Repository navigation
Shared: Treat trusted_schema names as non-sensitive - #22962
Open
LucaCappelletti94 wants to merge 2 commits into
Open
LucaCappelletti94 wants to merge 2 commits into
LucaCappelletti94 wants to merge 2 commits into
Conversation
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
An active moderate finding remains because the Go change note incorrectly claims that set_trusted_schema will not be classified as sensitive, while the Go queries use their own heuristic.
1 open issue
What changed in this PR
This pull request updates the shared sensitive-data heuristic so SQLite’s trusted_schema and trustedSchema names are not classified as secrets, reducing false positives in affected queries.
Changes:
- Excludes trusted-schema names from the shared secret-name heuristic.
- Adds Rust regression coverage for schema names, the setter method, and
trusted_token. - Adds language-specific analysis change notes.
| File | Summary |
|---|---|
swift/ql/lib/change-notes/2026-10-30-trusted-schema-not-sensitive.md |
Documents the Swift analysis improvement. |
shared/concepts/codeql/concepts/internal/SensitiveDataHeuristics.qll |
Excludes trusted-schema names from secret detection. |
rust/ql/test/library-tests/sensitivedata/test.rs |
Covers snake_case, camelCase, setter-method behavior, and continued detection of trusted_token. |
rust/ql/lib/change-notes/2026-10-30-trusted-schema-not-sensitive.md |
Documents the Rust analysis improvement. |
ruby/ql/lib/change-notes/2026-10-30-trusted-schema-not-sensitive.md |
Documents the Ruby analysis improvement. |
python/ql/lib/change-notes/2026-10-30-trusted-schema-not-sensitive.md |
Documents the Python analysis improvement. |
javascript/ql/lib/change-notes/2026-10-30-trusted-schema-not-sensitive.md |
Documents the JavaScript analysis improvement. |
go/ql/lib/change-notes/2026-10-30-trusted-schema-not-sensitive.md |
Documents a claimed Go analysis improvement; review identified that Go uses a separate unchanged heuristic. |
This pull request requires changes.
Review effort: Lite (auto)
| --- | ||
| category: minorAnalysis | ||
| --- | ||
| * The sensitive data heuristics treat names built on `trusted_schema`, such as SQLite's `set_trusted_schema` setting, as non-sensitive. This removes false positive results from queries that use the sensitive data library (for example `go/clear-text-logging`). |
Contributor
There was a problem hiding this comment.
This is correct: most languages use this shared library, but not Go, so it shouldn't have a change note.
owen-mc
approved these changes
Oct 30, 2026
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The secret-name heuristic in
SensitiveDataHeuristics.qllmatches any name containingtrusted, soset_trusted_schemacounts as a source of secret data. That name is SQLite'strusted_schemaswitch (PRAGMA trusted_schema,SQLITE_DBCONFIG_TRUSTED_SCHEMA), a hardening flag that carries no secret. Diesel exposes it asSqliteConnection::set_trusted_schema, andrust/cleartext-loggingreports any formatting of its result as cleartext logging of sensitive information.The regular expression already excludes
trusted_iterwith a lookahead, so this extends that lookahead to_?schema. Both the snake case and camel case spellings become non-sensitive, while names such astrusted_tokenstay secret.