@sun-asterisk/sunlint 1.3.41 → 1.3.43

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sun-asterisk/sunlint",
-  "version": "1.3.41",
+  "version": "1.3.43",
   "description": "☀️ SunLint - Multi-language static analysis tool for code quality and security | Sun* Engineering Standards",
   "main": "cli.js",
   "bin": {

package/rules/security/S024_xpath_xxe_protection/typescript/regex-based-analyzer.js

@@ -211,7 +211,7 @@ class S024RegexBasedAnalyzer {
         }
 
         violations.push({
-          rule: this.ruleId,
+          ruleId: this.ruleId,
           source: filePath,
           category: this.category,
           line: lineNumber,
@@ -250,7 +250,7 @@ class S024RegexBasedAnalyzer {
         }
 
         violations.push({
-          rule: this.ruleId,
+          ruleId: this.ruleId,
           source: filePath,
           category: this.category,
           line: lineNumber,
@@ -281,7 +281,7 @@ class S024RegexBasedAnalyzer {
       }
 
       violations.push({
-        rule: this.ruleId,
+        ruleId: this.ruleId,
         source: filePath,
         category: this.category,
         line: lineNumber,
@@ -315,7 +315,7 @@ class S024RegexBasedAnalyzer {
       // Check if XXE protection is implemented in the context
       if (!this.hasXXEProtection(contextContent)) {
         violations.push({
-          rule: this.ruleId,
+          ruleId: this.ruleId,
           source: filePath,
           category: this.category,
           line: lineNumber,

package/rules/security/S024_xpath_xxe_protection/typescript/symbol-based-analyzer.js

@@ -451,7 +451,7 @@ class S024SymbolBasedAnalyzer {
       const lineAndChar = sourceFile.getLineAndColumnAtPos(start);
 
       return {
-        rule: this.ruleId,
+        ruleId: this.ruleId,
         source: sourceFile.getFilePath(),
         category: this.category,
         line: lineAndChar.line,

package/rules/security/S025_server_side_validation/typescript/regex-based-analyzer.js

@@ -192,7 +192,7 @@ class S025RegexBasedAnalyzer {
         if (!hasValidation) {
           const lineNumber = this.getLineNumber(content, match.index);
           violations.push({
-            rule: this.ruleId,
+            ruleId: this.ruleId,
             source: filePath,
             category: this.category,
             line: lineNumber,
@@ -222,7 +222,7 @@ class S025RegexBasedAnalyzer {
         if (!hasValidation) {
           const lineNumber = this.getLineNumber(content, match.index);
           violations.push({
-            rule: this.ruleId,
+            ruleId: this.ruleId,
             source: filePath,
             category: this.category,
             line: lineNumber,
@@ -254,7 +254,7 @@ class S025RegexBasedAnalyzer {
 
         const lineNumber = this.getLineNumber(content, match.index);
         violations.push({
-          rule: this.ruleId,
+          ruleId: this.ruleId,
           source: filePath,
           category: this.category,
           line: lineNumber,
@@ -291,7 +291,7 @@ class S025RegexBasedAnalyzer {
         if (!hasNearbyValidation && !hasSchemaValidation) {
           const lineNumber = this.getLineNumber(content, match.index);
           violations.push({
-            rule: this.ruleId,
+            ruleId: this.ruleId,
             source: filePath,
             category: this.category,
             line: lineNumber,
@@ -322,7 +322,7 @@ class S025RegexBasedAnalyzer {
       if (!hasFileValidation) {
         const lineNumber = this.getLineNumber(content, match.index);
         violations.push({
-          rule: this.ruleId,
+          ruleId: this.ruleId,
           source: filePath,
           category: this.category,
           line: lineNumber,

package/rules/security/S025_server_side_validation/typescript/symbol-based-analyzer.js

