MarkLee131 f338ded349 Java: treat hash/encrypt/digest methods as sensitive-log sanitizers ...

The sensitive-log query (CWE-532) lacked sanitizers for hashed or
encrypted data, while the sibling cleartext-storage query (CWE-312)
already recognized methods with "encrypt", "hash", or "digest" in their
names as sanitizers (CleartextStorageQuery.qll:86).

This adds an EncryptionBarrier to SensitiveLoggingQuery that applies the
same name-based heuristic, making the two queries consistent. Calls like
DigestUtils.sha256Hex(password) or hashPassword(secret) are no longer
flagged when their results are logged.

2026-04-04 21:35:36 +08:00

..

code

Java: treat hash/encrypt/digest methods as sensitive-log sanitizers

2026-04-04 21:35:36 +08:00

files

Overlay: Add overlay annotations to Java & shared libraries

2025-06-24 10:25:06 +02:00