Skip to content

Commit 5f4bc41

Browse files
joefarebrotherjoefarebrother
committed
Add private category to sensitive data heuristics
1 parent b86aeb6 commit 5f4bc41

File tree

4 files changed

+168
-4
lines changed

4 files changed

+168
-4
lines changed

‎javascript/ql/lib/semmle/javascript/security/internal/SensitiveDataHeuristics.qll‎

Lines changed: 42 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,13 +14,14 @@
1414
* - id: a user name or other account information;
1515
* - password: a password or authorization key;
1616
* - certificate: a certificate.
17+
* - private: private data such as credit card numbers
1718
*
1819
* While classifications are represented as strings, this should not be relied upon.
1920
* Instead, use the predicates in `SensitiveDataClassification::` to work with
2021
* classifications.
2122
*/
2223
class SensitiveDataClassification extends string {
23-
SensitiveDataClassification() { this in ["secret", "id", "password", "certificate"] }
24+
SensitiveDataClassification() { this in ["secret", "id", "password", "certificate", "private"] }
2425
}
2526

2627
/**
@@ -38,6 +39,9 @@ module SensitiveDataClassification {
3839

3940
/** Gets the classification for certificates. */
4041
SensitiveDataClassification certificate() { result = "certificate" }
42+
43+
/** Gets the classification for private data. */
44+
SensitiveDataClassification private() { result = "private" }
4145
}
4246

4347
/**
@@ -77,6 +81,40 @@ module HeuristicNames {
7781
*/
7882
string maybeCertificate() { result = "(?is).*(cert)(?!.*(format|name|ification)).*" }
7983

84+
/**
85+
* Gets a regular expression that identifies strings that may indicate the presence of
86+
* private data.
87+
*/
88+
string maybePrivate() {
89+
result =
90+
"(?is).*(" +
91+
// Inspired by the list on https://cwe.mitre.org/data/definitions/359.html
92+
// Government identifiers, such as Social Security Numbers
93+
"social.?security|employer.?identification|national.?insurance|resident.?id|" +
94+
"passport.?(num|no)|([_-]|\\b)ssn([_-]|\\b)|" +
95+
// Contact information, such as home addresses
96+
"post.?code|zip.?code|home.?addr|" +
97+
// and telephone numbers
98+
"(mob(ile)?|home).?(num|no|tel|phone)|(tel|fax|phone).?(num|no)|telephone|" +
99+
"emergency.?contact|" +
100+
// Geographic location - where the user is (or was)
101+
"l(atitude|ongitude)|nationality|" +
102+
// Financial data - such as credit card numbers, salary, bank accounts, and debts
103+
"(credit|debit|bank|visa).?(card|num|no|acc(ou?)nt)|acc(ou)?nt.?(no|num|credit)|" +
104+
"salary|billing|credit.?(rating|score)|([_-]|\\b)ccn([_-]|\\b)" +
105+
// Communications - e-mail addresses, private e-mail messages, SMS text messages, chat logs, etc.
106+
// "e(mail|_mail)|" + // this seems too noisy
107+
// Health - medical conditions, insurance status, prescription records
108+
"birth.?da(te|y)|da(te|y).?(of.?)?birth|" +
109+
"medical|(health|care).?plan|healthkit|appointment|prescription|" +
110+
"blood.?(type|alcohol|glucose|pressure)|heart.?(rate|rhythm)|body.?(mass|fat)|" +
111+
"menstrua|pregnan|insulin|inhaler|" +
112+
// Relationships - work and family
113+
"employ(er|ee)|spouse|maiden.?name" +
114+
// ---
115+
").*"
116+
}
117+
80118
/**
81119
* Gets a regular expression that identifies strings that may indicate the presence
82120
* of sensitive data, with `classification` describing the kind of sensitive data involved.
@@ -90,6 +128,9 @@ module HeuristicNames {
90128
or
91129
result = maybeCertificate() and
92130
classification = SensitiveDataClassification::certificate()
131+
or
132+
result = maybePrivate() and
133+
classification = SensitiveDataClassification::private()
93134
}
94135

