add session{key,id} as sensitive info

2026-05-02 12:15:17 +02:00 · 2021-10-06 15:46:28 +02:00
parent 1e1e549847
commit 834d5ec6ad
4 changed files with 13 additions and 2 deletions
--- a/python/ql/lib/semmle/python/security/internal/SensitiveDataHeuristics.qll
+++ b/python/ql/lib/semmle/python/security/internal/SensitiveDataHeuristics.qll
@@ -58,7 +58,7 @@ module HeuristicNames {
   */
  string maybeAccountInfo() {
    result = "(?is).*acc(ou)?nt.*" or
-    result = "(?is).*(puid|username|userid).*" or
+    result = "(?is).*(puid|username|userid|session(id|key)).*" or
    result = "(?s).*([uU]|^|_|[a-z](?=U))([uU][iI][dD]).*"
  }