@sun-asterisk/sunlint 1.3.46 → 1.3.48

package/skill-assets/sunlint-code-quality/rules/ruby/S055-content-type-validation.md

@@ -0,0 +1,24 @@
+---
+title: Validate Content-Type for Uploads
+impact: MEDIUM
+impactDescription: prevents uploading of malicious executable files disguised as data
+tags: security, uploads, validation, mimetypes
+---
+
+## Validate Content-Type for Uploads
+
+Always validate the `Content-Type` and file extension of uploaded files. Check the magic bytes/file header rather than just the extension.
+
+**Correct (ActiveStorage + Marcel):**
+
+```ruby
+# Rails ActiveStorage uses Marcel gem to check magic bytes
+class User < ApplicationRecord
+  has_one_attached :avatar
+  
+  validates :avatar, content_type: ['image/png', 'image/jpeg']
+end
+```
+
+**Tools:** ActiveStorage Validations gem
+---

package/skill-assets/sunlint-code-quality/rules/ruby/S056-log-injection.md

@@ -0,0 +1,28 @@
+---
+title: Prevent Log Injection
+impact: MEDIUM
+impactDescription: prevents attackers from corrupting logs or misleading auditors
+tags: security, logging, sanitization
+---
+
+## Prevent Log Injection
+
+Sanitize all user-input data before including it in log files to prevent attackers from injecting newlines or carriage returns.
+
+**Incorrect (unsafe logging):**
+
+```ruby
+# Attacker name: "admin\n[INFO] Login successful for admin"
+logger.info "User update attempted by #{params[:user_name]}"
+```
+
+**Correct (sanitized logging):**
+
+```ruby
+# Replace newlines with spaces or use json logger
+sanitized_name = params[:user_name].gsub(/[\n\r]/, " ")
+logger.info "User update attempted by #{sanitized_name}"
+```
+
+**Tools:** Lograge (default Rails JSON logging avoids this)
+---

package/skill-assets/sunlint-code-quality/rules/ruby/S057-synchronized-time.md

@@ -0,0 +1,18 @@
+---
+title: Ensure Synchronized System Time
+impact: LOW
+impactDescription: crucial for log correlation, audit trails, and time-based security tokens
+tags: security, infrastructure, timing
+---
+
+## Ensure Synchronized System Time
+
+Ensure all servers in your environment are synchronized using a network time protocol (NTP). This is critical for authentication tokens (OTP, JWT) and log correlation.
+
+**Details:**
+- Configure NTP/Chrony on all production servers.
+- Monitor time synchronization offset.
+- Important for TOTP (MFA) and token expiry checks.
+
+**Tools:** NTP, Chrony, CloudWatch Time Sync
+---

package/skill-assets/sunlint-code-quality/rules/ruby/S058-ssrf-protection.md

@@ -0,0 +1,39 @@
+---
+title: Prevent Server-Side Request Forgery (SSRF)
+impact: HIGH
+impactDescription: prevents attackers from accessing internal resources or services
+tags: security, ssrf, vulnerability, net-http
+---
+
+## Prevent Server-Side Request Forgery (SSRF)
+
+Never allow users to provide the full URL or IP address for your server to fetch. Use an allow-list of domains or a secure proxy.
+
+**Incorrect (unvalidated SSRF):**
+
+```ruby
+def fetch_external_report
+  # Attacker url: http://localhost:5432 or http://169.254.169.254/metadata
+  response = Net::HTTP.get(URI(params[:url]))
+  render body: response
+end
+```
+
+**Correct (validated domain):**
+
+```ruby
+ALLOWED_DOMAINS = ['trusted-report-source.com']
+
+def fetch_external_report
+  uri = URI(params[:url])
+  if ALLOWED_DOMAINS.include?(uri.host)
+    response = Net::HTTP.get(uri)
+    render body: response
+  else
+    render_403
+  end
+end
+```
+
+**Tools:** Brakeman, ssrf_filter gem
+---