@sun-asterisk/sunlint 1.3.46 → 1.3.47

package/skill-assets/sunlint-code-quality/rules/ruby/S048-oauth-redirect-validation.md

@@ -0,0 +1,29 @@
+---
+title: Validate OAuth Redirect URIs
+impact: HIGH
+impactDescription: prevents redirect hijacking and token leakage
+tags: security, oauth, redirect, validation
+---
+
+## Validate OAuth Redirect URIs
+
+Ensure that the redirect URI sent in the authorization request matches the values pre-registered for your application.
+
+**Incorrect (dynamic/unvalidated redirect):**
+
+```ruby
+# Allowing user-supplied redirect_uri
+redirect_uri = params[:redirect_uri]
+redirect_to "https://provider.com/auth?redirect_uri=#{redirect_uri}"
+```
+
+**Correct (pre-registered URI):**
+
+```ruby
+# Hardcode or use config
+CALLBACK_URL = "https://app.com/auth/callback"
+redirect_to "https://provider.com/auth?redirect_uri=#{CALLBACK_URL}"
+```
+
+**Tools:** Manual Review
+---

package/skill-assets/sunlint-code-quality/rules/ruby/S049-auth-code-expiry.md

@@ -0,0 +1,31 @@
+---
+title: Enforce Token Expiration
+impact: MEDIUM
+impactDescription: limits the lifespan of stolen tokens or temporary credentials
+tags: security, session, token, timeout
+---
+
+## Enforce Token Expiration
+
+All authorization codes, access tokens, and temporary files should have a strict, short expiration time.
+
+**Incorrect (no expiry):**
+
+```ruby
+class ResetToken < ApplicationRecord
+  # Token never expires
+end
+```
+
+**Correct (expiration check):**
+
+```ruby
+class ResetToken < ApplicationRecord
+  def valid?
+    created_at > 2.hours.ago
+  end
+end
+```
+
+**Tools:** Manual Review
+---

package/skill-assets/sunlint-code-quality/rules/ruby/S050-token-entropy.md

@@ -0,0 +1,26 @@
+---
+title: Use High Entropy for Tokens
+impact: HIGH
+impactDescription: ensures tokens are unpredictable and cannot be guessed
+tags: security, tokens, entropy
+---
+
+## Use High Entropy for Tokens
+
+Always use cryptographically secure random values (CSPRNG) with sufficient entropy (at least 128 bits) for all security tokens.
+
+**Incorrect (low entropy):**
+
+```ruby
+token = rand(10**10).to_s # Not long enough and not secure
+```
+
+**Correct (High entropy):**
+
+```ruby
+require 'securerandom'
+token = SecureRandom.hex(32) # 256 bits of entropy
+```
+
+**Tools:** Brakeman, SecureRandom
+---

package/skill-assets/sunlint-code-quality/rules/ruby/S051-password-length.md

@@ -0,0 +1,38 @@
+---
+title: Enforce Stricter Password Policies
+impact: HIGH
+impactDescription: ensures users use strong, difficult-to-crack passwords
+tags: security, password, authentication
+---
+
+## Enforce Stricter Password Policies
+
+Require a minimum password length and complexity (uppercase, lowercase, numbers, symbols) to protect against credential guessing.
+
+**Incorrect (weak password requirements):**
+
+```ruby
+class User < ApplicationRecord
+  has_secure_password
+  validates :password, length: { minimum: 4 } # Too short
+end
+```
+
+**Correct (strong policy):**
+
+```ruby
+class User < ApplicationRecord
+  has_secure_password
+  validates :password, length: { minimum: 12 }
+  # Complexity check
+  validate :password_complexity
+
+  def password_complexity
+    return if password.blank? || password =~ /^(?=.*?[A-Z])(?=.*?[a-z])(?=.*?[0-9])(?=.*?[#?!@$%^&*-]).{12,}$/
+    errors.add :password, 'Complexity requirement not met'
+  end
+end
+```
+
+**Tools:** Devise-security, Manual Review
+---

package/skill-assets/sunlint-code-quality/rules/ruby/S052-otp-entropy.md

@@ -0,0 +1,25 @@
+---
+title: Ensure Strong OTP Entropy
+impact: HIGH
+impactDescription: prevents OTP guessing attacks
+tags: security, mfa, otp, entropy
+---
+
+## Ensure Strong OTP Entropy
+
+When using One-Time Passwords (OTP), ensure they are generated using a secure random source and have sufficient length (at least 6 digits).
+
+**Incorrect (not secure):**
+
+```ruby
+otp = rand(9999) # Only 4 digits, predictable rand
+```
+
+**Correct (SecureRandom + 6 digits):**
+
+```ruby
+otp = SecureRandom.random_number(1_000_000).to_s.rjust(6, '0')
+```
+
+**Tools:** ROTP gem, Brakeman
+---

package/skill-assets/sunlint-code-quality/rules/ruby/S053-generic-error-messages.md

