@sun-asterisk/sunlint 1.3.43 → 1.3.44

package/dart_analyzer/lib/rules/security/S005_trusted_service_authorization.dart

@@ -0,0 +1,182 @@
+import 'package:analyzer/dart/ast/ast.dart';
+import 'package:analyzer/dart/ast/visitor.dart';
+import 'package:analyzer/source/line_info.dart';
+
+import '../../models/rule.dart';
+import '../../models/violation.dart';
+import '../base_analyzer.dart';
+
+/// S005: Enforce authorization at trusted service layer
+/// Detect client-side authorization that can be bypassed
+class S005TrustedServiceAuthorizationAnalyzer extends BaseAnalyzer {
+  @override
+  String get ruleId => 'S005';
+
+  // Client-side authorization patterns (dangerous)
+  static const _clientSideAuthPatterns = [
+    'localstorage.getitem',
+    'sessionstorage.getitem',
+    'sharedpreferences',
+    'window.location',
+    'document.cookie',
+  ];
+
+  // Authorization keywords
+  static const _authKeywords = [
+    'isadmin',
+    'is_admin',
+    'hasrole',
+    'has_role',
+    'haspermission',
+    'has_permission',
+    'canaccess',
+    'can_access',
+    'isauthorized',
+    'is_authorized',
+    'checkpermission',
+    'check_permission',
+    'checkrole',
+    'check_role',
+  ];
+
+  // Server-side patterns (safe)
+  static const _serverSidePatterns = [
+    'middleware',
+    'interceptor',
+    'guard',
+    '@authorized',
+    '@authenticated',
+    'authservice',
+    'auth_service',
+    'api.',
+    'backend',
+    'server',
+  ];
+
+  @override
+  List<Violation> analyze({
+    required CompilationUnit unit,
+    required String filePath,
+    required Rule rule,
+    required LineInfo lineInfo,
+  }) {
+    final violations = <Violation>[];
+    final visitor = _S005Visitor(
+      filePath: filePath,
+      lineInfo: lineInfo,
+      violations: violations,
+      analyzer: this,
+    );
+    unit.accept(visitor);
+    return violations;
+  }
+}
+
+class _S005Visitor extends RecursiveAstVisitor<void> {
+  final String filePath;
+  final LineInfo lineInfo;
+  final List<Violation> violations;
+  final S005TrustedServiceAuthorizationAnalyzer analyzer;
+
+  _S005Visitor({
+    required this.filePath,
+    required this.lineInfo,
+    required this.violations,
+    required this.analyzer,
+  });
+
+  @override
+  void visitIfStatement(IfStatement node) {
+    final condition = node.expression.toSource().toLowerCase();
+
+    // Check if this is an authorization check
+    bool isAuthCheck = S005TrustedServiceAuthorizationAnalyzer._authKeywords
+        .any((k) => condition.contains(k));
+
+    if (isAuthCheck) {
+      // Check if relying on client-side data
+      bool usesClientSideData =
+          S005TrustedServiceAuthorizationAnalyzer._clientSideAuthPatterns
+              .any((p) => condition.contains(p));
+
+      // Check if it's server-side context
+      bool isServerSide =
+          S005TrustedServiceAuthorizationAnalyzer._serverSidePatterns
+              .any((p) => condition.contains(p));
+
+      if (usesClientSideData && !isServerSide) {
+        violations.add(analyzer.createViolation(
+          filePath: filePath,
+          line: analyzer.getLine(lineInfo, node.offset),
+          column: analyzer.getColumn(lineInfo, node.offset),
+          message:
+              'Authorization check uses client-side data - enforce authorization at trusted service layer',
+        ));
+      }
+    }
+
+    super.visitIfStatement(node);
+  }
+
+  @override
+  void visitMethodInvocation(MethodInvocation node) {
+    final source = node.toSource().toLowerCase();
+    final methodName = node.methodName.name.toLowerCase();
+
+    // Check for authorization methods using client-side data
