Skip to content

Rust: Do not treat account identifiers as sensitive in cleartext queries #22981

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
LucaCappelletti94 wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Rust: Do not treat account identifiers as sensitive in cleartext queries #22981

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2fd9dd7
Rust: Do not treat account identifiers as sensitive in cleartext queries
LucaCappelletti94 Nov 2, 2026
166e57c
Shared: Classify session and account keys as secrets
LucaCappelletti94 Nov 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion rust/ql/lib/codeql/rust/security/CleartextLoggingExtensions.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,11 @@ module CleartextLogging {
/**
* Sensitive data, considered as a flow source.
*/
private class SensitiveDataAsSource extends Source instanceof SensitiveData { }
private class SensitiveDataAsSource extends Source instanceof SensitiveData {
SensitiveDataAsSource() {
SensitiveData.super.getClassification() != SensitiveDataClassification::id()

@LucaCappelletti94 LucaCappelletti94 Nov 2, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

session_key, sessionkey, account_key and accnt_key are now classified as secrets in the shared heuristics, so the three Rust queries still report them. The Rust sensitive data test and a new session_key case in the logging test cover this. JavaScript, Python, Ruby and Swift already excluded id, so they now report these names too.

}
}

/**
* A sink for logging from model data.
Expand Down
6 changes: 5 additions & 1 deletion rust/ql/lib/codeql/rust/security/CleartextStorageDatabaseExtensions.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,11 @@ module CleartextStorageDatabase {
/**
* Sensitive data, considered as a flow source.
*/
private class SensitiveDataAsSource extends Source instanceof SensitiveData { }
private class SensitiveDataAsSource extends Source instanceof SensitiveData {
SensitiveDataAsSource() {
SensitiveData.super.getClassification() != SensitiveDataClassification::id()
}
}

/**
* A sink for cleartext storage vulnerabilities from model data.
Expand Down
6 changes: 5 additions & 1 deletion rust/ql/lib/codeql/rust/security/CleartextTransmissionExtensions.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,7 +48,11 @@ module CleartextTransmission {
/**
* Sensitive data, considered as a flow source.
*/
private class SensitiveDataAsSource extends Source instanceof SensitiveData { }
private class SensitiveDataAsSource extends Source instanceof SensitiveData {
SensitiveDataAsSource() {
SensitiveData.super.getClassification() != SensitiveDataClassification::id()
}
}

/**
* A sink defined through MaD.
Expand Down
4 changes: 4 additions & 0 deletions rust/ql/src/change-notes/2026-11-02-cleartext-account-identifiers.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
---
category: minorAnalysis
---
* The `rust/cleartext-logging`, `rust/cleartext-storage-database` and `rust/cleartext-transmission` queries no longer treat account identifiers, such as user IDs and UUIDs, as sensitive data.
8 changes: 4 additions & 4 deletions rust/ql/test/library-tests/sensitivedata/test.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -105,8 +105,8 @@ fn test_credentials(
) {
// credentials

sink(account_key); // $ sensitive=id
sink(accnt_key); // $ sensitive=id
sink(account_key); // $ sensitive=secret
sink(accnt_key); // $ sensitive=secret
sink(license_key); // $ MISSING: sensitive=secret
sink(secret_key); // $ sensitive=secret

Expand All @@ -116,8 +116,8 @@ fn test_credentials(
sink(user_id); // $ sensitive=id
sink(my_user_id_64); // $ sensitive=id

sink(sessionkey); // $ sensitive=id
sink(session_key); // $ sensitive=id
sink(sessionkey); // $ sensitive=secret
sink(session_key); // $ sensitive=secret