@@ -0,0 +1,33 @@
+---
+title: Use Generic Error Messages in Auth
+impact: MEDIUM
+impactDescription: prevents account enumeration by hiding which part of the authentication failed
+tags: security, authentication, privacy
+---
+
+## Use Generic Error Messages in Auth
+
+Avoid indicating whether the email or the password was incorrect. Use generic messages like "Invalid email or password".
+
+**Incorrect (reveals existence):**
+
+```ruby
+if @user.nil?
+  render json: { error: "User not found" } # Enumeration possible
+elsif !@user.authenticate(params[:password])
+  render json: { error: "Incorrect password" }
+end
+```
+
+**Correct (generic message):**
+
+```ruby
+if @user&.authenticate(params[:password])
+  login(@user)
+else
+  render json: { error: "Invalid email or password" }, status: :unauthorized
+end
+```
+
+**Tools:** Manual Review
+---

package/skill-assets/sunlint-code-quality/rules/ruby/S054-no-default-admin.md

@@ -0,0 +1,29 @@
+---
+title: No Default or Static Admin Accounts
+impact: CRITICAL
+impactDescription: prevents easy administrative access through well-known or static credentials
+tags: security, authorization, credentials, admin
+---
+
+## No Default or Static Admin Accounts
+
+Avoid creating default users or admin accounts with hardcoded passwords in seeds or initial configuration.
+
+**Incorrect (default seed):**
+
+```ruby
+# db/seeds.rb
+User.create!(email: "admin@example.com", password: "password", admin: true)
+```
+
+**Correct (env-driven seed):**
+
+```ruby
+User.find_or_create_by!(email: ENV['INITIAL_ADMIN_EMAIL']) do |u|
+  u.password = ENV['INITIAL_ADMIN_PASSWORD']
+  u.admin = true
+end
+```
+
+**Tools:** Manual Review
+---

package/skill-assets/sunlint-code-quality/rules/ruby/S055-content-type-validation.md

@@ -0,0 +1,24 @@
+---
+title: Validate Content-Type for Uploads
+impact: MEDIUM
+impactDescription: prevents uploading of malicious executable files disguised as data
+tags: security, uploads, validation, mimetypes
+---
+
+## Validate Content-Type for Uploads
+
+Always validate the `Content-Type` and file extension of uploaded files. Check the magic bytes/file header rather than just the extension.
+
+**Correct (ActiveStorage + Marcel):**
+
+```ruby
+# Rails ActiveStorage uses Marcel gem to check magic bytes
+class User < ApplicationRecord
+  has_one_attached :avatar
+  
+  validates :avatar, content_type: ['image/png', 'image/jpeg']
+end
+```
+
+**Tools:** ActiveStorage Validations gem
+---

package/skill-assets/sunlint-code-quality/rules/ruby/S056-log-injection.md

@@ -0,0 +1,28 @@
+---
+title: Prevent Log Injection
+impact: MEDIUM
+impactDescription: prevents attackers from corrupting logs or misleading auditors
+tags: security, logging, sanitization
+---
+
+## Prevent Log Injection
+
+Sanitize all user-input data before including it in log files to prevent attackers from injecting newlines or carriage returns.
+
+**Incorrect (unsafe logging):**
+
+```ruby
+# Attacker name: "admin\n[INFO] Login successful for admin"
+logger.info "User update attempted by #{params[:user_name]}"
+```
+
+**Correct (sanitized logging):**
+
+```ruby
+# Replace newlines with spaces or use json logger
+sanitized_name = params[:user_name].gsub(/[\n\r]/, " ")
+logger.info "User update attempted by #{sanitized_name}"
+```
+
+**Tools:** Lograge (default Rails JSON logging avoids this)
+---

package/skill-assets/sunlint-code-quality/rules/ruby/S057-synchronized-time.md

@@ -0,0 +1,18 @@
+---
+title: Ensure Synchronized System Time
+impact: LOW
+impactDescription: crucial for log correlation, audit trails, and time-based security tokens
+tags: security, infrastructure, timing
+---
+
+## Ensure Synchronized System Time
+
+Ensure all servers in your environment are synchronized using a network time protocol (NTP). This is critical for authentication tokens (OTP, JWT) and log correlation.
+
+**Details:**
+- Configure NTP/Chrony on all production servers.
+- Monitor time synchronization offset.
+- Important for TOTP (MFA) and token expiry checks.
+
+**Tools:** NTP, Chrony, CloudWatch Time Sync
+---

package/skill-assets/sunlint-code-quality/rules/ruby/S058-ssrf-protection.md

@@ -0,0 +1,39 @@
+---
+title: Prevent Server-Side Request Forgery (SSRF)
+impact: HIGH
+impactDescription: prevents attackers from accessing internal resources or services
+tags: security, ssrf, vulnerability, net-http
+---
+
+## Prevent Server-Side Request Forgery (SSRF)
+
+Never allow users to provide the full URL or IP address for your server to fetch. Use an allow-list of domains or a secure proxy.
+
+**Incorrect (unvalidated SSRF):**
+
+```ruby
+def fetch_external_report
+  # Attacker url: http://localhost:5432 or http://169.254.169.254/metadata
+  response = Net::HTTP.get(URI(params[:url]))
+  render body: response
+end
+```
+
+**Correct (validated domain):**
+
+```ruby
+ALLOWED_DOMAINS = ['trusted-report-source.com']
+
+def fetch_external_report
+  uri = URI(params[:url])
+  if ALLOWED_DOMAINS.include?(uri.host)
+    response = Net::HTTP.get(uri)
+    render body: response
+  else
+    render_403
+  end
+end
+```
+
+**Tools:** Brakeman, ssrf_filter gem
+---