Shared: Classify session and account keys as secrets

Author: LucaCappelletti94

rust/ql/test/library-tests/sensitivedata/test.rs

@@ -105,8 +105,8 @@ fn test_credentials(
 ) {
 	// credentials
 
-	sink(account_key); // $ sensitive=id
-	sink(accnt_key); // $ sensitive=id
+	sink(account_key); // $ sensitive=secret
+	sink(accnt_key); // $ sensitive=secret
 	sink(license_key); // $ MISSING: sensitive=secret
 	sink(secret_key); // $ sensitive=secret
 
@@ -116,8 +116,8 @@ fn test_credentials(
 	sink(user_id); // $ sensitive=id
 	sink(my_user_id_64); // $ sensitive=id
 
-	sink(sessionkey); // $ sensitive=id
-	sink(session_key); // $ sensitive=id
+	sink(sessionkey); // $ sensitive=secret
+	sink(session_key); // $ sensitive=secret
 
 	sink(ms.get_certificate()); // $ sensitive=certificate
 

rust/ql/test/query-tests/security/CWE-312/CleartextLogging.expected

@@ -56,7 +56,8 @@
 | test_logging.rs:248:15:248:60 | ... .as_bytes() | test_logging.rs:248:41:248:48 | password | test_logging.rs:248:15:248:60 | ... .as_bytes() | This operation writes $@ to a log file. | test_logging.rs:248:41:248:48 | password | password |
 | test_logging.rs:251:15:251:60 | ... .as_bytes() | test_logging.rs:251:41:251:48 | password | test_logging.rs:251:15:251:60 | ... .as_bytes() | This operation writes $@ to a log file. | test_logging.rs:251:41:251:48 | password | password |
 | test_logging.rs:276:11:276:42 | MacroExpr | test_logging.rs:276:27:276:42 | account_password | test_logging.rs:276:11:276:42 | MacroExpr | This operation writes $@ to a log file. | test_logging.rs:276:27:276:42 | account_password | account_password |
-| test_logging.rs:295:11:295:31 | MacroExpr | test_logging.rs:294:17:294:39 | get_password_or_error(...) | test_logging.rs:295:11:295:31 | MacroExpr | This operation writes $@ to a log file. | test_logging.rs:294:17:294:39 | get_password_or_error(...) | get_password_or_error(...) |
+| test_logging.rs:277:11:277:37 | MacroExpr | test_logging.rs:277:27:277:37 | session_key | test_logging.rs:277:11:277:37 | MacroExpr | This operation writes $@ to a log file. | test_logging.rs:277:27:277:37 | session_key | session_key |
+| test_logging.rs:296:11:296:31 | MacroExpr | test_logging.rs:295:17:295:39 | get_password_or_error(...) | test_logging.rs:296:11:296:31 | MacroExpr | This operation writes $@ to a log file. | test_logging.rs:295:17:295:39 | get_password_or_error(...) | get_password_or_error(...) |
 edges
 | test_logging.rs:42:28:42:35 | password | test_logging.rs:42:12:42:35 | MacroExpr | provenance | Sink:MaD:11 |
 | test_logging.rs:43:28:43:35 | password | test_logging.rs:43:12:43:35 | MacroExpr | provenance | Sink:MaD:11 |
@@ -228,8 +229,9 @@ edges
 | test_logging.rs:251:23:251:48 | { ... } | test_logging.rs:251:23:251:48 | ...::must_use(...) | provenance | MaD:21 |
 | test_logging.rs:251:41:251:48 | password | test_logging.rs:251:23:251:48 | MacroExpr | provenance |  |
 | test_logging.rs:276:27:276:42 | account_password | test_logging.rs:276:11:276:42 | MacroExpr | provenance | Sink:MaD:11 |
-| test_logging.rs:294:9:294:13 | value | test_logging.rs:295:11:295:31 | MacroExpr | provenance | Sink:MaD:11 |
-| test_logging.rs:294:17:294:39 | get_password_or_error(...) | test_logging.rs:294:9:294:13 | value | provenance |  |
+| test_logging.rs:277:27:277:37 | session_key | test_logging.rs:277:11:277:37 | MacroExpr | provenance | Sink:MaD:11 |
+| test_logging.rs:295:9:295:13 | value | test_logging.rs:296:11:296:31 | MacroExpr | provenance | Sink:MaD:11 |
+| test_logging.rs:295:17:295:39 | get_password_or_error(...) | test_logging.rs:295:9:295:13 | value | provenance |  |
 models
 | 1 | Sink: <core::option::Option as log_err::LogErrOption>::log_expect; Argument[0]; log-injection |
 | 2 | Sink: <core::option::Option>::expect; Argument[0]; log-injection |
@@ -469,7 +471,9 @@ nodes
 | test_logging.rs:251:41:251:48 | password | semmle.label | password |
 | test_logging.rs:276:11:276:42 | MacroExpr | semmle.label | MacroExpr |
 | test_logging.rs:276:27:276:42 | account_password | semmle.label | account_password |
-| test_logging.rs:294:9:294:13 | value | semmle.label | value |
-| test_logging.rs:294:17:294:39 | get_password_or_error(...) | semmle.label | get_password_or_error(...) |
-| test_logging.rs:295:11:295:31 | MacroExpr | semmle.label | MacroExpr |
+| test_logging.rs:277:11:277:37 | MacroExpr | semmle.label | MacroExpr |
+| test_logging.rs:277:27:277:37 | session_key | semmle.label | session_key |
+| test_logging.rs:295:9:295:13 | value | semmle.label | value |
+| test_logging.rs:295:17:295:39 | get_password_or_error(...) | semmle.label | get_password_or_error(...) |
+| test_logging.rs:296:11:296:31 | MacroExpr | semmle.label | MacroExpr |
 subpaths