@@ -273,7 +273,7 @@ class S025SymbolBasedAnalyzer {
         while ((match = pattern.exec(content)) !== null) {
           const lineNumber = this.getLineNumber(content, match.index);
           violations.push({
-            rule: this.ruleId,
+            ruleId: this.ruleId,
             source: sourceFile.getFilePath(),
             category: this.category,
             line: lineNumber,
@@ -313,7 +313,7 @@ class S025SymbolBasedAnalyzer {
           while ((match = pattern.exec(content)) !== null) {
             const lineNumber = this.getLineNumber(content, match.index);
             violations.push({
-              rule: this.ruleId,
+              ruleId: this.ruleId,
               source: sourceFile.getFilePath(),
               category: this.category,
               line: lineNumber,
@@ -354,7 +354,7 @@ class S025SymbolBasedAnalyzer {
         while ((match = pattern.exec(content)) !== null) {
           const lineNumber = this.getLineNumber(content, match.index);
           violations.push({
-            rule: this.ruleId,
+            ruleId: this.ruleId,
             source: sourceFile.getFilePath(),
             category: this.category,
             line: lineNumber,
@@ -395,7 +395,7 @@ class S025SymbolBasedAnalyzer {
           if (uploadMatch) {
             const lineNumber = this.getLineNumber(content, uploadMatch.index);
             violations.push({
-              rule: this.ruleId,
+              ruleId: this.ruleId,
               source: sourceFile.getFilePath(),
               category: this.category,
               line: lineNumber,
@@ -444,7 +444,7 @@ class S025SymbolBasedAnalyzer {
           if (!hasValidation) {
             const lineNumber = this.getLineNumber(content, match.index);
             violations.push({
-              rule: this.ruleId,
+              ruleId: this.ruleId,
               source: sourceFile.getFilePath(),
               category: this.category,
               line: lineNumber,
@@ -495,7 +495,7 @@ class S025SymbolBasedAnalyzer {
       const lineAndChar = sourceFile.getLineAndColumnAtPos(start);
 
       return {
-        rule: this.ruleId,
+        ruleId: this.ruleId,
         source: sourceFile.getFilePath(),
         category: this.category,
         line: lineAndChar.line,

package/rules/security/S032_httponly_session_cookies/typescript/regex-based-analyzer.js

@@ -243,7 +243,7 @@ class S032RegexBasedAnalyzer {
             }
 
             violations.push({
-              rule: this.ruleId,
+              ruleId: this.ruleId,
               source: filePath,
               category: this.category,
               line: lineNumber,
@@ -299,7 +299,7 @@ class S032RegexBasedAnalyzer {
         }
 
         violations.push({
-          rule: this.ruleId,
+          ruleId: this.ruleId,
           source: filePath,
           category: this.category,
           line: lineNumber,
@@ -360,7 +360,7 @@ class S032RegexBasedAnalyzer {
               const lineNumber = this.getLineNumber(content, match.index);
 
               violations.push({
-                rule: this.ruleId,
+                ruleId: this.ruleId,
                 source: filePath,
                 category: this.category,
                 line: lineNumber,
@@ -450,7 +450,7 @@ class S032RegexBasedAnalyzer {
         const lineNumber = this.getLineNumber(content, match.index);
 
         violations.push({
-          rule: this.ruleId,
+          ruleId: this.ruleId,
           source: filePath,
           category: this.category,
           line: lineNumber,
@@ -465,7 +465,7 @@ class S032RegexBasedAnalyzer {
       const lineNumber = this.getLineNumber(content, match.index);
 
       violations.push({
-        rule: this.ruleId,
+        ruleId: this.ruleId,
         source: filePath,
         category: this.category,
         line: lineNumber,
@@ -606,7 +606,7 @@ class S032RegexBasedAnalyzer {
       if (!this.hasHttpOnlyInNextAuthConfig(cookieConfig)) {
         const lineNumber = this.getLineNumber(content, match.index);
         violations.push({
-          rule: this.ruleId,
+          ruleId: this.ruleId,
           source: filePath,
           category: this.category,
           line: lineNumber,
@@ -627,7 +627,7 @@ class S032RegexBasedAnalyzer {
       ) {
         const lineNumber = this.getLineNumber(content, match.index);
         violations.push({
-          rule: this.ruleId,
+          ruleId: this.ruleId,
           source: filePath,
           category: this.category,
           line: lineNumber,
@@ -646,7 +646,7 @@ class S032RegexBasedAnalyzer {
         const framework = this.detectFramework(matchText);
 
