@sun-asterisk/sunlint 1.3.39 → 1.3.41

package/skill-assets/sunlint-code-quality/rules/csharp/S051-password-length.md

@@ -0,0 +1,35 @@
+---
+title: Support 12-64 Character Passwords
+impact: MEDIUM
+impactDescription: enables secure passphrase usage
+tags: password, length, passphrase, security, csharp
+---
+
+## Support 12-64 Character Passwords
+
+Allow users to use long passphrases.
+
+**Configuration:**
+
+```csharp
+services.Configure<IdentityOptions>(options =>
+{
+    options.Password.RequiredLength = 12;
+    options.Password.RequireDigit = true;
+    options.Password.RequireLowercase = true;
+    options.Password.RequireNonAlphanumeric = true; 
+    options.Password.RequireUppercase = true; 
+});
+```
+
+**Validation:**
+
+```csharp
+public class RegisterModel
+{
+    [StringLength(100, MinimumLength = 12)]
+    public string Password { get; set; }
+}
+```
+
+**Tools:** ASP.NET Identity

package/skill-assets/sunlint-code-quality/rules/csharp/S052-otp-entropy.md

@@ -0,0 +1,26 @@
+---
+title: OTPs Must Have 20-bit Entropy Minimum
+impact: MEDIUM
+impactDescription: prevents OTP brute-forcing
+tags: otp, entropy, authentication, 2fa, security, csharp
+---
+
+## OTPs Must Have 20-bit Entropy Minimum
+
+Use CSPRNG for OTP generation.
+
+**Incorrect (Random):**
+
+```csharp
+var otp = new Random().Next(1000, 9999);
+```
+
+**Correct (CSPRNG):**
+
+```csharp
+// 6 digits
+int otp = RandomNumberGenerator.GetInt32(0, 1000000);
+string otpString = otp.ToString("D6");
+```
+
+**Tools:** Roslyn Analyzers

package/skill-assets/sunlint-code-quality/rules/csharp/S053-generic-error-messages.md

@@ -0,0 +1,32 @@
+---
+title: Return Generic Error Messages
+impact: HIGH
+impactDescription: prevents information disclosure
+tags: error-messages, information-disclosure, security, csharp
+---
+
+## Return Generic Error Messages
+
+Don't leak stack traces or internal details to users.
+
+**Incorrect (Dev Exception Page in Prod):**
+
+```csharp
+// Startup.cs
+app.UseDeveloperExceptionPage(); // Dangerous in Prod
+```
+
+**Correct (Generic Error Handler):**
+
+```csharp
+if (env.IsDevelopment())
+{
+    app.UseDeveloperExceptionPage();
+}
+else
+{
+    app.UseExceptionHandler("/Error");
+}
+```
+
+**Tools:** ASP.NET Core Middleware

package/skill-assets/sunlint-code-quality/rules/csharp/S054-no-default-admin.md

@@ -0,0 +1,31 @@
+---
+title: Avoid Default Admin/Root Accounts
+impact: HIGH
+impactDescription: prevents easy initial access by attackers
+tags: admin, default-accounts, credentials, security, csharp
+---
+
+## Avoid Default Admin/Root Accounts
+
+Do not seed default admin accounts with known passwords.
+
+**Incorrect:**
+
+```csharp
+// Seeding
+if (!users.Any())
+{
+    userManager.CreateAsync(new User("admin"), "Admin123!"); 
+}
+```
+
+**Correct:**
+
+```csharp
+// Require setup via UI or CLI, or use random password printed to logs on first startup
+var pwd = GenerateRandomPassword();
+logger.LogInformation("Generated Admin Password: {Pwd}", pwd);
+userManager.CreateAsync(new User("admin"), pwd);
+```
+
+**Tools:** Manual Review

package/skill-assets/sunlint-code-quality/rules/csharp/S055-content-type-validation.md

