new Error('Host not allowed');
+  }
+  
+  // IP block list (if dynamic hosts needed)
+  const ip = await dns.resolve(parsed.hostname);
+  if (BLOCKED_IPS.some(range => ipRangeCheck(ip, range))) {
+    throw new Error('IP range not allowed');
+  }
+  
+  // No redirects
+  return fetch(userUrl, { redirect: 'error' });
+}
+```
+
+**Tools:** SonarQube, Manual Review, Burp Suite