         violations.push({
-          rule: this.ruleId,
+          ruleId: this.ruleId,
           source: filePath,
           category: this.category,
           line: lineNumber,

package/rules/security/S033_samesite_session_cookies/typescript/regex-based-analyzer.js

@@ -188,7 +188,7 @@ class S033RegexBasedAnalyzer {
 
         const lineNumber = this.getLineNumber(content, match.index);
         violations.push({
-          rule: this.ruleId,
+          ruleId: this.ruleId,
           source: filePath,
           category: this.category,
           line: lineNumber,
@@ -247,7 +247,7 @@ class S033RegexBasedAnalyzer {
           ) {
             const lineNumber = this.getLineNumber(content, match.index);
             violations.push({
-              rule: this.ruleId,
+              ruleId: this.ruleId,
               source: filePath,
               category: this.category,
               line: lineNumber,
@@ -266,7 +266,7 @@ class S033RegexBasedAnalyzer {
         ) {
           const lineNumber = this.getLineNumber(content, match.index);
           violations.push({
-            rule: this.ruleId,
+            ruleId: this.ruleId,
             source: filePath,
             category: this.category,
             line: lineNumber,
@@ -310,7 +310,7 @@ class S033RegexBasedAnalyzer {
         if (!this.hasSameSiteInText(cookieConfig)) {
           const lineNumber = this.getLineNumber(content, match.index);
           violations.push({
-            rule: this.ruleId,
+            ruleId: this.ruleId,
             source: filePath,
             category: this.category,
             line: lineNumber,
@@ -323,7 +323,7 @@ class S033RegexBasedAnalyzer {
         // No cookie config at all
         const lineNumber = this.getLineNumber(content, match.index);
         violations.push({
-          rule: this.ruleId,
+          ruleId: this.ruleId,
           source: filePath,
           category: this.category,
           line: lineNumber,
@@ -432,7 +432,7 @@ class S033RegexBasedAnalyzer {
       if (!configObject || !this.hasSameSiteInText(configObject)) {
         const lineNumber = this.getLineNumber(content, match.index);
         violations.push({
-          rule: this.ruleId,
+          ruleId: this.ruleId,
           source: filePath,
           category: this.category,
           line: lineNumber,
@@ -471,7 +471,7 @@ class S033RegexBasedAnalyzer {
       if (!configObject || !this.hasSameSiteInText(configObject)) {
         const lineNumber = this.getLineNumber(content, match.index);
         violations.push({
-          rule: this.ruleId,
+          ruleId: this.ruleId,
           source: filePath,
           category: this.category,
           line: lineNumber,
@@ -510,7 +510,7 @@ class S033RegexBasedAnalyzer {
       if (!configObject || !this.hasSameSiteInText(configObject)) {
         const lineNumber = this.getLineNumber(content, match.index);
         violations.push({
-          rule: this.ruleId,
+          ruleId: this.ruleId,
           source: filePath,
           category: this.category,
           line: lineNumber,
@@ -556,7 +556,7 @@ class S033RegexBasedAnalyzer {
       if (!configObject || !this.hasSameSiteInText(configObject)) {
         const lineNumber = this.getLineNumber(content, match.index);
         violations.push({
-          rule: this.ruleId,
+          ruleId: this.ruleId,
           source: filePath,
           category: this.category,
           line: lineNumber,
@@ -602,7 +602,7 @@ class S033RegexBasedAnalyzer {
       if (!configObject || !this.hasSameSiteInText(configObject)) {
         const lineNumber = this.getLineNumber(content, match.index);
         violations.push({
-          rule: this.ruleId,
+          ruleId: this.ruleId,
           source: filePath,
           category: this.category,
           line: lineNumber,
@@ -642,7 +642,7 @@ class S033RegexBasedAnalyzer {
       if (!this.hasSameSiteInText(cookieOptions)) {
         const lineNumber = this.getLineNumber(content, match.index);
         violations.push({
-          rule: this.ruleId,
+          ruleId: this.ruleId,
           source: filePath,
           category: this.category,
           line: lineNumber,
@@ -674,7 +674,7 @@ class S033RegexBasedAnalyzer {
       if (!this.hasSameSiteInText(cookieOptions)) {
         const lineNumber = this.getLineNumber(content, match.index);
         violations.push({
-          rule: this.ruleId,
+          ruleId: this.ruleId,
           source: filePath,
           category: this.category,
           line: lineNumber,

