Skip to content

Commit 99e62d6

Browse files
geoffw0geoffw0
committed
Rust: Add sensitive data patterns.
1 parent 2cd4d98 commit 99e62d6

File tree

2 files changed

+43
-36
lines changed

2 files changed

+43
-36
lines changed

‎rust/ql/lib/codeql/rust/security/internal/SensitiveDataHeuristics.qll

Lines changed: 15 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,9 @@ module HeuristicNames {
5454
* Gets a regular expression that identifies strings that may indicate the presence of secret
5555
* or trusted data.
5656
*/
57-
string maybeSecret() { result = "(?is).*((?<!is|is_)secret|(?<!un|un_|is|is_)trusted).*" }
57+
string maybeSecret() {
58+
result = "(?is).*((?<!is|is_)secret|(?<!un|un_|is|is_)trusted|confidential).*"
59+
}
5860

5961
/**
6062
* Gets a regular expression that identifies strings that may indicate the presence of
@@ -72,7 +74,10 @@ module HeuristicNames {
7274
*/
7375
string maybePassword() {
7476
result = "(?is).*pass(wd|word|code|.?phrase)(?!.*question).*" or
75-
result = "(?is).*(auth(entication|ori[sz]ation)?).?key.*"
77+
result = "(?is).*(auth(entication|ori[sz]ation)?).?key.*" or
78+
result = "(?is).*([_-]|\\b)mfa([_-]|\\b).*" or
79+
result = "(?is).*oauth.*" or
80+
result = "(?is).*api.?(key|token).*"
7681
}
7782

7883
/**
@@ -88,7 +93,7 @@ module HeuristicNames {
8893
string maybePrivate() {
8994
result =
9095
"(?is).*(" +
91-
// Inspired by the list on https://cwe.mitre.org/data/definitions/359.html
96+
// Inspired by multiple sources including the list on https://cwe.mitre.org/data/definitions/359.html
9297
// Government identifiers, such as Social Security Numbers
9398
"social.?security|employer.?identification|national.?insurance|resident.?id|" +
9499
"passport.?(num|no)|([_-]|\\b)ssn([_-]|\\b)|" +
@@ -100,17 +105,19 @@ module HeuristicNames {
100105
// Geographic location - where the user is (or was)
101106
"latitude|longitude|nationality|" +
102107
// Financial data - such as credit card numbers, salary, bank accounts, and debts
103-
"(credit|debit|bank|visa).?(card|num|no|acc(ou)?nt)|acc(ou)?nt.?(no|num|credit)|" +
104-
"salary|billing|credit.?(rating|score)|([_-]|\\b)ccn([_-]|\\b)|" +
108+
"(credit|debit|bank|visa).?(card|num|no|acc(ou)?nt)|acc(ou)?nt.?(no|num|credit)|routing.?num|" +
109+
"salary|billing|beneficiary|credit.?(rating|score)|([_-]|\\b)(ccn|cvv|iban)([_-]|\\b)|" +
105110
// Communications - e-mail addresses, private e-mail messages, SMS text messages, chat logs, etc.
106111
// "e(mail|_mail)|" + // this seems too noisy
107112
// Health - medical conditions, insurance status, prescription records
108-
"birth.?da(te|y)|da(te|y).?(of.?)?birth|" +
109-
"medical|(health|care).?plan|healthkit|appointment|prescription|" +
113+
"birth.?da(te|y)|da(te|y).?(of.?)?birth|gender|([_-]|\\b)sex([_-]|\\b)|" +
114+
"medical|(health|care).?plan|healthkit|appointment|prescription|patient.?(id|record)|" +
110115
"blood.?(type|alcohol|glucose|pressure)|heart.?(rate|rhythm)|body.?(mass|fat)|" +
111116
"menstrua|pregnan|insulin|inhaler|" +
112117
// Relationships - work and family
113-
"employ(er|ee)|spouse|maiden.?name" +
118+
"employ(er|ee)|spouse|maiden.?name|" +
119+
// Device information
120+
"([_-]|\\b)ip.?addr|mac.?addr|finger.?print" +
114121
// ---
115122
").*"
116123
}

‎rust/ql/test/library-tests/sensitivedata/test.rs

Lines changed: 28 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -48,12 +48,12 @@ fn test_passwords(
4848
sink(authentication_key); // $ sensitive=password
4949
sink(authenticationkey); // $ sensitive=password
5050
sink(authenticationKey); // $ sensitive=password
51-
sink(oauth); // $ MISSING: sensitive=password
51+
sink(oauth); // $ sensitive=password
5252
sink(one_time_code); // $ MISSING: sensitive=password
5353

5454
sink(ms); // $ MISSING: sensitive=password
5555
sink(ms.password.as_str()); // $ sensitive=password
56-
sink(ms.mfa.as_str()); // $ MISSING: sensitive=password
56+
sink(ms.mfa.as_str()); // $ sensitive=password
5757

5858
sink(get_password()); // $ sensitive=password
5959
let password2 = get_string();
@@ -160,16 +160,16 @@ impl DeviceInfo {
160160
fn test_device_info(&self, other: &DeviceInfo) {
161161
// private device info
162162