+    bool isAuthMethod = S005TrustedServiceAuthorizationAnalyzer._authKeywords
+        .any((k) => methodName.contains(k));
+
+    if (isAuthMethod) {
+      // Check arguments for client-side data sources
+      for (final arg in node.argumentList.arguments) {
+        final argSource = arg.toSource().toLowerCase();
+        bool usesClientData =
+            S005TrustedServiceAuthorizationAnalyzer._clientSideAuthPatterns
+                .any((p) => argSource.contains(p));
+
+        if (usesClientData) {
+          violations.add(analyzer.createViolation(
+            filePath: filePath,
+            line: analyzer.getLine(lineInfo, node.offset),
+            column: analyzer.getColumn(lineInfo, node.offset),
+            message:
+                'Authorization relies on client-controlled data - validate permissions server-side',
+          ));
+          break;
+        }
+      }
+    }
+
+    super.visitMethodInvocation(node);
+  }
+
+  @override
+  void visitVariableDeclaration(VariableDeclaration node) {
+    final varName = node.name.lexeme.toLowerCase();
+    final initializer = node.initializer;
+
+    // Check for authorization variables from client-side storage
+    bool isAuthVar = S005TrustedServiceAuthorizationAnalyzer._authKeywords
+        .any((k) => varName.contains(k));
+
+    if (isAuthVar && initializer != null) {
+      final initSource = initializer.toSource().toLowerCase();
+      bool fromClientStorage =
+          S005TrustedServiceAuthorizationAnalyzer._clientSideAuthPatterns
+              .any((p) => initSource.contains(p));
+
+      if (fromClientStorage) {
+        violations.add(analyzer.createViolation(
+          filePath: filePath,
+          line: analyzer.getLine(lineInfo, node.offset),
+          column: analyzer.getColumn(lineInfo, node.offset),
+          message:
+              'Authorization state from client storage can be manipulated - use server-side validation',
+        ));
+      }
+    }
+
+    super.visitVariableDeclaration(node);
+  }
+}

package/dart_analyzer/lib/rules/security/S006_no_default_credentials.dart

@@ -0,0 +1,208 @@
+import 'package:analyzer/dart/ast/ast.dart';
+import 'package:analyzer/dart/ast/visitor.dart';
+import 'package:analyzer/source/line_info.dart';
+
+import '../../models/rule.dart';
+import '../../models/violation.dart';
+import '../base_analyzer.dart';
+
+/// S006: Do not use default credentials for service authentication
+/// Detect common default or well-known credentials
+class S006NoDefaultCredentialsAnalyzer extends BaseAnalyzer {
+  @override
+  String get ruleId => 'S006';
+
+  // Common default credential combinations
+  static const _defaultCredentials = [
+    'admin:admin',
+    'root:root',
+    'test:test',
+    'user:user',
+    'guest:guest',
+    'admin:password',
+    'admin:123456',
+    'root:password',
+    'postgres:postgres',
+    'mysql:mysql',
+    'sa:sa',
+    'administrator:administrator',
+  ];
+
+  // Default password patterns
+  static const _defaultPasswords = [
+    'password',
+    'password123',
+    '123456',
+    'admin',
+    'root',
+    'test',
+    'default',
+    'changeme',
+    'letmein',
+    'qwerty',
+  ];
+
+  // Credential context patterns
+  static const _credentialContexts = [
+    'password',
+    'passwd',
+    'credential',
+    'auth',
+    'login',
+    'connect',
+    'database',
+    'db_',
+    'redis',
+    'mongo',
+    'mysql',
+    'postgres',
+  ];
+
+  @override
+  List<Violation> analyze({
+    required CompilationUnit unit,
+    required String filePath,
+    required Rule rule,
+    required LineInfo lineInfo,
+  }) {
+    final violations = <Violation>[];
+    final visitor = _S006Visitor(
+      filePath: filePath,