rust/ql/test/query-tests/security/CWE-312/test_logging.rs

@@ -271,9 +271,10 @@ fn test_collections(harmless: String) {
     password_queue.make_contiguous();
 }
 
-fn test_account_identifiers(user_id: i32, user_uuid: String, account_password: String) {
+fn test_account_identifiers(user_id: i32, user_uuid: String, account_password: String, session_key: String) {
     info!("message = {} {}", user_id, user_uuid);
     info!("message = {}", account_password); // $ Alert[rust/cleartext-logging]
+    info!("message = {}", session_key); // $ Alert[rust/cleartext-logging]
 }
 
 fn get_password_or_error() -> Result<String, std::io::Error> {
@@ -310,6 +311,6 @@ fn main() {
     );
     test_std("123456".to_string(), 0, None);
     test_collections("harmless".to_string());
-    test_account_identifiers(123, "uuid".to_string(), "123456".to_string());
+    test_account_identifiers(123, "uuid".to_string(), "123456".to_string(), "key".to_string());
     _ = test_try_operator();
 }

shared/concepts/change-notes/2026-11-02-session-key-secret.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The sensitive data heuristics now classify names like `session_key` and `account_key` as secrets rather than account identifiers.

shared/concepts/codeql/concepts/internal/SensitiveDataHeuristics.qll

@@ -57,15 +57,16 @@ module HeuristicNames {
    * or trusted data.
    */
   string maybeSecret() {
-    result = "(?is).*((?<!is|is_)secret|(?<!un|un_|is|is_)trusted(?!_iter)|confidential).*"
+    result =
+      "(?is).*((?<!is|is_)secret|(?<!un|un_|is|is_)trusted(?!_iter)|confidential|(session|acc(ou)?nt).?key).*"
   }
 
   /**
    * Gets a regular expression that identifies strings that may indicate the presence of
    * user names or other account information.
    */
   string maybeAccountInfo() {
-    result = "(?is).*(acc(ou)?nt|puid|user.?(name|id)|session.?(id|key)).*" or
+    result = "(?is).*(acc(ou)?nt(?!.?key)|puid|user.?(name|id)|session.?id).*" or
     result = "(?s).*([uU]|^|_|[a-z](?=U))([uU][iI][dD]).*"
   }