C++: Convert to regexp.

geoffw0 · geoffw0 · commit 393819837ccf · 2022-03-29T09:33:16.000+01:00
diff --git a/cpp/ql/lib/semmle/code/cpp/security/PrivateData.qll b/cpp/ql/lib/semmle/code/cpp/security/PrivateData.qll
@@ -12,32 +12,36 @@
 
 import cpp
 
-/** A string for `match` that identifies strings that look like they represent private data. */
+/**
+ * A string for `regexpMatch` that identifies strings that look like they
+ * represent private data.
+ */
 private string privateNames() {
   result =
-    [
+    ".*(" +
       // Inspired by the list on https://cwe.mitre.org/data/definitions/359.html
       // Government identifiers, such as Social Security Numbers
-      "%social%security%",
+      "social.*security|" +
       // Contact information, such as home addresses and telephone numbers
-      "%postcode%", "%zipcode%", "%telephone%",
+      "postcode|zipcode|telephone|" +
       // Geographic location - where the user is (or was)
-      "%latitude%", "%longitude%",
+      "latitude|longitude|" +
       // Financial data - such as credit card numbers, salary, bank accounts, and debts
-      "%credit%card%", "%salary%", "%bank%account%",
+      "credit.*card|salary|bank.*account|" +
       // Communications - e-mail addresses, private e-mail messages, SMS text messages, chat logs, etc.
-      "%email%", "%mobile%", "%employer%",
+      "email|mobile|employer|" +
       // Health - medical conditions, insurance status, prescription records
-      "%medical%"
-    ]
+      "medical" +
+      // ---
+      ").*"
 }
 
 /**
  * A variable that might contain sensitive private information.
  */
 class PrivateDataVariable extends Variable {
   PrivateDataVariable() {
-    this.getName().toLowerCase().matches(privateNames()) and
+    this.getName().toLowerCase().regexpMatch(privateNames()) and
     not this.getUnspecifiedType() instanceof IntegralType
   }
 }
@@ -47,7 +51,7 @@ class PrivateDataVariable extends Variable {
  */
 class PrivateDataFunction extends Function {
   PrivateDataFunction() {
-    this.getName().toLowerCase().matches(privateNames()) and
+    this.getName().toLowerCase().regexpMatch(privateNames()) and
     not this.getUnspecifiedType() instanceof IntegralType
   }
 }