163-
sink(&self.api_key); // $ MISSING: sensitive=id
164-
sink(&other.api_key); // $ MISSING: sensitive=id
165-
sink(&self.deviceApiToken); // $ MISSING: sensitive=id
166-
sink(&self.finger_print); // $ MISSING: sensitive=id
167-
sink(&self.ip_address); // $ MISSING: sensitive=id
168-
sink(self.macaddr12); // $ MISSING: sensitive=id
169-
sink(&self.mac_addr); // $ MISSING: sensitive=id
170-
sink(self.mac_addr.values); // $ MISSING: sensitive=id
171-
sink(self.mac_addr.values[0]); // $ MISSING: sensitive=id
172-
sink(&self.networkMacAddress); // $ MISSING: sensitive=id
163+
sink(&self.api_key); // $ sensitive=password
164+
sink(&other.api_key); // $ sensitive=password
165+
sink(&self.deviceApiToken); // $ sensitive=password
166+
sink(&self.finger_print); // $ sensitive=private
167+
sink(&self.ip_address); // $ sensitive=private
168+
sink(self.macaddr12); // $ sensitive=private
169+
sink(&self.mac_addr); // $ sensitive=private
170+
sink(self.mac_addr.values); // $ sensitive=private
171+
sink(self.mac_addr.values[0]); // $ sensitive=private
172+
sink(&self.networkMacAddress); // $ sensitive=private
173173

174174
// not private device info
175175

@@ -267,26 +267,26 @@ fn test_private_info(
267267
sink(info.emergency_contact.as_str()); // $ sensitive=private
268268
sink(info.name_of_employer.as_str()); // $ sensitive=private
269269

270-
sink(&info.gender); // $ MISSING: sensitive=private
271-
sink(info.genderString.as_str()); // $ MISSING: sensitive=private
270+
sink(&info.gender); // $ sensitive=private
271+
sink(info.genderString.as_str()); // $ sensitive=private
272272
let sex = "Male";
273273
let gender = Gender::Female;
274274
let a = Gender::Female;
275-
sink(sex); // $ MISSING: sensitive=private
276-
sink(gender); // $ MISSING: sensitive=private
275+
sink(sex); // $ sensitive=private
276+
sink(gender); // $ sensitive=private
277277
sink(a); // $ MISSING: sensitive=private
278278

279-
sink(info.patient_id); // $ MISSING: sensitive=private
280-
sink(info.linkedPatientId); // $ MISSING: sensitive=private
281-
sink(info.patient_record.as_str()); // $ MISSING: sensitive=private
282-
sink(info.patient_record.trim()); // $ MISSING: sensitive=private
279+
sink(info.patient_id); // $ sensitive=private
280+
sink(info.linkedPatientId); // $ sensitive=private
281+
sink(info.patient_record.as_str()); // $ sensitive=private
282+
sink(info.patient_record.trim()); // $ sensitive=private
283283
sink(&info.medical_notes); // $ sensitive=private
284284
sink(info.medical_notes[0].as_str()); // $ sensitive=private
285285
for n in info.medical_notes.iter() {
286286
sink(n.as_str()); // $ MISSING: sensitive=private
287287
}
288-
sink(info.confidentialMessage.as_str()); // $ MISSING: sensitive=private
289-
sink(info.confidentialMessage.to_lowercase()); // $ MISSING: sensitive=private
288+
sink(info.confidentialMessage.as_str()); // $ sensitive=secret
289+
sink(info.confidentialMessage.to_lowercase()); // $ sensitive=secret
290290

291291
sink(info.latitude); // $ sensitive=private
292292
let x = info.longitude.unwrap();
@@ -296,12 +296,12 @@ fn test_private_info(
296296
sink(info.financials.credit_card_no.as_str()); // $ sensitive=private
297297
sink(info.financials.credit_rating); // $ sensitive=private
298298
sink(info.financials.user_ccn.as_str()); // $ sensitive=private
299-
sink(info.financials.cvv.as_str()); // $ MISSING: sensitive=private
300-
sink(info.financials.beneficiary.as_str()); // $ MISSING: sensitive=private
301-
sink(info.financials.routing_number); // $ MISSING: sensitive=private
302-
sink(info.financials.routingNumberText.as_str()); // $ MISSING: sensitive=private
303-
sink(info.financials.iban.as_str()); // $ MISSING: sensitive=private
304-
sink(info.financials.iBAN.as_str()); // $ MISSING: sensitive=private
299+
sink(info.financials.cvv.as_str()); // $ sensitive=private
300+
sink(info.financials.beneficiary.as_str()); // $ sensitive=private
301+
sink(info.financials.routing_number); // $ sensitive=private
302+
sink(info.financials.routingNumberText.as_str()); // $ sensitive=private
303+
sink(info.financials.iban.as_str()); // $ sensitive=private
304+
sink(info.financials.iBAN.as_str()); // $ sensitive=private
305305

306306
sink(ContactDetails::HomePhoneNumber("123".to_string())); // $ sensitive=private
307307
sink(ContactDetails::MobileNumber("123".to_string())); // $ sensitive=private

0 commit comments

Comments
 (0)