@sun-asterisk/sunlint 1.3.40 → 1.3.42

package/skill-assets/sunlint-code-quality/rules/go/S052-otp-entropy.md

@@ -0,0 +1,48 @@
+---
+title: OTPs Must Have 20-bit Entropy Minimum
+impact: MEDIUM
+impactDescription: prevents OTP brute-forcing
+tags: otp, entropy, authentication, 2fa, security
+---
+
+## OTPs Must Have 20-bit Entropy Minimum
+
+Low-entropy OTPs (like 4 digits) can be brute-forced easily. 20 bits of entropy requires at least 6 decimal digits.
+
+**Incorrect (low entropy OTPs):**
+
+```go
+// 4 digits = ~13 bits entropy
+otp := fmt.Sprintf("%04d", rand.Intn(10000))
+```
+
+**Correct (high entropy OTPs via crypto/rand):**
+
+```go
+import (
+    "crypto/rand"
+    "math/big"
+)
+
+// 6-digit numeric OTP (≈20 bits entropy)
+func GenerateOTP() string {
+    max := big.NewInt(1000000)
+    n, _ := rand.Int(rand.Reader, max)
+    return fmt.Sprintf("%06d", n)
+}
+
+// 8-digit for higher security (≈26 bits)
+func GenerateStrongOTP() string {
+    max := big.NewInt(100000000)
+    n, _ := rand.Int(rand.Reader, max)
+    return fmt.Sprintf("%08d", n)
+}
+```
+
+**OTP requirements:**
+- Must use `crypto/rand` (CSPRNG).
+- Minimum 6 digits (20 bits).
+- Short expiration (5-10 minutes).
+- Rate limit verification attempts.
+
+**Tools:** Manual Review, Unit Test

package/skill-assets/sunlint-code-quality/rules/go/S053-generic-error-messages.md

@@ -0,0 +1,51 @@
+---
+title: Return Generic Error Messages
+impact: HIGH
+impactDescription: prevents information disclosure
+tags: error-messages, information-disclosure, security
+---
+
+## Return Generic Error Messages
+
+Detailed error messages can help attackers understand your system's internals. Return generic messages to end-users.
+
+**Incorrect (detailed errors to user):**
+
+```go
+func Handler(w http.ResponseWriter, r *http.Request) {
+    err := db.QueryRow("...").Scan(&id)
+    if err != nil {
+        // Exposes database details!
+        http.Error(w, err.Error(), 500)
+        return
+    }
+}
+
+// User enumeration
+if userNotFound {
+    http.Error(w, "User john@example.com dose not exist", 404)
+}
+```
+
+**Correct (generic errors with internal logging):**
+
+```go
+func Handler(w http.ResponseWriter, r *http.Request) {
+    err := db.QueryRow("...").Scan(&id)
+    if err != nil {
+        // Log internally
+        slog.Error("query failed", "error", err, "request_id", r.Header.Get("X-Request-Id"))
+        
+        // Return generic message
+        http.Error(w, "An internal error occurred", 500)
+        return
+    }
+}
+
+// Same message for "user not found" and "wrong password"
+if !userExists || !passwordMatches {
+    http.Error(w, "Invalid credentials", 401)
+}
+```
+
+**Tools:** Global Error Middleware, `slog`

package/skill-assets/sunlint-code-quality/rules/go/S054-no-default-admin.md

@@ -0,0 +1,43 @@
+---
+title: Avoid Default Admin/Root Accounts
+impact: HIGH
+impactDescription: prevents easy initial access by attackers
+tags: admin, default-accounts, credentials, security
+---
+
+## Avoid Default Admin/Root Accounts
+
+Default accounts with known credentials (e.g., admin/admin) are the first thing attackers check.
+
+**Incorrect (default admin in seed):**
+
+```go
+// Seed script
+db.Exec("INSERT INTO users (email, password, role) VALUES ('admin@example.com', 'admin123', 'admin')")
+```
+
+**Correct (secure initial setup):**
+
+```go
+// 1. Setup wizard on first run
+func SetupHandler(w http.ResponseWriter, r *http.Request) {
+    if adminExists() {
+        http.Error(w, "Setup already done", 403)
+        return
+    }
+    // Form to create first admin...
+}
+
+// 2. Or use environment variables for bootstrap
+func BootstrapAdmin() {
+    email := os.Getenv("INITIAL_ADMIN_EMAIL")
+    pass := os.Getenv("INITIAL_ADMIN_PASSWORD")
+    
+    if pass == "" || len(pass) < 16 {
+        log.Fatal("Secure INITIAL_ADMIN_PASSWORD required")
+    }
+    createAdmin(email, pass)
+}
+```
+
+**Tools:** Security Audit, Configuration Review

package/skill-assets/sunlint-code-quality/rules/go/S055-content-type-validation.md

