diff --git a/javascript/ql/lib/change-notes/2026-10-30-trusted-schema-not-sensitive.md b/javascript/ql/lib/change-notes/2026-10-30-trusted-schema-not-sensitive.md new file mode 100644 index 000000000000..f97ae0b25b6e --- /dev/null +++ b/javascript/ql/lib/change-notes/2026-10-30-trusted-schema-not-sensitive.md @@ -0,0 +1,4 @@ +--- +category: minorAnalysis +--- +* The sensitive data heuristics treat names built on `trusted_schema`, such as SQLite's `set_trusted_schema` setting, as non-sensitive. This removes false positive results from queries that use the sensitive data library (for example `js/clear-text-logging`). diff --git a/python/ql/lib/change-notes/2026-10-30-trusted-schema-not-sensitive.md b/python/ql/lib/change-notes/2026-10-30-trusted-schema-not-sensitive.md new file mode 100644 index 000000000000..2e4c6e5ee2a3 --- /dev/null +++ b/python/ql/lib/change-notes/2026-10-30-trusted-schema-not-sensitive.md @@ -0,0 +1,4 @@ +--- +category: minorAnalysis +--- +* The sensitive data heuristics treat names built on `trusted_schema`, such as SQLite's `set_trusted_schema` setting, as non-sensitive. This removes false positive results from queries that use the sensitive data library (for example `py/clear-text-logging-sensitive-data`). diff --git a/ruby/ql/lib/change-notes/2026-10-30-trusted-schema-not-sensitive.md b/ruby/ql/lib/change-notes/2026-10-30-trusted-schema-not-sensitive.md new file mode 100644 index 000000000000..ade6e38949ff --- /dev/null +++ b/ruby/ql/lib/change-notes/2026-10-30-trusted-schema-not-sensitive.md @@ -0,0 +1,4 @@ +--- +category: minorAnalysis +--- +* The sensitive data heuristics treat names built on `trusted_schema`, such as SQLite's `set_trusted_schema` setting, as non-sensitive. This removes false positive results from queries that use the sensitive data library (for example `rb/clear-text-logging-sensitive-data`). diff --git a/rust/ql/lib/change-notes/2026-10-30-trusted-schema-not-sensitive.md b/rust/ql/lib/change-notes/2026-10-30-trusted-schema-not-sensitive.md new file mode 100644 index 000000000000..9a51edefa011 --- /dev/null +++ b/rust/ql/lib/change-notes/2026-10-30-trusted-schema-not-sensitive.md @@ -0,0 +1,4 @@ +--- +category: minorAnalysis +--- +* The sensitive data heuristics treat names built on `trusted_schema`, such as SQLite's `set_trusted_schema` setting, as non-sensitive. This removes false positive results from queries that use the sensitive data library (for example `rust/cleartext-logging`). diff --git a/rust/ql/test/library-tests/sensitivedata/test.rs b/rust/ql/test/library-tests/sensitivedata/test.rs index e2bb5a5f595c..0dfc94ccf558 100644 --- a/rust/ql/test/library-tests/sensitivedata/test.rs +++ b/rust/ql/test/library-tests/sensitivedata/test.rs @@ -97,10 +97,17 @@ fn get_public_key() -> String { get_string() } fn get_secret_token() -> String { get_string() } fn get_next_token() -> String { get_string() } +struct Connection; + +impl Connection { + fn set_trusted_schema(&mut self, enabled: bool) -> bool { enabled } +} + fn test_credentials( account_key: &str, accnt_key: &str, license_key: &str, secret_key: &str, is_secret: bool, num_accounts: i64, username: String, user_name: String, userid: i64, user_id: i64, my_user_id_64: i64, id: i64, uid: i64, uuid: i64, guid: i64, unique_id: i64, sessionkey: &[u64; 4], session_key: &[u64; 4], hashkey: &[u64; 4], hash_key: &[u64; 4], sessionkeypath: &[u64; 4], account_key_path: &[u64; 4], + trusted_token: &str, trusted_schema: bool, trustedSchema: bool, conn: &mut Connection, ms: &MyStruct ) { // credentials @@ -125,6 +132,7 @@ fn test_credentials( sink(get_secure_key()); // $ MISSING: sensitive=secret sink(get_private_key()); // $ MISSING: sensitive=secret sink(get_secret_token()); // $ sensitive=secret + sink(trusted_token); // $ sensitive=secret // not (necessarily) credentials @@ -146,6 +154,9 @@ fn test_credentials( sink(get_public_key()); sink(get_next_token()); + sink(trusted_schema); + sink(trustedSchema); + sink(conn.set_trusted_schema(false)); } struct MacAddr { diff --git a/shared/concepts/codeql/concepts/internal/SensitiveDataHeuristics.qll b/shared/concepts/codeql/concepts/internal/SensitiveDataHeuristics.qll index b2bda909e3ba..4a2b56af3ea4 100644 --- a/shared/concepts/codeql/concepts/internal/SensitiveDataHeuristics.qll +++ b/shared/concepts/codeql/concepts/internal/SensitiveDataHeuristics.qll @@ -57,7 +57,7 @@ module HeuristicNames { * or trusted data. */ string maybeSecret() { - result = "(?is).*((?