+      lineInfo: lineInfo,
+      violations: violations,
+      analyzer: this,
+    );
+    unit.accept(visitor);
+    return violations;
+  }
+}
+
+class _S006Visitor extends RecursiveAstVisitor<void> {
+  final String filePath;
+  final LineInfo lineInfo;
+  final List<Violation> violations;
+  final S006NoDefaultCredentialsAnalyzer analyzer;
+
+  _S006Visitor({
+    required this.filePath,
+    required this.lineInfo,
+    required this.violations,
+    required this.analyzer,
+  });
+
+  @override
+  void visitVariableDeclaration(VariableDeclaration node) {
+    final varName = node.name.lexeme.toLowerCase();
+    final initializer = node.initializer;
+
+    if (initializer is StringLiteral) {
+      final value = _getStringValue(initializer).toLowerCase();
+
+      // Check for default credential combinations
+      bool hasDefaultCredential =
+          S006NoDefaultCredentialsAnalyzer._defaultCredentials
+              .any((c) => value.contains(c));
+
+      if (hasDefaultCredential) {
+        violations.add(analyzer.createViolation(
+          filePath: filePath,
+          line: analyzer.getLine(lineInfo, node.offset),
+          column: analyzer.getColumn(lineInfo, node.offset),
+          message:
+              'Default credentials detected - use unique, strong credentials for each service',
+        ));
+      }
+
+      // Check for default passwords in credential contexts
+      bool isCredentialContext =
+          S006NoDefaultCredentialsAnalyzer._credentialContexts
+              .any((c) => varName.contains(c));
+
+      if (isCredentialContext) {
+        bool hasDefaultPassword =
+            S006NoDefaultCredentialsAnalyzer._defaultPasswords
+                .any((p) => value == p || value.contains(p));
+
+        if (hasDefaultPassword) {
+          violations.add(analyzer.createViolation(
+            filePath: filePath,
+            line: analyzer.getLine(lineInfo, node.offset),
+            column: analyzer.getColumn(lineInfo, node.offset),
+            message:
+                'Default/weak password detected - generate unique strong credentials',
+          ));
+        }
+      }
+    }
+
+    super.visitVariableDeclaration(node);
+  }
+
+  @override
+  void visitMapLiteralEntry(MapLiteralEntry node) {
+    final key = node.key.toSource().toLowerCase();
+    final value = node.value;
+
+    // Check for credential keys with default values
+    bool isCredentialKey = S006NoDefaultCredentialsAnalyzer._credentialContexts
+        .any((c) => key.contains(c));
+
+    if (isCredentialKey && value is StringLiteral) {
+      final valueStr = _getStringValue(value).toLowerCase();
+
+      bool hasDefaultPassword = S006NoDefaultCredentialsAnalyzer._defaultPasswords
+          .any((p) => valueStr == p || valueStr.contains(p));
+
+      bool hasDefaultCredential =
+          S006NoDefaultCredentialsAnalyzer._defaultCredentials
+              .any((c) => valueStr.contains(c));
+
+      if (hasDefaultPassword || hasDefaultCredential) {
+        violations.add(analyzer.createViolation(
+          filePath: filePath,
+          line: analyzer.getLine(lineInfo, node.offset),
+          column: analyzer.getColumn(lineInfo, node.offset),
+          message:
+              'Default credentials in configuration - use secrets manager or environment variables',
+        ));
+      }
+    }
+
+    super.visitMapLiteralEntry(node);
+  }
+
+  @override
+  void visitMethodInvocation(MethodInvocation node) {
+    final source = node.toSource().toLowerCase();
+
+    // Check for connection strings with default credentials
+    if (source.contains('connect') ||
+        source.contains('createclient') ||
+        source.contains('database')) {