@@ -0,0 +1,44 @@
+---
+title: Validate Content-Type In REST Services
+impact: MEDIUM
+impactDescription: prevents content-type confusion attacks
+tags: rest, content-type, validation, api, security, csharp
+---
+
+## Validate Content-Type In REST Services
+
+Ensure your API only accepts expected content types to avoid parsing vulnerabilities.
+
+**Incorrect (accepting anything):**
+
+```csharp
+[HttpPost]
+public IActionResult Upload(IFormFile file) 
+{
+    // No check on Content-Type or file signature
+}
+```
+
+**Correct (strict validation):**
+
+```csharp
+[HttpPost]
+[Consumes("application/json")] // Force valid Content-Type
+public IActionResult UpdateData([FromBody] DataModel model)
+{
+    return Ok();
+}
+
+// Manual check for files
+public IActionResult Upload(IFormFile file)
+{
+    if (file.ContentType != "image/png" && file.ContentType != "image/jpeg")
+    {
+        return BadRequest("Invalid Content-Type");
+    }
+    // Also validate file signature/magic numbers!
+    return Ok();
+}
+```
+
+**Tools:** Roslyn Analyzers, SonarQube

package/skill-assets/sunlint-code-quality/rules/csharp/S056-log-injection.md

@@ -0,0 +1,33 @@
+---
+title: Protect Against Log Injection
+impact: HIGH
+impactDescription: prevents log forging and exploitation
+tags: logging, injection, sanitization, security, csharp
+---
+
+## Protect Against Log Injection
+
+Attackers can inject newlines to forge log entries or confuse monitoring systems.
+
+**Incorrect (raw logging):**
+
+```csharp
+_logger.LogInformation("User logged in: " + username); 
+// Attacker: "admin\n[ERROR] System failure"
+```
+
+**Correct (structured logging or sanitization):**
+
+```csharp
+// Structured Logging (Serilog/MEL) - Safe by default as it treats data as properties
+_logger.LogInformation("User logged in: {Username}", username);
+
+// If using simple text logging, sanitize
+string SanitizeLog(string input)
+{
+    return input.Replace("\n", "_").Replace("\r", "_");
+}
+_logger.LogInformation($"User logged in: {SanitizeLog(username)}");
+```
+
+**Tools:** Serilog, Roslyn Analyzers, SonarQube

package/skill-assets/sunlint-code-quality/rules/csharp/S057-synchronized-time.md

@@ -0,0 +1,27 @@
+---
+title: Use Synchronized Time (UTC) In Logs
+impact: MEDIUM
+impactDescription: enables accurate incident correlation
+tags: logging, time, utc, synchronization, security, csharp
+---
+
+## Use Synchronized Time (UTC) In Logs
+
+Always use UTC time for logs and database records.
+
+**Incorrect (local time):**
+
+```csharp
+_logger.LogInformation("Action at {Time}", DateTime.Now); // Depends on server timezone
+```
+
+**Correct (UTC):**
+
+```csharp
+_logger.LogInformation("Action at {Time}", DateTime.UtcNow); 
+
+// Configure Serilog to output UTC
+// .WriteTo.Console(outputTemplate: "{Timestamp:u} ...")
+```
+
+**Tools:** Roslyn Analyzers, SonarQube

package/skill-assets/sunlint-code-quality/rules/csharp/S058-ssrf-protection.md

@@ -0,0 +1,54 @@
+---
+title: Protect Against SSRF Attacks
+impact: MEDIUM
+impactDescription: prevents internal network access from user input
+tags: ssrf, url, network, internal, security, csharp
+---
+
+## Protect Against SSRF Attacks
+
+Server-Side Request Forgery occurs when the server fetches a URL provided by the attacker.
+
+**Incorrect (fetching user URL):**
+
+```csharp
+public async Task<string> FetchUrl(string url)
+{
+    using var client = new HttpClient();
+    return await client.GetStringAsync(url); // Attacker can access internal metadata/localhost
+}
+```
+
+**Correct (validation):**
+
+```csharp
+public async Task<string> SafeFetchUrl(string inputUrl)
+{
+    if (!Uri.TryCreate(inputUrl, UriKind.Absolute, out var uri))
+        throw new ArgumentException("Invalid URL");
+
+    if (uri.Scheme != "http" && uri.Scheme != "https")
+        throw new ArgumentException("Invalid Scheme");
+
+    // Block non-standard ports
+    if (!uri.IsDefaultPort) throw new ArgumentException("Port not allowed");
+
+    // Resolve IP and check blocklist (simplified)
+    var ipAddresses = await Dns.GetHostAddressesAsync(uri.DnsSafeHost);
+    foreach (var ip in ipAddresses)
+    {
+        if (IsPrivateIp(ip)) throw new Exception("SSRF Detected: Private IP");
+    }
+
+    using var client = new HttpClient();
+    return await client.GetStringAsync(uri);
+}
+
+private bool IsPrivateIp(IPAddress ip)
+{
+    // Check for 127.0.0.1, 10.x.x.x, 192.168.x.x, etc.
+    return IPAddress.IsLoopback(ip) || ip.ToString().StartsWith("10.") || ip.ToString().StartsWith("192.168.");
+}
+```
+
+**Tools:** Security Code Scan, SonarQube