@@ -0,0 +1,52 @@
+---
+title: Validate Content-Type In REST Services
+impact: MEDIUM
+impactDescription: prevents content-type confusion attacks
+tags: rest, content-type, validation, api, security
+---
+
+## Validate Content-Type In REST Services
+
+Accepting unexpected content types can lead to parsing vulnerabilities or bypass security controls.
+
+**Incorrect (accepting any content):**
+
+```go
+func Handler(w http.ResponseWriter, r *http.Request) {
+    // No check on Content-Type header
+    var data map[string]interface{}
+    json.NewDecoder(r.Body).Decode(&data)
+}
+```
+
+**Correct (strict content-type validation):**
+
+```go
+func validateContentType(allowed ...string) func(http.Handler) http.Handler {
+    return func(next http.Handler) http.Handler {
+        return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+            ct := r.Header.Get("Content-Type")
+            
+            isValid := false
+            for _, a := range allowed {
+                if strings.Contains(strings.ToLower(ct), strings.ToLower(a)) {
+                    isValid = true
+                    break
+                }
+            }
+            
+            if !isValid {
+                http.Error(w, "Unsupported Media Type", http.StatusUnsupportedMediaType)
+                return
+            }
+            
+            next.ServeHTTP(w, r)
+        })
+    }
+}
+
+// Router usage
+mux.Handle("/api/data", validateContentType("application/json")(http.HandlerFunc(Handler)))
+```
+
+**Tools:** API Gateway, Middleware, OWASP ZAP

package/skill-assets/sunlint-code-quality/rules/go/S056-log-injection.md

@@ -0,0 +1,40 @@
+---
+title: Protect Against Log Injection
+impact: HIGH
+impactDescription: prevents log forging and exploitation
+tags: logging, injection, sanitization, security
+---
+
+## Protect Against Log Injection
+
+Log injection allows attackers to forge log entries, hide their tracks, or inject malicious control characters.
+
+**Incorrect (unsanitized logging):**
+
+```go
+func Handler(w http.ResponseWriter, r *http.Request) {
+    user := r.FormValue("user")
+    slog.Info("User logged in: " + user)
+    // Attacker: "admin\n[ERROR] Payment failed for user: victim"
+}
+```
+
+**Correct (sanitized structured logging):**
+
+```go
+// 1. Use structured logging (automatically handles quotes/escaping in key-value pairs)
+slog.Info("User logged in", "username", sanitizeForLog(user))
+
+// 2. Sanitize input
+func sanitizeForLog(input string) string {
+    // Replace CRLF/tabs with space
+    replacer := strings.NewReplacer("\r", " ", "\n", " ", "\t", " ")
+    return replacer.Replace(input)
+}
+
+// 3. Recommended: Use JSON logger in production
+logger := slog.New(slog.NewJSONHandler(os.Stdout, nil))
+logger.Info("User logged in", "username", user)
+```
+
+**Tools:** `log/slog`, `zap`, `gosec`