95136
/**

‎python/ql/lib/semmle/python/security/internal/SensitiveDataHeuristics.qll‎

Lines changed: 42 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,13 +14,14 @@
1414
* - id: a user name or other account information;
1515
* - password: a password or authorization key;
1616
* - certificate: a certificate.
17+
* - private: private data such as credit card numbers
1718
*
1819
* While classifications are represented as strings, this should not be relied upon.
1920
* Instead, use the predicates in `SensitiveDataClassification::` to work with
2021
* classifications.
2122
*/
2223
class SensitiveDataClassification extends string {
23-
SensitiveDataClassification() { this in ["secret", "id", "password", "certificate"] }
24+
SensitiveDataClassification() { this in ["secret", "id", "password", "certificate", "private"] }
2425
}
2526

2627
/**
@@ -38,6 +39,9 @@ module SensitiveDataClassification {
3839

3940
/** Gets the classification for certificates. */
4041
SensitiveDataClassification certificate() { result = "certificate" }
42+
43+
/** Gets the classification for private data. */
44+
SensitiveDataClassification private() { result = "private" }
4145
}
4246

4347
/**
@@ -77,6 +81,40 @@ module HeuristicNames {
7781
*/
7882
string maybeCertificate() { result = "(?is).*(cert)(?!.*(format|name|ification)).*" }
7983

84+
/**
85+
* Gets a regular expression that identifies strings that may indicate the presence of
86+
* private data.
87+
*/
88+
string maybePrivate() {
89+
result =
90+
"(?is).*(" +
91+
// Inspired by the list on https://cwe.mitre.org/data/definitions/359.html
92+
// Government identifiers, such as Social Security Numbers
93+
"social.?security|employer.?identification|national.?insurance|resident.?id|" +
94+
"passport.?(num|no)|([_-]|\\b)ssn([_-]|\\b)|" +
95+
// Contact information, such as home addresses
96+
"post.?code|zip.?code|home.?addr|" +
97+
// and telephone numbers
98+
"(mob(ile)?|home).?(num|no|tel|phone)|(tel|fax|phone).?(num|no)|telephone|" +
99+
"emergency.?contact|" +
100+
// Geographic location - where the user is (or was)
101+
"l(atitude|ongitude)|nationality|" +
102+
// Financial data - such as credit card numbers, salary, bank accounts, and debts
103+
"(credit|debit|bank|visa).?(card|num|no|acc(ou?)nt)|acc(ou)?nt.?(no|num|credit)|" +
104+
"salary|billing|credit.?(rating|score)|([_-]|\\b)ccn([_-]|\\b)" +
105+
// Communications - e-mail addresses, private e-mail messages, SMS text messages, chat logs, etc.
106+
// "e(mail|_mail)|" + // this seems too noisy
107+
// Health - medical conditions, insurance status, prescription records
108+
"birth.?da(te|y)|da(te|y).?(of.?)?birth|" +
109+
"medical|(health|care).?plan|healthkit|appointment|prescription|" +
110+
"blood.?(type|alcohol|glucose|pressure)|heart.?(rate|rhythm)|body.?(mass|fat)|" +
111+
"menstrua|pregnan|insulin|inhaler|" +
112+
// Relationships - work and family
113+
"employ(er|ee)|spouse|maiden.?name" +
114+
// ---
115+
").*"
116+
}
117+
80118
/**
81119
* Gets a regular expression that identifies strings that may indicate the presence
82120
* of sensitive data, with `classification` describing the kind of sensitive data involved.
@@ -90,6 +128,9 @@ module HeuristicNames {
90128
or
91129
result = maybeCertificate() and
92130
classification = SensitiveDataClassification::certificate()
131+
or
132+
result = maybePrivate() and
133+
classification = SensitiveDataClassification::private()
93134
}
94135