sink(ms.get_certificate()); // $ sensitive=certificate

Expand Down
14 changes: 14 additions & 0 deletions rust/ql/test/query-tests/security/CWE-311/CleartextTransmission.expected
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@
| main.rs:21:17:21:19 | url | main.rs:19:50:19:57 | password | main.rs:21:17:21:19 | url | This 'url' operation transmits data which may contain unencrypted sensitive data from $@. | main.rs:19:50:19:57 | password | password |
| main.rs:28:33:28:35 | url | main.rs:26:50:26:57 | password | main.rs:28:33:28:35 | url | This 'url' operation transmits data which may contain unencrypted sensitive data from $@. | main.rs:26:50:26:57 | password | password |
| main.rs:35:33:35:35 | url | main.rs:33:50:33:57 | password | main.rs:35:33:35:35 | url | This 'url' operation transmits data which may contain unencrypted sensitive data from $@. | main.rs:33:50:33:57 | password | password |
| main.rs:45:28:45:30 | url | main.rs:44:50:44:65 | account_password | main.rs:45:28:45:30 | url | This 'url' operation transmits data which may contain unencrypted sensitive data from $@. | main.rs:44:50:44:65 | account_password | account_password |
edges
| main.rs:6:9:6:11 | url | main.rs:7:28:7:30 | url | provenance | Sink:MaD:4 |
| main.rs:6:23:6:57 | ...::format(...) | main.rs:6:23:6:57 | { ... } | provenance | |
Expand Down Expand Up @@ -40,6 +41,12 @@ edges
| main.rs:33:23:33:57 | MacroExpr | main.rs:33:23:33:57 | ...::format(...) | provenance | MaD:7 |
| main.rs:33:23:33:57 | { ... } | main.rs:33:23:33:57 | ...::must_use(...) | provenance | MaD:8 |
| main.rs:33:50:33:57 | password | main.rs:33:23:33:57 | MacroExpr | provenance | |
| main.rs:44:9:44:11 | url | main.rs:45:28:45:30 | url | provenance | Sink:MaD:4 |
| main.rs:44:23:44:65 | ...::format(...) | main.rs:44:23:44:65 | { ... } | provenance | |
| main.rs:44:23:44:65 | ...::must_use(...) | main.rs:44:9:44:11 | url | provenance | |
| main.rs:44:23:44:65 | MacroExpr | main.rs:44:23:44:65 | ...::format(...) | provenance | MaD:7 |
| main.rs:44:23:44:65 | { ... } | main.rs:44:23:44:65 | ...::must_use(...) | provenance | MaD:8 |
| main.rs:44:50:44:65 | account_password | main.rs:44:23:44:65 | MacroExpr | provenance | |
models
| 1 | Sink: <reqwest::async_impl::client::Client>::post; Argument[0]; request-url |
| 2 | Sink: <reqwest::async_impl::client::Client>::request; Argument[1]; request-url |
Expand Down Expand Up @@ -90,4 +97,11 @@ nodes
| main.rs:33:23:33:57 | { ... } | semmle.label | { ... } |
| main.rs:33:50:33:57 | password | semmle.label | password |
| main.rs:35:33:35:35 | url | semmle.label | url |
| main.rs:44:9:44:11 | url | semmle.label | url |
| main.rs:44:23:44:65 | ...::format(...) | semmle.label | ...::format(...) |
| main.rs:44:23:44:65 | ...::must_use(...) | semmle.label | ...::must_use(...) |
| main.rs:44:23:44:65 | MacroExpr | semmle.label | MacroExpr |
| main.rs:44:23:44:65 | { ... } | semmle.label | { ... } |
| main.rs:44:50:44:65 | account_password | semmle.label | account_password |
| main.rs:45:28:45:30 | url | semmle.label | url |
subpaths
11 changes: 11 additions & 0 deletions rust/ql/test/query-tests/security/CWE-311/main.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,10 +35,21 @@ fn request_put_with_password_in_url() {
client.request(Method::PUT, url).body("body").send(); // $ Alert[rust/cleartext-transmission]
}

fn get_with_account_identifiers_in_url() {
let user_uuid = "uuid";
let url = format!("example.com?user={}", user_uuid);
reqwest::blocking::get(url).unwrap().text().unwrap();

let account_password = "Hunter12";
let url = format!("example.com?password={}", account_password); // $ Source
reqwest::blocking::get(url).unwrap().text().unwrap(); // $ Alert[rust/cleartext-transmission]
}