package/skill-assets/sunlint-code-quality/rules/go/S057-synchronized-time.md

@@ -0,0 +1,40 @@
+---
+title: Use Synchronized Time (UTC) In Logs
+impact: MEDIUM
+impactDescription: enables accurate incident correlation
+tags: logging, time, utc, synchronization, security
+---
+
+## Use Synchronized Time (UTC) In Logs
+
+Inconsistent timestamps across servers/services make incident investigation difficult. Use UTC and ISO 8601 format.
+
+**Incorrect (local time/custom formats):**
+
+```go
+// Local time - depends on server TZ
+log.Printf("Event time: %v", time.Now())
+
+// Different formats
+fmt.Println(time.Now().Unix())
+fmt.Println(time.Now().Format("2006-01-02"))
+```
+
+**Correct (UTC, ISO 8601):**
+
+```go
+// Use .UTC() and .Format(time.RFC3339)
+slog.Info("User action", 
+    "timestamp", time.Now().UTC().Format(time.RFC3339Nano), 
+    "action", "login",
+)
+
+// Output: {"timestamp":"2024-01-15T10:30:00.123456Z", "level":"INFO", "message":"User action", "action":"login"}
+```
+
+**Requirements:**
+- Use UTC timezone externally.
+- Use ISO 8601 (RFC 3339) with nanosecond/millisecond precision.
+- Ensure servers are NTP-synchronized.
+
+**Tools:** `time` (Standard Library), `slog`, NTP

package/skill-assets/sunlint-code-quality/rules/go/S058-ssrf-protection.md

@@ -0,0 +1,70 @@
+---
+title: Protect Against SSRF Attacks
+impact: MEDIUM
+impactDescription: prevents internal network access from user input
+tags: ssrf, url, network, internal, security
+---
+
+## Protect Against SSRF Attacks
+
+SSRF allows attackers to make requests from your server to internal services, local files, or cloud metadata endpoints.
+
+**Incorrect (accepting user URLs without validation):**
+
+```go
+func Handler(w http.ResponseWriter, r *http.Request) {
+    url := r.URL.Query().Get("url")
+    resp, _ := http.Get(url) // Attacker controls URL!
+    io.Copy(w, resp.Body)
+}
+// Attacker: ?url=http://169.254.169.254/latest/meta-data/
+```
+
+**Correct (URL validation and IP blocking):**
+
+```go
+import (
+    "net"
+    "net/url"
+)
+
+var allowedHosts = []string{"api.example.com", "cdn.example.com"}
+
+func SafeFetch(userURL string) (*http.Response, error) {
+    parsed, err := url.Parse(userURL)
+    if err != nil {
+        return nil, err
+    }
+
+    // 1. Protocol whitelist
+    if parsed.Scheme != "http" && parsed.Scheme != "https" {
+        return nil, errors.New("protocol not allowed")
+    }
+
+    // 2. Host whitelist
+    isAllowed := false
+    for _, h := range allowedHosts {
+        if parsed.Hostname() == h {
+            isAllowed = true
+            break
+        }
+    }
+    
+    // 3. Resolve IP and block internal ranges
+    ips, _ := net.LookupIP(parsed.Hostname())
+    for _, ip := range ips {
+        if ip.IsLoopback() || ip.IsPrivate() || ip.IsUnspecified() {
+            return nil, errors.New("internal IP blocked")
+        }
+    }
+
+    client := &http.Client{
+        CheckRedirect: func(req *http.Request, via []*http.Request) error {
+            return http.ErrUseLastResponse // Disable redirects
+        },
+    }
+    return client.Get(userURL)
+}
+```
+
+**Tools:** `net/url`, `net.LookupIP`, `gosec` (G107)

package/skill-assets/sunlint-code-quality/rules/ruby/RB001-use-snake-case.md

@@ -0,0 +1,30 @@
+---
+title: Use snake_case for symbols, methods, and variables
+impact: MEDIUM
+impactDescription: Follow Ruby community naming conventions for consistency and readability.
+tags: ruby, naming, snake_case, convention
+---
+
+## Use snake_case for symbols, methods, and variables
+
+Follow Ruby community naming conventions for consistency and readability. Use `snake_case` (all lowercase with underscores) for symbols, methods, and variables. Avoid camelCase or other naming styles for these elements.
+
+**Incorrect:**
+
+```ruby
+def calculateTotal(price, taxRate)
+  totalAmount = price * taxRate
+  :orderStatus
+end
+```
+
+**Correct:**
+
+```ruby
+def calculate_total(price, tax_rate)
+  total_amount = price * tax_rate
+  :order_status
+end
+```
+
+**Tools:** RuboCop (`Naming/VariableName`, `Naming/MethodName`)