package/rules/security/S033_samesite_session_cookies/typescript/symbol-based-analyzer.js

@@ -592,7 +592,7 @@ class S033SymbolBasedAnalyzer {
       const lineAndChar = sourceFile.getLineAndColumnAtPos(start);
 
       return {
-        rule: this.ruleId,
+        ruleId: this.ruleId,
         source: sourceFile.getFilePath(),
         category: this.category,
         line: lineAndChar.line,

package/rules/security/S034_host_prefix_session_cookies/typescript/regex-based-analyzer.js

@@ -460,7 +460,7 @@ class S034RegexBasedAnalyzer {
     }
 
     this.violations.push({
-      rule: this.ruleId,
+      ruleId: this.ruleId,
       source: filePath,
       category: this.category,
       line: line,

package/rules/security/S041_session_token_invalidation/typescript/regex-based-analyzer.js

@@ -185,7 +185,7 @@ class S041RegexBasedAnalyzer {
         
         if (!hasSessionCleanup) {
           violations.push({
-            rule: this.ruleId,
+            ruleId: this.ruleId,
             source: filePath,
             category: this.category,
             line: lineNumber,
@@ -218,7 +218,7 @@ class S041RegexBasedAnalyzer {
         
         if (!hasSessionCleanup) {
           violations.push({
-            rule: this.ruleId,
+            ruleId: this.ruleId,
             source: filePath,
             category: this.category,
             line: lineNumber,
@@ -249,7 +249,7 @@ class S041RegexBasedAnalyzer {
         
         if (isInLogoutContext) {
           violations.push({
-            rule: this.ruleId,
+            ruleId: this.ruleId,
             source: filePath,
             category: this.category,
             line: lineNumber,
@@ -299,7 +299,7 @@ class S041RegexBasedAnalyzer {
         // Only report if it's in logout context and missing token invalidation
         if (isInLogoutContext && !hasTokenInvalidation) {
           violations.push({
-            rule: this.ruleId,
+            ruleId: this.ruleId,
             source: filePath,
             category: this.category,
             line: lineNumber,

package/rules/security/S041_session_token_invalidation/typescript/symbol-based-analyzer.js

@@ -666,7 +666,7 @@ class S041SymbolBasedAnalyzer {
       const lineAndChar = sourceFile.getLineAndColumnAtPos(start);
 
       return {
-        rule: this.ruleId,
+        ruleId: this.ruleId,
         source: sourceFile.getFilePath(),
         category: this.category,
         line: lineAndChar.line,

package/rules/security/S044_re_authentication_required/typescript/regex-based-analyzer.js

@@ -308,7 +308,7 @@ class S044RegexBasedAnalyzer {
 
   createViolation(filePath, line, column, message) {
     return {
-      rule: this.ruleId,
+      ruleId: this.ruleId,
       source: filePath,
       category: this.category,
       line: line,

package/rules/security/S044_re_authentication_required/typescript/symbol-based-analyzer.js

