Python: Model sensitive data based on parameter names

2026-05-05 05:35:13 +02:00 · 2021-06-03 14:25:15 +02:00
parent 925e67d734
commit f5fd0f8d1c
2 changed files with 15 additions and 1 deletions
--- a/python/ql/test/experimental/dataflow/sensitive-data/test.py
+++ b/python/ql/test/experimental/dataflow/sensitive-data/test.py
@@ -29,7 +29,10 @@ foo = ObjectFromDatabase()
 foo.secret # $ SensitiveDataSource=secret
 foo.username # $ SensitiveDataSource=id

-# plain variables
+# based on variable/parameter names
+def my_func(password): # $ SensitiveDataSource=password
+    print(password) # $ SensitiveUse=password
+
 password = some_function()
 print(password) # $ MISSING: SensitiveUse=password