[DIFF-INFORMED] Java: SensitiveLogging

d10c · d10c · commit 45b627df1d9b · 2025-07-17T19:02:02.000+02:00
https://github.com/d10c/codeql/blob/d10c/diff-informed-phase-3/java/ql/src/Security/CWE/CWE-532/SensitiveInfoLog.ql#L20
diff --git a/java/ql/lib/semmle/code/java/security/SensitiveLoggingQuery.qll b/java/ql/lib/semmle/code/java/security/SensitiveLoggingQuery.qll
@@ -53,6 +53,8 @@ module SensitiveLoggerConfig implements DataFlow::ConfigSig {
   }
 
   predicate isBarrierIn(DataFlow::Node node) { isSource(node) }
+
+  predicate observeDiffInformedIncrementalMode() { any() }
 }
 
 module SensitiveLoggerFlow = TaintTracking::Global<SensitiveLoggerConfig>;

Original file line number	Diff line number	Diff line change
`@@ -53,6 +53,8 @@ module SensitiveLoggerConfig implements DataFlow::ConfigSig {`
`53`	`53`	`}`
`54`	`54`
`55`	`55`	`predicate isBarrierIn(DataFlow::Node node) { isSource(node) }`
	`56`	`+`
	`57`	`+ predicate observeDiffInformedIncrementalMode() { any() }`
`56`	`58`	`}`
`57`	`59`
`58`	`60`	`module SensitiveLoggerFlow = TaintTracking::Global<SensitiveLoggerConfig>;`