hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-03 04:39:29 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix getCommonSensitiveInfoRegex

Browse Source
This commit is contained in:
Tony Torralba
2023-04-13 10:33:03 +02:00
parent 84971c8687
commit 485709a133
2 changed files with 12 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
java/ql/lib/semmle/code/java/security/SensitiveActions.qll
View File

@@ -31,7 +31,7 @@ private string nonSuspicious() {
* Gets a regular expression for matching common names of variables that indicate the value being held contains sensitive information.
*/
string getCommonSensitiveInfoRegex() {
result = "(?i).*challenge|pass(wd|word|code|phrase)(?!.*question).*" or
result = "(?i).*(challenge|pass(wd|word|code|phrase))(?!.*question).*" or
result = "(?i).*(token|secret).*"
}

11
java/ql/test/library-tests/sensitive-actions/test.expected
View File

@@ -29,12 +29,23 @@ sensitiveVarAccess
| Test.java:140:15:140:34 | aaPasswdaaQuestionaa |
| Test.java:141:15:141:36 | aaPasswordaaQuestionaa |
sensitiveVariable
| Test.java:48:9:48:33 | String aaPasswordaa |
| Test.java:49:9:49:31 | String aaPasswdaa |
| Test.java:53:9:53:39 | String aaRefreshaaTokenaa |
| Test.java:54:9:54:38 | String aaSecretaaTokenaa |
| Test.java:72:9:72:39 | String aaHashedPasswordaa |
| Test.java:73:9:73:37 | String aaHashedPasswdaa |
| Test.java:77:9:77:45 | String aaHashedRefreshaaTokenaa |
| Test.java:78:9:78:44 | String aaHashedsecretaatokenaa |
| Test.java:79:9:79:38 | String aaCryptPasswordaa |
| Test.java:80:9:80:36 | String aaCryptPasswdaa |
| Test.java:84:9:84:44 | String aaCryptRefreshaaTokenaa |
| Test.java:85:9:85:43 | String aaCryptSecretaaTokenaa |
| Test.java:117:9:117:34 | String aaChallengeaa |
| Test.java:118:9:118:31 | String aaPasswdaa |
| Test.java:119:9:119:33 | String aaPasswordaa |
| Test.java:120:9:120:33 | String aaPasscodeaa |
| Test.java:121:9:121:35 | String aaPassphraseaa |
| Test.java:122:9:122:30 | String aaTokenaa |
| Test.java:123:9:123:31 | String aaSecretaa |
sensitiveDataMethod