Add sensitive data heuristic

python/ql/lib/semmle/python/Concepts.qll

@@ -12,6 +12,7 @@ private import semmle.python.dataflow.new.TaintTracking
 private import semmle.python.Files
 private import semmle.python.Frameworks
 private import semmle.python.security.internal.EncryptionKeySizes
+private import semmle.python.dataflow.new.SensitiveDataSources
 private import codeql.threatmodels.ThreatModels
 private import codeql.concepts.ConceptsShared
 
@@ -1290,6 +1291,18 @@ module Http {
        */
       DataFlow::Node getValueArg() { result = super.getValueArg() }
 
+      /** Holds if the name of this cookie indicates it may contain sensitive information. */
+      predicate isSensitive() {
+        exists(DataFlow::Node name |
+          name = [this.getNameArg(), this.getHeaderArg()] and
+          (
+            name instanceof SensitiveDataSource
+            or
+            name = sensitiveLookupStringConst(_)
+          )
+        )
+      }
+
       /**
        * Holds if the `Secure` flag of the cookie is known to have a value of `b`.
        */

python/ql/lib/semmle/python/dataflow/new/SensitiveDataSources.qll

@@ -334,3 +334,5 @@ private module SensitiveDataModeling {
 }
 
 predicate sensitiveDataExtraStepForCalls = SensitiveDataModeling::extraStepForCalls/2;
+
+predicate sensitiveLookupStringConst = SensitiveDataModeling::sensitiveLookupStringConst/1;