13 Commits

Author	SHA1	Message	Date
MarkLee131	46ef0204ef	Remove secretQuestion from FP exclusion list ... secretQuestion is ambiguous: it could be the question text (not sensitive) or a security question answer. Worse, the regex secrets?(question) also matches secretQuestionAnswer, which is clearly sensitive. Drop it to avoid false negatives.	2026-04-04 21:58:32 +08:00
MarkLee131	20cfe29199	Java: reduce false positives in sensitive-log by expanding FP exclusion regex ... The getCommonSensitiveInfoFPRegex() only excluded "null", "tokenizer", and "tokenImage", causing widespread false positives for common non-sensitive variable names containing "token" or "secret". This adds exclusions for three categories: - Pagination/iteration tokens: nextToken (AWS SDK), pageToken (GCP), continuationToken (Azure), etc. - Token metadata: tokenType (OAuth), tokenEndpoint (OIDC), tokenCount, tokenIndex, tokenLength, tokenUrl, etc. - Secret metadata: secretName (K8s/AWS), secretId (Azure), secretVersion, secretArn, secretPath, etc. All truly sensitive variable names (accessToken, clientSecret, secretKey, refreshToken, etc.) remain correctly flagged.	2026-04-04 21:33:35 +08:00
Owen Mansel-Chan	1a59839f3c	Range library recognises long literals now	2025-11-24 14:10:54 +00:00
Owen Mansel-Chan	ec381e4ec5	Use range analysis and improve tests	2025-11-21 10:31:50 +00:00
aegilops	62ee6d3a33	Made changes requested by reviewers - bounded() for range checking, style and better comments	2025-11-20 11:46:42 +00:00
aegilops	fa703e3e60	Test cases for sensitive logging sanitizer	2025-11-14 16:53:46 +00:00
Nora Dimitrijević	6134518d60	[TEST] Java: SensitiveLogInfo: convert to qlref	2025-07-17 18:59:01 +02:00
Owen Mansel-Chan	e259b25428	Add "tokenizer" to sensitive variable name FPs	2024-07-30 15:38:32 +01:00
Owen Mansel-Chan	bdff0fdcc5	Add test for "tokenizer"	2024-07-30 15:37:46 +01:00
Owen Mansel-Chan	0d71072f94	Make test more compact	2024-07-30 15:36:59 +01:00
Owen Mansel-Chan	19ac9e089a	Add test	2024-03-03 21:03:41 +00:00
Tony Torralba	5db8306fef	Stop considering usernames sensitive info ... Require variables to be static to be considered constants	2022-05-12 11:46:52 +02:00
Joe Farebrother	06f2c03828	Add tests	2022-03-11 17:44:52 +00:00