95136
/**

‎ruby/ql/lib/codeql/ruby/security/internal/SensitiveDataHeuristics.qll‎

Lines changed: 42 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,13 +14,14 @@
1414
* - id: a user name or other account information;
1515
* - password: a password or authorization key;
1616
* - certificate: a certificate.
17+
* - private: private data such as credit card numbers
1718
*
1819
* While classifications are represented as strings, this should not be relied upon.
1920
* Instead, use the predicates in `SensitiveDataClassification::` to work with
2021
* classifications.
2122
*/
2223
class SensitiveDataClassification extends string {
23-
SensitiveDataClassification() { this in ["secret", "id", "password", "certificate"] }
24+
SensitiveDataClassification() { this in ["secret", "id", "password", "certificate", "private"] }
2425
}
2526

2627
/**
@@ -38,6 +39,9 @@ module SensitiveDataClassification {
3839

3940
/** Gets the classification for certificates. */
4041
SensitiveDataClassification certificate() { result = "certificate" }
42+
43+
/** Gets the classification for private data. */
44+
SensitiveDataClassification private() { result = "private" }
4145
}
4246

4347
/**
@@ -77,6 +81,40 @@ module HeuristicNames {
7781
*/
7882
string maybeCertificate() { result = "(?is).*(cert)(?!.*(format|name|ification)).*" }
7983

84+
/**
85+
* Gets a regular expression that identifies strings that may indicate the presence of
86+
* private data.
87+
*/
88+
string maybePrivate() {
89+
result =
90+
"(?is).*(" +
91+
// Inspired by the list on https://cwe.mitre.org/data/definitions/359.html
92+
// Government identifiers, such as Social Security Numbers
93+
"social.?security|employer.?identification|national.?insurance|resident.?id|" +
94+
"passport.?(num|no)|([_-]|\\b)ssn([_-]|\\b)|" +
95+
// Contact information, such as home addresses
96+
"post.?code|zip.?code|home.?addr|" +
97+
// and telephone numbers
98+
"(mob(ile)?|home).?(num|no|tel|phone)|(tel|fax|phone).?(num|no)|telephone|" +
99+
"emergency.?contact|" +
100+
// Geographic location - where the user is (or was)
101+
"l(atitude|ongitude)|nationality|" +
102+
// Financial data - such as credit card numbers, salary, bank accounts, and debts
103+
"(credit|debit|bank|visa).?(card|num|no|acc(ou?)nt)|acc(ou)?nt.?(no|num|credit)|" +
104+
"salary|billing|credit.?(rating|score)|([_-]|\\b)ccn([_-]|\\b)" +
105+
// Communications - e-mail addresses, private e-mail messages, SMS text messages, chat logs, etc.
106+
// "e(mail|_mail)|" + // this seems too noisy
107+
// Health - medical conditions, insurance status, prescription records
108+
"birth.?da(te|y)|da(te|y).?(of.?)?birth|" +
109+
"medical|(health|care).?plan|healthkit|appointment|prescription|" +
110+
"blood.?(type|alcohol|glucose|pressure)|heart.?(rate|rhythm)|body.?(mass|fat)|" +
111+
"menstrua|pregnan|insulin|inhaler|" +
112+
// Relationships - work and family
113+
"employ(er|ee)|spouse|maiden.?name" +
114+
// ---
115+
").*"
116+
}
117+
80118
/**
81119
* Gets a regular expression that identifies strings that may indicate the presence
82120
* of sensitive data, with `classification` describing the kind of sensitive data involved.
@@ -90,6 +128,9 @@ module HeuristicNames {
90128
or
91129
result = maybeCertificate() and
92130
classification = SensitiveDataClassification::certificate()
131+
or
132+
result = maybePrivate() and
133+
classification = SensitiveDataClassification::private()
93134
}
94135