+      bool hasDefaultCredential =
+          S006NoDefaultCredentialsAnalyzer._defaultCredentials
+              .any((c) => source.contains(c));
+
+      if (hasDefaultCredential) {
+        violations.add(analyzer.createViolation(
+          filePath: filePath,
+          line: analyzer.getLine(lineInfo, node.offset),
+          column: analyzer.getColumn(lineInfo, node.offset),
+          message:
+              'Default credentials in connection - use environment variables or secrets manager',
+        ));
+      }
+    }
+
+    super.visitMethodInvocation(node);
+  }
+
+  String _getStringValue(StringLiteral literal) {
+    if (literal is SimpleStringLiteral) {
+      return literal.value;
+    } else if (literal is AdjacentStrings) {
+      return literal.strings.map((s) => _getStringValue(s)).join();
+    }
+    return literal.toSource();
+  }
+}

package/dart_analyzer/lib/rules/security/S007_output_encoding.dart

@@ -0,0 +1,224 @@
+import 'package:analyzer/dart/ast/ast.dart';
+import 'package:analyzer/dart/ast/visitor.dart';
+import 'package:analyzer/source/line_info.dart';
+
+import '../../models/rule.dart';
+import '../../models/violation.dart';
+import '../base_analyzer.dart';
+
+/// S007: Perform output encoding before interpreter use
+/// Detect missing output encoding for different contexts
+class S007OutputEncodingAnalyzer extends BaseAnalyzer {
+  @override
+  String get ruleId => 'S007';
+
+  // Output context patterns
+  static const _htmlOutputPatterns = [
+    'innerhtml',
+    'innerHtml',
+    'setinnerhtml',
+    'outerhtml',
+    'outerHtml',
+    'dangerouslysetinnerhtml',
+    'unsafehtml',
+  ];
+
+  // JavaScript context patterns
+  static const _jsOutputPatterns = [
+    'eval(',
+    'new function(',
+    'settimeout(',
+    'setinterval(',
+    'script>',
+  ];
+
+  // URL context patterns
+  static const _urlOutputPatterns = [
+    'href=',
+    'src=',
+    'action=',
+    'window.location',
+    'document.location',
+  ];
+
+  // Safe encoding patterns
+  static const _encodingPatterns = [
+    'htmlescape',
+    'html.escape',
+    'htmlentities',
+    'encodeuri',
+    'encodeuricomponent',
+    'urlencode',
+    'sanitize',
+    'encode',
+    'escape',
+    'dompurify',
+  ];
+
+  @override
+  List<Violation> analyze({
+    required CompilationUnit unit,
+    required String filePath,
+    required Rule rule,
+    required LineInfo lineInfo,
+  }) {
+    final violations = <Violation>[];
+    final visitor = _S007Visitor(
+      filePath: filePath,
+      lineInfo: lineInfo,
+      violations: violations,
+      analyzer: this,
+    );
+    unit.accept(visitor);
+    return violations;
+  }
+}
+
+class _S007Visitor extends RecursiveAstVisitor<void> {
+  final String filePath;
+  final LineInfo lineInfo;
+  final List<Violation> violations;
+  final S007OutputEncodingAnalyzer analyzer;
+
+  _S007Visitor({
+    required this.filePath,
+    required this.lineInfo,
+    required this.violations,
+    required this.analyzer,
+  });
+
+  @override
+  void visitAssignmentExpression(AssignmentExpression node) {
+    final left = node.leftHandSide.toSource().toLowerCase();
+    final right = node.rightHandSide.toSource().toLowerCase();
+
+    // Check for HTML context without encoding
+    bool isHtmlContext = S007OutputEncodingAnalyzer._htmlOutputPatterns
+        .any((p) => left.contains(p));
+
+    if (isHtmlContext) {
+      bool hasEncoding = S007OutputEncodingAnalyzer._encodingPatterns
+          .any((p) => right.contains(p));
+
+      // Check if using user input without encoding
+      bool hasUserInput = _containsUserInput(right);
+
+      if (hasUserInput && !hasEncoding) {