package/skill-assets/sunlint-code-quality/rules/go/C006-verb-noun-functions.md

@@ -0,0 +1,45 @@
+---
+title: Function Names Verb-Noun
+impact: LOW
+impactDescription: makes code self-documenting
+tags: naming, functions, readability, conventions, quality
+---
+
+## Function Names Verb-Noun
+
+Functions do things. Action verbs make purpose clear.
+
+**Incorrect (vague names):**
+
+```go
+func user() { }           // Noun only
+func userData() { }       // Noun only
+func doSomething() { }    // Vague
+func handleStuff() { }    // Vague
+func manager() { }        // Noun only
+```
+
+**Correct (action verbs):**
+
+```go
+func GetUser() { }
+func CreateUserAccount() { }
+func ValidateEmailFormat() { }
+func CalculateTotalPrice() { }
+func SendConfirmationEmail() { }
+func ConvertCurrencyToUSD() { }
+```
+
+**Verb categories:**
+
+| Category | Verbs |
+|----------|-------|
+| Retrieval | `Get`, `Fetch`, `Find`, `Load`, `Query` |
+| Creation | `Create`, `Build`, `Make`, `Generate` |
+| Modification | `Set`, `Update`, `Modify`, `Change` |
+| Deletion | `Delete`, `Remove`, `Destroy`, `Clear` |
+| Validation | `Validate`, `Verify`, `Check`, `Ensure` |
+| Computation | `Calculate`, `Compute`, `Parse`, `Format` |
+| Boolean | `Is`, `Has`, `Can`, `Should`, `Will` |
+
+**Tools:** PR review, GolangCI-Lint

package/skill-assets/sunlint-code-quality/rules/go/C013-no-dead-code.md

@@ -0,0 +1,48 @@
+---
+title: Do Not Use Dead Code
+impact: LOW
+impactDescription: reduces codebase noise and maintenance burden
+tags: dead-code, cleanup, maintenance, quality
+---
+
+## Do Not Use Dead Code
+
+Dead code confuses readers and increases cognitive load. Git history preserves deleted code.
+
+**Incorrect (keeping dead code):**
+
+```go
+func ProcessOrder(order *Order) float64 {
+	// Old implementation - keeping for reference
+	// total := 0.0
+	// for _, item := range order.Items {
+	// 	total += item.Price * float64(item.Quantity)
+	// }
+	// return total
+
+	total := calculateTotal(order)
+	return total
+}
+
+// Unused function - someone might need it later
+func legacyCalculation() { }
+```
+
+**Correct (clean code):**
+
+```go
+func ProcessOrder(order *Order) float64 {
+	return calculateTotal(order)
+}
+
+// Delete unused functions - git history preserves them
+// Delete commented code - git history preserves it
+```
+
+**Types of dead code:**
+- Commented-out code
+- Unused functions/structs/methods
+- Unreachable code
+- Unused variables (Go compiler will error on these locally, but they may exist in long-lived branches)
+
+**Tools:** gofmt, govet, staticcheck, GolangCI-Lint

