hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-24 04:36:35 +01:00
Code Issues Packages Projects Releases Wiki Activity

remove url from sensitive info regex

Browse Source
This commit is contained in:
Joe Farebrother
2022-03-04 10:37:05 +00:00
parent 4ad402f33f
commit 6c05f7a81a
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
java/ql/src/Security/CWE/CWE-532/SensitiveInfoLog.ql
View File

@@ -1,7 +1,7 @@
/**
* @name Insertion of sensitive information into log files
* @description Writing sensitive information to log files can give valuable
* guidance to an attacker or expose sensitive user information.
* @description Writing sensitive information to log files can allow that
* information to be leaked to an attacker more easily.
* @kind path-problem
* @problem.severity warning
* @precision medium
@@ -20,7 +20,7 @@ import PathGraph
/**
* Gets a regular expression for matching names of variables that indicate the value being held may contain sensitive information
*/
private string getACredentialRegex() { result = "(?i)(.*username|url).*" }
private string getACredentialRegex() { result = "(?i).*username.*" }
/** Variable keeps sensitive information judging by its name * */
class CredentialExpr extends Expr {