Repository navigation
Rust: Do not treat account identifiers as sensitive in cleartext queries - #22981
Open
LucaCappelletti94 wants to merge 2 commits into
Open
LucaCappelletti94 wants to merge 2 commits into
LucaCappelletti94 wants to merge 2 commits into
Conversation
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The account-identifier filters also exclude credential-like names such as session_key and account_key, suppressing cleartext leak detection in logging, database storage, and transmission.
1 open issue
What changed in this PR
This PR reduces account-identifier false positives in Rust’s cleartext security queries while preserving password detection.
Changes:
- Filters identifier-classified sources from logging, database storage, and transmission queries.
- Adds regression cases for ignored identifiers and retained password alerts, with updated expected results.
- Documents the analysis change.
| File | Description |
|---|---|
rust/ql/test/query-tests/security/CWE-312/test_storage.rs |
Adds identifier and password database-storage cases. |
rust/ql/test/query-tests/security/CWE-312/test_logging.rs |
Adds identifier and password logging cases. |
rust/ql/test/query-tests/security/CWE-312/CleartextStorageDatabase.expected |
Updates expected storage alerts and paths. |
rust/ql/test/query-tests/security/CWE-312/CleartextLogging.expected |
Updates expected logging alerts and paths. |
rust/ql/test/query-tests/security/CWE-311/main.rs |
Adds identifier and password transmission cases. |
rust/ql/test/query-tests/security/CWE-311/CleartextTransmission.expected |
Records the new password transmission alert. |
rust/ql/src/change-notes/2026-11-02-cleartext-account-identifiers.md |
Documents reduced account-identifier reporting. |
rust/ql/lib/codeql/rust/security/CleartextTransmissionExtensions.qll |
Filters identifier-classified transmission sources. |
rust/ql/lib/codeql/rust/security/CleartextStorageDatabaseExtensions.qll |
Filters identifier-classified database-storage sources. |
rust/ql/lib/codeql/rust/security/CleartextLoggingExtensions.qll |
Filters identifier-classified logging sources. |
Review effort: Max (auto)
| private class SensitiveDataAsSource extends Source instanceof SensitiveData { } | ||
| private class SensitiveDataAsSource extends Source instanceof SensitiveData { | ||
| SensitiveDataAsSource() { | ||
| SensitiveData.super.getClassification() != SensitiveDataClassification::id() |
Contributor
Author
There was a problem hiding this comment.
session_key, sessionkey, account_key and accnt_key are now classified as secrets in the shared heuristics, so the three Rust queries still report them. The Rust sensitive data test and a new session_key case in the logging test cover this. JavaScript, Python, Ruby and Swift already excluded id, so they now report these names too.
github-actions
Bot
added
documentation
Rust
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Rust's cleartext logging, storage and transmission queries report any value whose name looks like an account identifier, such as
user_id,usernameor anything containinguuid. For example, writing a variable nameduser_uuidto a log is reported as cleartext logging of sensitive data.The same queries for JavaScript, Python, Ruby and Swift do not treat account identifiers as sensitive, and neither does Rust's own
rust/weak-sensitive-data-hashing. This PR makes the three Rust cleartext queries ignore them too. A value whose name also suggests a password, such asaccount_password, is still reported.Names like
session_keyandaccount_keywere classified only as account identifiers, so the shared heuristics now classify them as secrets and they stay reported in every language.