package/skill-assets/sunlint-code-quality/rules/go/C014-dependency-injection.md

@@ -0,0 +1,85 @@
+---
+title: Use Dependency Injection
+impact: HIGH
+impactDescription: enables testability and loose coupling
+tags: dependency-injection, testing, coupling, architecture, quality
+---
+
+## Use Dependency Injection
+
+Direct instantiation creates tight coupling, making testing difficult and changes risky. DI enables mockability, replaceability, and testability.
+
+**Incorrect (hardcoded dependencies):**
+
+```go
+type OrderService struct {
+	db     *PostgresDatabase
+	mailer *SendGridMailer
+}
+
+func NewOrderService() *OrderService {
+	return &OrderService{
+		db:     NewPostgresDatabase(), // Hardcoded dependency
+		mailer: NewSendGridMailer(),   // Hardcoded dependency
+	}
+}
+
+func (s *OrderService) CreateOrder(data OrderData) error {
+	order, err := s.db.Insert("orders", data)
+	if err != nil {
+		return err
+	}
+	return s.mailer.Send(data.Email, "Order created")
+}
+```
+
+**Correct (injected dependencies via interfaces):**
+
+```go
+type Database interface {
+	Insert(table string, data any) (any, error)
+}
+
+type Mailer interface {
+	Send(to string, message string) error
+}
+
+type OrderService struct {
+	db     Database
+	mailer Mailer
+}
+
+func NewOrderService(db Database, mailer Mailer) *OrderService {
+	return &OrderService{
+		db:     db,
+		mailer: mailer,
+	}
+}
+
+func (s *OrderService) CreateOrder(data OrderData) error {
+	order, err := s.db.Insert("orders", data)
+	if err != nil {
+		return err
+	}
+	return s.mailer.Send(data.Email, "Order created")
+}
+
+// Usage
+service := NewOrderService(
+	NewPostgresDatabase(connString),
+	NewSendGridMailer(apiKey),
+)
+
+// Testing
+mockDb := new(MockDatabase)
+mockMailer := new(MockMailer)
+testService := NewOrderService(mockDb, mockMailer)
+```
+
+**Benefits:**
+- Easy mocking for unit tests
+- Swappable implementations
+- Clear dependencies visible in constructor/factory
+- Supports interface-based design (accept interfaces, return structs)
+
+**Tools:** GolangCI-Lint, Manual review

package/skill-assets/sunlint-code-quality/rules/go/C017-no-constructor-logic.md

@@ -0,0 +1,67 @@
+---
+title: No Business Logic In Factory Functions
+impact: HIGH
+impactDescription: ensures predictable object initialization
+tags: factory, initialization, side-effects, patterns, quality
+---
+
+## No Business Logic In Factory Functions
+
+Factory functions (e.g., `NewService`) should only initialize state. Side effects in factory functions are unexpected and make testing difficult.
+
+**Incorrect (logic in factory function):**
+
+```go
+type UserService struct {
+	config Config
+}
+
+func NewUserService(configPath string) (*UserService, error) {
+	// BAD: Reading files in factory function
+	rawConfig, err := os.ReadFile(configPath)
+	if err != nil {
+		return nil, err
+	}
+	var config Config
+	json.Unmarshal(rawConfig, &config)
+	
+	// BAD: Network calls/API initialization here
+	resp, _ := http.Get("https://api.example.com/init")
+	
+	// BAD: Logging/side effects
+	log.Println("UserService initialized")
+	
+	return &UserService{config: config}, nil
+}
+```
+
+**Correct (clear separation):**
+
+```go
+type UserService struct {
+	config     Config
+	httpClient *http.Client
+}
+
+func NewUserService(config Config, httpClient *http.Client) *UserService {
+	// Only assignment - no side effects
+	return &UserService{
+		config:     config,
+		httpClient: httpClient,
+	}
+}
+
+// Service initialization in main or a dedicated bootstrapper
+func InitializeApp() {
+	rawConfig, _ := os.ReadFile("./config.json")
+	var config Config
+	json.Unmarshal(rawConfig, &config)
+	
+	httpClient := &http.Client{Timeout: 10 * time.Second}
+	
+	service := NewUserService(config, httpClient)
+	log.Println("UserService ready")
+}
+```
+
+**Tools:** PR review, Manual review