95136
/**

‎swift/ql/lib/codeql/swift/security/internal/SensitiveDataHeuristics.qll‎

Lines changed: 42 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,13 +14,14 @@
1414
* - id: a user name or other account information;
1515
* - password: a password or authorization key;
1616
* - certificate: a certificate.
17+
* - private: private data such as credit card numbers
1718
*
1819
* While classifications are represented as strings, this should not be relied upon.
1920
* Instead, use the predicates in `SensitiveDataClassification::` to work with
2021
* classifications.
2122
*/
2223
class SensitiveDataClassification extends string {
23-
SensitiveDataClassification() { this in ["secret", "id", "password", "certificate"] }
24+
SensitiveDataClassification() { this in ["secret", "id", "password", "certificate", "private"] }
2425
}
2526

2627
/**
@@ -38,6 +39,9 @@ module SensitiveDataClassification {
3839

3940
/** Gets the classification for certificates. */
4041
SensitiveDataClassification certificate() { result = "certificate" }
42+
43+
/** Gets the classification for private data. */
44+
SensitiveDataClassification private() { result = "private" }
4145
}
4246

4347
/**
@@ -77,6 +81,40 @@ module HeuristicNames {
7781
*/
7882
string maybeCertificate() { result = "(?is).*(cert)(?!.*(format|name|ification)).*" }
7983

84+
/**
85+
* Gets a regular expression that identifies strings that may indicate the presence of
86+
* private data.
87+
*/
88+
string maybePrivate() {
89+
result =
90+
"(?is).*(" +
91+
// Inspired by the list on https://cwe.mitre.org/data/definitions/359.html
92+
// Government identifiers, such as Social Security Numbers
93+
"social.?security|employer.?identification|national.?insurance|resident.?id|" +
94+
"passport.?(num|no)|([_-]|\\b)ssn([_-]|\\b)|" +
95+
// Contact information, such as home addresses
96+
"post.?code|zip.?code|home.?addr|" +
97+
// and telephone numbers
98+
"(mob(ile)?|home).?(num|no|tel|phone)|(tel|fax|phone).?(num|no)|telephone|" +
99+
"emergency.?contact|" +
100+
// Geographic location - where the user is (or was)
101+
"l(atitude|ongitude)|nationality|" +
102+
// Financial data - such as credit card numbers, salary, bank accounts, and debts
103+
"(credit|debit|bank|visa).?(card|num|no|acc(ou?)nt)|acc(ou)?nt.?(no|num|credit)|" +
104+
"salary|billing|credit.?(rating|score)|([_-]|\\b)ccn([_-]|\\b)" +
105+
// Communications - e-mail addresses, private e-mail messages, SMS text messages, chat logs, etc.
106+
// "e(mail|_mail)|" + // this seems too noisy
107+
// Health - medical conditions, insurance status, prescription records
108+
"birth.?da(te|y)|da(te|y).?(of.?)?birth|" +
109+
"medical|(health|care).?plan|healthkit|appointment|prescription|" +
110+
"blood.?(type|alcohol|glucose|pressure)|heart.?(rate|rhythm)|body.?(mass|fat)|" +
111+
"menstrua|pregnan|insulin|inhaler|" +
112+
// Relationships - work and family
113+
"employ(er|ee)|spouse|maiden.?name" +
114+
// ---
115+
").*"
116+
}
117+
80118
/**
81119
* Gets a regular expression that identifies strings that may indicate the presence
82120
* of sensitive data, with `classification` describing the kind of sensitive data involved.
@@ -90,6 +128,9 @@ module HeuristicNames {
90128
or
91129
result = maybeCertificate() and
92130
classification = SensitiveDataClassification::certificate()
131+
or
132+
result = maybePrivate() and
133+
classification = SensitiveDataClassification::private()
93134
}
94135

95136
/**

0 commit comments

Comments
 (0)