package/skill-assets/sunlint-code-quality/rules/ruby/RB002-use-camel-case.md

@@ -0,0 +1,38 @@
+---
+title: Use CamelCase for classes and modules
+impact: MEDIUM
+impactDescription: Follow Ruby community naming conventions for classes and modules.
+tags: ruby, naming, CamelCase, architecture
+---
+
+## Use CamelCase for classes and modules
+
+Use `CamelCase` (also known as PascalCase) for class and module names. Keep acronyms uppercase (e.g., `HTTPClient`, `XMLParser`).
+
+**Incorrect:**
+
+```ruby
+class User_profile
+end
+
+module Api_Helper
+end
+
+class HttpClient # Acronym 'HTTP' should be all caps
+end
+```
+
+**Correct:**
+
+```ruby
+class UserProfile
+end
+
+module ApiHelper
+end
+
+class HTTPClient
+end
+```
+
+**Tools:** RuboCop (`Naming/ClassName`)

package/skill-assets/sunlint-code-quality/rules/ruby/RB003-use-screaming-snake-case.md

@@ -0,0 +1,26 @@
+---
+title: Use SCREAMING_SNAKE_CASE for constants
+impact: LOW
+impactDescription: Clearly distinguish constants from other identifiers.
+tags: ruby, naming, constants, readability
+---
+
+## Use SCREAMING_SNAKE_CASE for constants
+
+Clearly distinguish constants from other identifiers. Use `SCREAMING_SNAKE_CASE` for constants that do not refer to classes or modules.
+
+**Incorrect:**
+
+```ruby
+DefaultTimeout = 30
+Max_Retry_Count = 5
+```
+
+**Correct:**
+
+```ruby
+DEFAULT_TIMEOUT = 30
+MAX_RETRY_COUNT = 5
+```
+
+**Tools:** RuboCop (`Naming/ConstantName`)

package/skill-assets/sunlint-code-quality/rules/ruby/RB004-predicate-methods.md

@@ -0,0 +1,36 @@
+---
+title: Predicate methods should end with ?
+impact: MEDIUM
+impactDescription: Make boolean-returning methods immediately recognizable.
+tags: ruby, naming, predicate, boolean
+---
+
+## Predicate methods should end with ?
+
+Make boolean-returning methods immediately recognizable. Methods that return boolean values should end with a question mark (`?`). Avoid prefixing with auxiliary verbs like `is_`, `does_`, or `can_`.
+
+**Incorrect:**
+
+```ruby
+def is_valid
+  # logic
+end
+
+if user.is_authenticated
+  # logic
+end
+```
+
+**Correct:**
+
+```ruby
+def valid?
+  # logic
+end
+
+if user.authenticated?
+  # logic
+end
+```
+
+**Tools:** RuboCop (`Naming/PredicateName`)

package/skill-assets/sunlint-code-quality/rules/ruby/RB005-dangerous-methods.md

@@ -0,0 +1,36 @@
+---
+title: Dangerous methods should end with !
+impact: MEDIUM
+impactDescription: Clearly indicate methods that modify the receiver or can raise exceptions.
+tags: ruby, naming, bang, side-effect
+---
+
+## Dangerous methods should end with !
+
+Clearly indicate methods that modify the receiver or can raise exceptions. Methods that modify the object in place or can raise exceptions should end with a bang (`!`).
+
+**Incorrect:**
+
+```ruby
+# Method raises an exception if validation fails
+def save
+  # complex logic
+end
+
+# In-place sort
+values.sort
+```
+
+**Correct:**
+
+```ruby
+# Recommends save! for raising exceptions
+def save!
+  # complex logic
+end
+
+# Indicates in-place sort
+values.sort!
+```
+
+**Tools:** RuboCop (`Style/BangPredicate`)

package/skill-assets/sunlint-code-quality/rules/ruby/RB006-indentation.md

@@ -0,0 +1,32 @@
+---
+title: Use 2 spaces for indentation
+impact: LOW
+impactDescription: Follow Ruby community standard for code formatting.
+tags: ruby, formatting, indentation, style
+---
+
+## Use 2 spaces for indentation
+
+Follow Ruby community standard for code formatting. Use 2 spaces for indentation, never tabs. Ensure consistent indentation throughout the codebase.
+
+**Incorrect:**
+
+```ruby
+def hello
+	puts "hello" # Tab used
+end
+
+def world
+    puts "world" # 4 spaces used
+end
+```
+
+**Correct:**
+
+```ruby
+def hello
+  puts "hello" # 2 spaces
+end
+```
+
+**Tools:** RuboCop (`Layout/IndentationWidth`)