@@ -514,7 +514,7 @@ class S044SymbolBasedAnalyzer {
       const lineAndChar = sourceFile.getLineAndColumnAtPos(start);
 
       return {
-        rule: this.ruleId,
+        ruleId: this.ruleId,
         source: sourceFile.getFilePath(),
         category: this.category,
         line: lineAndChar.line,

package/rules/security/S045_brute_force_protection/typescript/analyzer.js

@@ -283,7 +283,7 @@ class S045Analyzer {
             // Always flag violations if no protection is found
             if (!hasProtection) {
               violations.push({
-                rule: this.ruleId,
+                ruleId: this.ruleId,
                 source: filePath,
                 category: "security",
                 line: lineNumber,

package/rules/security/S045_brute_force_protection/typescript/symbol-based-analyzer.js

@@ -623,7 +623,7 @@ class S045SymbolBasedAnalyzer {
       const lineAndChar = sourceFile.getLineAndColumnAtPos(start);
 
       return {
-        rule: this.ruleId,
+        ruleId: this.ruleId,
         source: sourceFile.getFilePath(),
         category: this.category,
         line: lineAndChar.line,

package/skill-assets/sunlint-code-quality/rules/dart/D001-recommended-lints.md

@@ -0,0 +1,36 @@
+---
+title: Recommended Lint Rules Should Be Enabled
+impact: MEDIUM
+impactDescription: Ensure code quality through standard lint configurations
+tags: lint, quality, static-analysis
+---
+
+## Recommended Lint Rules Should Be Enabled
+
+The `analysis_options.yaml` file should include recommended lint packages (flutter_lints, very_good_analysis, or lints) and critical lint rules should not be disabled. This ensures consistent code quality standards across the project.
+
+**Incorrect (minimal components):**
+
+```yaml
+analyzer:
+  exclude:
+    - build/**
+```
+
+**Correct (recommended setup):**
+
+```yaml
+include: package:flutter_lints/flutter.yaml
+
+analyzer:
+  exclude:
+    - "**/*.g.dart"
+    - "**/*.freezed.dart"
+
+linter:
+  rules:
+    - avoid_print
+    - prefer_const_constructors
+```
+
+**Tools:** Custom analyzer (D001)

package/skill-assets/sunlint-code-quality/rules/dart/D002-dispose-resources.md

@@ -0,0 +1,44 @@
+---
+title: Always Dispose Resources and Remove Listeners
+impact: HIGH
+impactDescription: Prevent memory leaks by ensuring proper resource disposal
+tags: memory-leak, resources, disposal, lifecycle, performance
+---
+
+## Always Dispose Resources and Remove Listeners
+
+All disposable resources (Controllers, StreamSubscriptions, FocusNodes, Listeners) must be properly disposed in the `dispose()` method. This includes TextEditingController, AnimationController, ScrollController, StreamSubscription, FocusNode, and other resources that implement Disposable. Failing to dispose these resources leads to memory leaks.
+
+**Incorrect (not disposed):**
+
+```dart
+class _MyWidgetState extends State<MyWidget> {
+  final _controller = TextEditingController();
+
+  @override
+  Widget build(BuildContext context) {
+    return TextField(controller: _controller);
+  }
+}
+```
+
+**Correct (properly disposed):**
+
+```dart
+class _MyWidgetState extends State<MyWidget> {
+  final _controller = TextEditingController();
+
+  @override
+  void dispose() {
+    _controller.dispose();
+    super.dispose();
+  }
+
+  @override
+  Widget build(BuildContext context) {
+    return TextField(controller: _controller);
+  }
+}
+```
+
+**Tools:** Custom analyzer (D002)

package/skill-assets/sunlint-code-quality/rules/dart/D003-prefer-widget-classes.md

