@@ -111,6 +111,43 @@ private module SensitiveDataModeling {
111111 override SensitiveDataClassification getClassification ( ) { result = classification }
112112 }
113113
114+ /**
115+ * Any kind of variable assignment (also including with/for) where the name indicates
116+ * it contains sensitive data.
117+ *
118+ * Note: We _could_ make any access to a variable with a sensitive name a source of
119+ * sensitive data, but to make path explanations in data-flow/taint-tracking good,
120+ * we don't want that, since it works against allowing users to understand the flow
121+ * in the program (which is the whole point).
122+ *
123+ * Note: To make data-flow/taint-tracking work, the expression that is _assigned_ to
124+ * the variable is marked as the source (as compared to marking the variable as the
125+ * source).
126+ */
127+ class SensitiveVariableAssignment extends SensitiveDataSource:: Range {
128+ SensitiveDataClassification classification ;
129+
130+ SensitiveVariableAssignment ( ) {
131+ exists ( DefinitionNode def |
132+ nameIndicatesSensitiveData ( def .( NameNode ) .getId ( ) , classification ) and
133+ (
134+ this .asCfgNode ( ) = def .getValue ( )
135+ or
136+ this .asCfgNode ( ) = def .getValue ( ) .( ForNode ) .getSequence ( )
137+ ) and
138+ not this .asExpr ( ) instanceof FunctionExpr and
139+ not this .asExpr ( ) instanceof ClassExpr
140+ )
141+ or
142+ exists ( With with |
143+ nameIndicatesSensitiveData ( with .getOptionalVars ( ) .( Name ) .getId ( ) , classification ) and
144+ this .asExpr ( ) = with .getContextExpr ( )
145+ )
146+ }
147+
148+ override SensitiveDataClassification getClassification ( ) { result = classification }
149+ }
150+
114151 /** An attribute access that is considered a source of sensitive data. */
115152 class SensitiveAttributeAccess extends SensitiveDataSource:: Range {
116153 SensitiveDataClassification classification ;
0 commit comments