package/skill-assets/sunlint-code-quality/rules/ruby/RB007-line-length.md

@@ -0,0 +1,25 @@
+---
+title: Keep lines under 120 characters
+impact: LOW
+impactDescription: Improve code readability and prevent horizontal scrolling.
+tags: ruby, formatting, readability, side-scrolling
+---
+
+## Keep lines under 120 characters
+
+Improve code readability and prevent horizontal scrolling. Limit line length to 120 characters maximum. Break long lines into multiple lines when necessary.
+
+**Incorrect:**
+
+```ruby
+puts "This is an extremely long string that definitely exceeds the recommended limit of one hundred and twenty characters that we have set for our coding standards in this project."
+```
+
+**Correct:**
+
+```ruby
+puts "This is an extremely long string that definitely exceeds " \
+     "the recommended limit of one hundred and twenty characters..."
+```
+
+**Tools:** RuboCop (`Layout/LineLength`)

package/skill-assets/sunlint-code-quality/rules/ruby/RB008-rescue-exception.md

@@ -0,0 +1,36 @@
+---
+title: Avoid rescuing the Exception class
+impact: HIGH
+impactDescription: Prevent hiding critical system errors.
+tags: ruby, errors, exception, safety
+---
+
+## Avoid rescuing the Exception class
+
+Prevent hiding critical system errors. Never rescue the generic `Exception` class as it catches system-level errors (like `SignalException`, `NoMemoryError`, `SystemExit`). Rescue specific exception classes or `StandardError` instead.
+
+**Incorrect (Dangerous):**
+
+```ruby
+begin
+  do_something
+rescue Exception => e
+  logger.error(e.message)
+end
+```
+
+**Correct (Safe):**
+
+```ruby
+begin
+  do_something
+rescue StandardError => e # Or just 'rescue => e' which defaults to StandardError
+  logger.error(e.message)
+end
+
+# Or specific
+rescue ActiveRecord::RecordNotFound => e
+  # handle
+```
+
+**Tools:** RuboCop (`Lint/RescueException`)

package/skill-assets/sunlint-code-quality/rules/ruby/RB009-save-bang.md

@@ -0,0 +1,41 @@
+---
+title: Use save! or handle return values
+impact: HIGH
+impactDescription: Ensure database operations are properly validated and errors are not silently ignored.
+tags: rails, database, validations, active-record
+---
+
+## Use save! or handle return values
+
+Ensure database operations are properly validated and errors are not silently ignored. Use bang methods (`save!`, `create!`, `update!`, `destroy!`) to raise exceptions on failure. If using non-bang methods, always check the return value.
+
+**Incorrect:**
+
+```ruby
+def create
+  @user = User.new(user_params)
+  @user.save # Failure will be silent
+  redirect_to @user
+end
+```
+
+**Correct:**
+
+```ruby
+def create
+  @user = User.new(user_params)
+  if @user.save
+    redirect_to @user
+  else
+    render :new
+  end
+end
+
+# Or using bang
+def create
+  @user = User.create!(user_params)
+  redirect_to @user
+end
+```
+
+**Tools:** RuboCop (`Rails/SaveBang`)

package/skill-assets/sunlint-code-quality/rules/ruby/RB010-avoid-n-plus-one.md

@@ -0,0 +1,32 @@
+---
+title: Avoid N+1 queries with eager loading
+impact: HIGH
+impactDescription: Prevent performance issues caused by N+1 query problems.
+tags: rails, performance, database, n+1, active-record
+---
+
+## Avoid N+1 queries with eager loading
+
+Prevent performance issues caused by N+1 query problems. Use `includes`, `preload`, or `eager_load` to load associations upfront. Avoid iterating over collections and accessing associations without eager loading.
+
+**Incorrect:**
+
+```ruby
+# Triggers N+1 queries (one query for users, and one query per user for posts)
+users = User.limit(10)
+users.each do |user|
+  puts user.posts.count
+end
+```
+
+**Correct:**
+
+```ruby
+# Eager loads posts in 2 queries total
+users = User.includes(:posts).limit(10)
+users.each do |user|
+  puts user.posts.count
+end
+```
+
+**Tools:** Bullet gem, RuboCop Rails (`Rails/FindEach`)