Skip to content

Commit 90382c4

Browse files
erik-krogherik-krogh
authored
Merge pull request github#11178 from erik-krogh/passcode
JS/RB/PY: Recognize `passcode` as sensitive
2 parents bda4b52 + 724a31b commit 90382c4

5 files changed

Lines changed: 19 additions & 3 deletions

File tree

‎javascript/ql/lib/semmle/javascript/security/internal/SensitiveDataHeuristics.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -103,7 +103,7 @@ module HeuristicNames {
103103
*/
104104
string notSensitiveRegexp() {
105105
result =
106-
"(?is).*([^\\w$.-]|redact|censor|obfuscate|hash|md5|sha|random|((?<!un)(en))?(crypt|code)|certain|concert|secretar|accountant|accountab).*"
106+
"(?is).*([^\\w$.-]|redact|censor|obfuscate|hash|md5|sha|random|((?<!un)(en))?(crypt|(?<!pass)code)|certain|concert|secretar|accountant|accountab).*"
107107
}
108108

109109
/**

‎javascript/ql/test/query-tests/Security/CWE-312/CleartextLogging.expected‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -133,6 +133,12 @@ nodes
133133
| passwords.js:170:11:170:18 | password |
134134
| passwords.js:170:11:170:39 | passwor ... g, "*") |
135135
| passwords.js:170:11:170:39 | passwor ... g, "*") |
136+
| passwords.js:173:17:173:26 | myPassword |
137+
| passwords.js:173:17:173:26 | myPassword |
138+
| passwords.js:173:17:173:26 | myPassword |
139+
| passwords.js:176:17:176:26 | myPasscode |
140+
| passwords.js:176:17:176:26 | myPasscode |
141+
| passwords.js:176:17:176:26 | myPasscode |
136142
| passwords_in_browser1.js:2:13:2:20 | password |
137143
| passwords_in_browser1.js:2:13:2:20 | password |
138144
| passwords_in_browser1.js:2:13:2:20 | password |
@@ -277,6 +283,8 @@ edges
277283
| passwords.js:170:11:170:18 | password | passwords.js:170:11:170:39 | passwor ... g, "*") |
278284
| passwords.js:170:11:170:18 | password | passwords.js:170:11:170:39 | passwor ... g, "*") |
279285
| passwords.js:170:11:170:18 | password | passwords.js:170:11:170:39 | passwor ... g, "*") |
286+
| passwords.js:173:17:173:26 | myPassword | passwords.js:173:17:173:26 | myPassword |
287+
| passwords.js:176:17:176:26 | myPasscode | passwords.js:176:17:176:26 | myPasscode |
280288
| passwords_in_browser1.js:2:13:2:20 | password | passwords_in_browser1.js:2:13:2:20 | password |
281289
| passwords_in_browser2.js:2:13:2:20 | password | passwords_in_browser2.js:2:13:2:20 | password |
282290
| passwords_in_server_1.js:6:13:6:20 | password | passwords_in_server_1.js:6:13:6:20 | password |
@@ -322,6 +330,8 @@ edges
322330
| passwords.js:164:14:164:42 | passwor ... g, "*") | passwords.js:164:14:164:21 | password | passwords.js:164:14:164:42 | passwor ... g, "*") | This logs sensitive data returned by $@ as clear text. | passwords.js:164:14:164:21 | password | an access to password |
323331
| passwords.js:169:17:169:45 | passwor ... g, "*") | passwords.js:169:17:169:24 | password | passwords.js:169:17:169:45 | passwor ... g, "*") | This logs sensitive data returned by $@ as clear text. | passwords.js:169:17:169:24 | password | an access to password |
324332
| passwords.js:170:11:170:39 | passwor ... g, "*") | passwords.js:170:11:170:18 | password | passwords.js:170:11:170:39 | passwor ... g, "*") | This logs sensitive data returned by $@ as clear text. | passwords.js:170:11:170:18 | password | an access to password |
333+
| passwords.js:173:17:173:26 | myPassword | passwords.js:173:17:173:26 | myPassword | passwords.js:173:17:173:26 | myPassword | This logs sensitive data returned by $@ as clear text. | passwords.js:173:17:173:26 | myPassword | an access to myPassword |
334+
| passwords.js:176:17:176:26 | myPasscode | passwords.js:176:17:176:26 | myPasscode | passwords.js:176:17:176:26 | myPasscode | This logs sensitive data returned by $@ as clear text. | passwords.js:176:17:176:26 | myPasscode | an access to myPasscode |
325335
| passwords_in_server_1.js:6:13:6:20 | password | passwords_in_server_1.js:6:13:6:20 | password | passwords_in_server_1.js:6:13:6:20 | password | This logs sensitive data returned by $@ as clear text. | passwords_in_server_1.js:6:13:6:20 | password | an access to password |
326336
| passwords_in_server_2.js:3:13:3:20 | password | passwords_in_server_2.js:3:13:3:20 | password | passwords_in_server_2.js:3:13:3:20 | password | This logs sensitive data returned by $@ as clear text. | passwords_in_server_2.js:3:13:3:20 | password | an access to password |
327337
| passwords_in_server_3.js:2:13:2:20 | password | passwords_in_server_3.js:2:13:2:20 | password | passwords_in_server_3.js:2:13:2:20 | password | This logs sensitive data returned by $@ as clear text. | passwords_in_server_3.js:2:13:2:20 | password | an access to password |

‎javascript/ql/test/query-tests/Security/CWE-312/passwords.js‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -168,4 +168,10 @@ const debug = require('debug')('test');
168168
(function () {
169169
console.log(password.replace(/foo/g, "*")); // NOT OK
170170
debug(password.replace(/foo/g, "*")); // NOT OK
171+
172+
const myPassword = foo();
173+
console.log(myPassword); // NOT OK
174+
175+
const myPasscode = foo();
176+
console.log(myPasscode); // NOT OK
171177
});

‎python/ql/lib/semmle/python/security/internal/SensitiveDataHeuristics.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -103,7 +103,7 @@ module HeuristicNames {
103103
*/
104104
string notSensitiveRegexp() {
105105
result =
106-
"(?is).*([^\\w$.-]|redact|censor|obfuscate|hash|md5|sha|random|((?<!un)(en))?(crypt|code)|certain|concert|secretar|accountant|accountab).*"
106+
"(?is).*([^\\w$.-]|redact|censor|obfuscate|hash|md5|sha|random|((?<!un)(en))?(crypt|(?<!pass)code)|certain|concert|secretar|accountant|accountab).*"
107107
}
108108

109109
/**

‎ruby/ql/lib/codeql/ruby/security/internal/SensitiveDataHeuristics.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -103,7 +103,7 @@ module HeuristicNames {
103103
*/
104104
string notSensitiveRegexp() {
105105
result =
106-
"(?is).*([^\\w$.-]|redact|censor|obfuscate|hash|md5|sha|random|((?<!un)(en))?(crypt|code)|certain|concert|secretar|accountant|accountab).*"
106+
"(?is).*([^\\w$.-]|redact|censor|obfuscate|hash|md5|sha|random|((?<!un)(en))?(crypt|(?<!pass)code)|certain|concert|secretar|accountant|accountab).*"
107107
}
108108

109109
/**

0 commit comments

Comments
 (0)