@@ -0,0 +1,53 @@
+---
+title: Prefer Widgets Over Methods Returning Widgets
+impact: LOW
+impactDescription: Improve performance and maintainability by extracting widget-returning methods into widget classes
+tags: performance, maintainability, widgets, extraction
+---
+
+## Prefer Widgets Over Methods Returning Widgets
+
+Methods that return widgets should be extracted into separate StatelessWidget or StatefulWidget classes. This improves performance as Flutter can optimize widget rebuilds, makes code more reusable, and follows Flutter best practices. Only the build() method and lifecycle methods are exempt from this rule.
+
+**Incorrect (method returning widget):**
+
+```dart
+Widget _buildHeader() {
+  return Text("Title", style: TextStyle(fontSize: 24));
+}
+
+@override
+Widget build(BuildContext context) {
+  return Column(
+    children: [
+      _buildHeader(),
+      Text("Content"),
+    ],
+  );
+}
+```
+
+**Correct (extracted widget class):**
+
+```dart
+class HeaderWidget extends StatelessWidget {
+  const HeaderWidget({super.key});
+
+  @override
+  Widget build(BuildContext context) {
+    return Text("Title", style: TextStyle(fontSize: 24));
+  }
+}
+
+@override
+Widget build(BuildContext context) {
+  return Column(
+    children: [
+      const HeaderWidget(),
+      Text("Content"),
+    ],
+  );
+}
+```
+
+**Tools:** Custom analyzer (D003)

package/skill-assets/sunlint-code-quality/rules/dart/D004-avoid-shrinkwrap.md

@@ -0,0 +1,31 @@
+---
+title: Avoid shrinkWrap in ListView
+impact: LOW
+impactDescription: Prevent performance issues caused by shrinkWrap in scrollable widgets
+tags: performance, scroll, listview, lazy-loading
+---
+
+## Avoid shrinkWrap in ListView
+
+Using `shrinkWrap: true` in ListView or GridView disables lazy loading and forces all items to render at once, causing severe performance degradation. Instead, use Expanded or Flexible widgets to constrain the ListView size, or use SliverList within a CustomScrollView for better performance. The shrinkWrap parameter should only be used in rare cases where the list is guaranteed to be small.
+
+**Incorrect (using shrinkWrap):**
+
+```dart
+ListView(
+  shrinkWrap: true,
+  children: [ ... ],
+)
+```
+
+**Correct (using Expanded):**
+
+```dart
+Expanded(
+  child: ListView(
+    children: [ ... ],
+  ),
+)
+```
+
+**Tools:** Custom analyzer (D004)

package/skill-assets/sunlint-code-quality/rules/dart/D005-widget-nesting.md

@@ -0,0 +1,62 @@
+---
+title: Limit Widget Nesting Depth to 6
+impact: LOW
+impactDescription: Maintain code readability and prevent performance issues caused by deeply nested widgets
+tags: readability, maintainability, performance, nesting
+---
+
+## Limit Widget Nesting Depth to 6
+
+Widget nesting should not exceed 6 levels in the build method. Deeply nested widgets make code harder to understand, maintain, and can impact performance. When nesting exceeds this limit, extract nested widgets into separate StatelessWidget or StatefulWidget classes.
+
+**Incorrect (deeply nested):**
+
+```dart
+@override
+Widget build(BuildContext context) {
+  return Scaffold(
+    body: Center(
+      child: Container(
+        padding: const EdgeInsets.all(16),
+        child: Column(
+          children: [
+            Padding(
+              padding: const EdgeInsets.only(bottom: 8),
+              child: Row(
+                children: [
+                  Expanded(
+                    child: Card(
+                      child: Padding(
+                        padding: const EdgeInsets.all(12),
+                        child: Text("Too deep!"), // Level 11
+                      ),
+                    ),
+                  ),
+                ],
+              ),
+            ),
+          ],
+        ),
+      ),
+    ),
+  );
+}
+```
+
+**Correct (extracted widget):**
+
+```dart
+@override
+Widget build(BuildContext context) {
+  return Scaffold(
+    body: Center(
+      child: Container(
+        padding: const EdgeInsets.all(16),
+        child: const MyCustomHeader(), // Extracted at level 4
+      ),
+    ),
+  );
+}
+```
+
+**Tools:** Custom analyzer (D005)