+        violations.add(analyzer.createViolation(
+          filePath: filePath,
+          line: analyzer.getLine(lineInfo, node.offset),
+          column: analyzer.getColumn(lineInfo, node.offset),
+          message:
+              'HTML output without encoding - apply HTML encoding before inserting user data',
+        ));
+      }
+    }
+
+    super.visitAssignmentExpression(node);
+  }
+
+  @override
+  void visitMethodInvocation(MethodInvocation node) {
+    final source = node.toSource().toLowerCase();
+    final methodName = node.methodName.name.toLowerCase();
+
+    // Check for dangerous output methods
+    bool isHtmlOutput = S007OutputEncodingAnalyzer._htmlOutputPatterns
+        .any((p) => methodName.contains(p) || source.contains(p));
+
+    if (isHtmlOutput) {
+      bool hasEncoding = S007OutputEncodingAnalyzer._encodingPatterns
+          .any((p) => source.contains(p));
+
+      bool hasUserInput = _containsUserInput(source);
+
+      if (hasUserInput && !hasEncoding) {
+        violations.add(analyzer.createViolation(
+          filePath: filePath,
+          line: analyzer.getLine(lineInfo, node.offset),
+          column: analyzer.getColumn(lineInfo, node.offset),
+          message:
+              'Output to HTML without encoding - use context-appropriate encoding',
+        ));
+      }
+    }
+
+    // Check for JavaScript context
+    bool isJsOutput = S007OutputEncodingAnalyzer._jsOutputPatterns
+        .any((p) => source.contains(p));
+
+    if (isJsOutput) {
+      bool hasEncoding = S007OutputEncodingAnalyzer._encodingPatterns
+          .any((p) => source.contains(p));
+
+      bool hasUserInput = _containsUserInput(source);
+
+      if (hasUserInput && !hasEncoding) {
+        violations.add(analyzer.createViolation(
+          filePath: filePath,
+          line: analyzer.getLine(lineInfo, node.offset),
+          column: analyzer.getColumn(lineInfo, node.offset),
+          message:
+              'User data in JavaScript context without encoding - escape properly before use',
+        ));
+      }
+    }
+
+    super.visitMethodInvocation(node);
+  }
+
+  @override
+  void visitStringInterpolation(StringInterpolation node) {
+    final source = node.toSource().toLowerCase();
+
+    // Check if interpolation is in URL context
+    bool isUrlContext = S007OutputEncodingAnalyzer._urlOutputPatterns
+        .any((p) => source.contains(p));
+
+    if (isUrlContext) {
+      // Check parent context for encoding
+      bool hasEncoding = _parentHasEncoding(node);
+
+      if (!hasEncoding && _containsUserInput(source)) {
+        violations.add(analyzer.createViolation(
+          filePath: filePath,
+          line: analyzer.getLine(lineInfo, node.offset),
+          column: analyzer.getColumn(lineInfo, node.offset),
+          message:
+              'URL construction with user data - use encodeURIComponent() for query parameters',
+        ));
+      }
+    }
+
+    super.visitStringInterpolation(node);
+  }
+
+  bool _containsUserInput(String source) {
+    final userInputPatterns = [
+      'request.',
+      'params.',
+      'query.',
+      'body.',
+      'input',
+      'userdata',
+      'user.',
+      'form.',
+    ];
+    return userInputPatterns.any((p) => source.contains(p));
+  }
+
+  bool _parentHasEncoding(AstNode node) {
+    AstNode? current = node.parent;
+    int depth = 0;
+    while (current != null && depth < 5) {
+      final source = current.toSource().toLowerCase();
+      if (S007OutputEncodingAnalyzer._encodingPatterns
+          .any((p) => source.contains(p))) {
+        return true;
+      }
+      current = current.parent;
+      depth++;
+    }
+    return false;
+  }
+}