package/skill-assets/sunlint-code-quality/rules/go/C018-generic-errors.md

@@ -0,0 +1,63 @@
+---
+title: Do Not Return Generic Errors
+impact: HIGH
+impactDescription: enables proper error handling and monitoring
+tags: error-handling, custom-errors, debugging, quality
+---
+
+## Do Not Return Generic Errors
+
+Generic errors (like `errors.New("error")`) lack context needed for debugging. They make it impossible to distinguish between error types for proper handling.
+
+**Incorrect (generic errors):**
+
+```go
+if user == nil {
+	return errors.New("error")
+}
+
+if !isValid {
+	return fmt.Errorf("invalid")
+}
+```
+
+**Correct (specific custom errors or sentinel errors):**
+
+```go
+// Sentinel errors for simple checks
+var ErrUserNotFound = errors.New("user not found")
+
+func (s *Service) GetUser(id string) (*User, error) {
+	if user == nil {
+		return nil, fmt.Errorf("%w: user with ID %s not found", ErrUserNotFound, id)
+	}
+	return user, nil
+}
+
+// Custom error types for complex context
+type ValidationError struct {
+	Field   string
+	Message string
+	Value   any
+}
+
+func (e *ValidationError) Error() string {
+	return fmt.Sprintf("validation failed on %s: %s", e.Field, e.Message)
+}
+
+if !isValid {
+	return &ValidationError{
+		Field:   "email",
+		Message: "invalid format",
+		Value:   email,
+	}
+}
+```
+
+Custom errors should include:
+- Descriptive message with context (use `%w` for wrapping)
+- Error codes or types for programmatic handling (using `errors.Is` or `errors.As`)
+- Relevant data for debugging
+- Appropriate mapping to status codes in the transport layer (e.g., HTTP 404)
+
+**Tools:** GolangCI-Lint (errname, goerr113), Manual review

package/skill-assets/sunlint-code-quality/rules/go/C019-error-log-level.md

@@ -0,0 +1,50 @@
+---
+title: Do Not Use Error Log For Non-critical
+impact: HIGH
+impactDescription: prevents alert fatigue and log noise
+tags: logging, log-levels, error, observability, quality
+---
+
+## Do Not Use Error Log For Non-critical
+
+Incorrect log levels cause alert fatigue and hide real issues. When everything is an "error", nothing is.
+
+**Incorrect (overusing error level):**
+
+```go
+// NOT an error - expected business case
+slog.Error("User entered wrong password")
+
+// NOT an error - validation failure
+slog.Error("Email format invalid")
+
+// NOT an error - temporary network issue
+slog.Error("Retry attempt 2 of 5")
+```
+
+**Correct (appropriate log levels using slog):**
+
+```go
+// WARN - recoverable, may need attention
+slog.Warn("Payment retry attempt", "attempt", 2, "max_attempts", 5)
+
+// INFO - normal business events
+slog.Info("Login failed - invalid password", "user_id", userID, "attempts", 3)
+
+// DEBUG - detailed troubleshooting
+slog.Debug("Validation failed", "field", "email", "value", maskedEmail)
+
+// ERROR - only for actual system failures
+slog.Error("Database connection lost", "host", dbHost, "error", err)
+```
+
+**Log Level Guide:**
+
+| Level | Use For |
+|-------|---------|
+| ERROR | System failures, crashes, unrecoverable |
+| WARN  | Potential issues, degraded performance |
+| INFO  | Business events, state changes |
+| DEBUG | Detailed troubleshooting |
+
+**Tools:** Log linter, Custom rule, `slog` (standard library)

package/skill-assets/sunlint-code-quality/rules/go/C020-no-unused-imports.md

@@ -0,0 +1,45 @@
+---
+title: No Unused Imports
+impact: LOW
+impactDescription: reduces codebase noise and compilation time
+tags: imports, cleanup, maintenance, quality
+---
+
+## No Unused Imports
+
+Unused imports increase binary size and slow down compilation. Go compiler strictly enforces this at compile time.
+
+**Incorrect (unused imports):**
+
+```go
+package main
+
+import (
+	"fmt"
+	"os"     // UNUSED
+	"time"   // UNUSED
+)
+
+func main() {
+	fmt.Println("Hello")
+}
+```
+
+**Correct (clean imports):**
+
+```go
+package main
+
+import (
+	"fmt"
+)
+
+func main() {
+	fmt.Println("Hello")
+}
+
+// Side-effect only imports use the blank identifier
+import _ "net/http/pprof"
+```
+
+**Tools:** `goimports`, `golines`, Go Compiler (enforced)