fn main() {
get_with_password_in_url();
get_with_password_in_constructed_url();
post_with_password_in_url();
request_blocking_put_with_password_in_url();
request_put_with_password_in_url();
get_with_account_identifiers_in_url();
}
20 changes: 14 additions & 6 deletions rust/ql/test/query-tests/security/CWE-312/CleartextLogging.expected
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,9 @@
| test_logging.rs:245:20:245:65 | ... .as_bytes() | test_logging.rs:245:46:245:53 | password | test_logging.rs:245:20:245:65 | ... .as_bytes() | This operation writes $@ to a log file. | test_logging.rs:245:46:245:53 | password | password |
| test_logging.rs:248:15:248:60 | ... .as_bytes() | test_logging.rs:248:41:248:48 | password | test_logging.rs:248:15:248:60 | ... .as_bytes() | This operation writes $@ to a log file. | test_logging.rs:248:41:248:48 | password | password |
| test_logging.rs:251:15:251:60 | ... .as_bytes() | test_logging.rs:251:41:251:48 | password | test_logging.rs:251:15:251:60 | ... .as_bytes() | This operation writes $@ to a log file. | test_logging.rs:251:41:251:48 | password | password |
| test_logging.rs:290:11:290:31 | MacroExpr | test_logging.rs:289:17:289:39 | get_password_or_error(...) | test_logging.rs:290:11:290:31 | MacroExpr | This operation writes $@ to a log file. | test_logging.rs:289:17:289:39 | get_password_or_error(...) | get_password_or_error(...) |
| test_logging.rs:276:11:276:42 | MacroExpr | test_logging.rs:276:27:276:42 | account_password | test_logging.rs:276:11:276:42 | MacroExpr | This operation writes $@ to a log file. | test_logging.rs:276:27:276:42 | account_password | account_password |
| test_logging.rs:277:11:277:37 | MacroExpr | test_logging.rs:277:27:277:37 | session_key | test_logging.rs:277:11:277:37 | MacroExpr | This operation writes $@ to a log file. | test_logging.rs:277:27:277:37 | session_key | session_key |
| test_logging.rs:296:11:296:31 | MacroExpr | test_logging.rs:295:17:295:39 | get_password_or_error(...) | test_logging.rs:296:11:296:31 | MacroExpr | This operation writes $@ to a log file. | test_logging.rs:295:17:295:39 | get_password_or_error(...) | get_password_or_error(...) |
edges
| test_logging.rs:42:28:42:35 | password | test_logging.rs:42:12:42:35 | MacroExpr | provenance | Sink:MaD:11 |
| test_logging.rs:43:28:43:35 | password | test_logging.rs:43:12:43:35 | MacroExpr | provenance | Sink:MaD:11 |
Expand Down Expand Up @@ -226,8 +228,10 @@ edges
| test_logging.rs:251:23:251:48 | MacroExpr | test_logging.rs:251:23:251:48 | ...::format(...) | provenance | MaD:20 |
| test_logging.rs:251:23:251:48 | { ... } | test_logging.rs:251:23:251:48 | ...::must_use(...) | provenance | MaD:21 |
| test_logging.rs:251:41:251:48 | password | test_logging.rs:251:23:251:48 | MacroExpr | provenance | |
| test_logging.rs:289:9:289:13 | value | test_logging.rs:290:11:290:31 | MacroExpr | provenance | Sink:MaD:11 |
| test_logging.rs:289:17:289:39 | get_password_or_error(...) | test_logging.rs:289:9:289:13 | value | provenance | |
| test_logging.rs:276:27:276:42 | account_password | test_logging.rs:276:11:276:42 | MacroExpr | provenance | Sink:MaD:11 |
| test_logging.rs:277:27:277:37 | session_key | test_logging.rs:277:11:277:37 | MacroExpr | provenance | Sink:MaD:11 |
| test_logging.rs:295:9:295:13 | value | test_logging.rs:296:11:296:31 | MacroExpr | provenance | Sink:MaD:11 |
| test_logging.rs:295:17:295:39 | get_password_or_error(...) | test_logging.rs:295:9:295:13 | value | provenance | |
models
| 1 | Sink: <core::option::Option as log_err::LogErrOption>::log_expect; Argument[0]; log-injection |
| 2 | Sink: <core::option::Option>::expect; Argument[0]; log-injection |
Expand Down Expand Up @@ -465,7 +469,11 @@ nodes
| test_logging.rs:251:23:251:48 | MacroExpr | semmle.label | MacroExpr |
| test_logging.rs:251:23:251:48 | { ... } | semmle.label | { ... } |
| test_logging.rs:251:41:251:48 | password | semmle.label | password |
| test_logging.rs:289:9:289:13 | value | semmle.label | value |
| test_logging.rs:289:17:289:39 | get_password_or_error(...) | semmle.label | get_password_or_error(...) |
| test_logging.rs:290:11:290:31 | MacroExpr | semmle.label | MacroExpr |
| test_logging.rs:276:11:276:42 | MacroExpr | semmle.label | MacroExpr |
| test_logging.rs:276:27:276:42 | account_password | semmle.label | account_password |
| test_logging.rs:277:11:277:37 | MacroExpr | semmle.label | MacroExpr |
| test_logging.rs:277:27:277:37 | session_key | semmle.label | session_key |
| test_logging.rs:295:9:295:13 | value | semmle.label | value |
| test_logging.rs:295:17:295:39 | get_password_or_error(...) | semmle.label | get_password_or_error(...) |
| test_logging.rs:296:11:296:31 | MacroExpr | semmle.label | MacroExpr |
subpaths
Loading