Merge pull request #22962 from LucaCappelletti94/upstream/trusted-schema-not-secret

Shared: Treat `trusted_schema` names as non-sensitive

Author: geoffw0

javascript/ql/lib/change-notes/2026-10-30-trusted-schema-not-sensitive.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The sensitive data heuristics treat names built on `trusted_schema`, such as SQLite's `set_trusted_schema` setting, as non-sensitive. This removes false positive results from queries that use the sensitive data library (for example `js/clear-text-logging`).

python/ql/lib/change-notes/2026-10-30-trusted-schema-not-sensitive.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The sensitive data heuristics treat names built on `trusted_schema`, such as SQLite's `set_trusted_schema` setting, as non-sensitive. This removes false positive results from queries that use the sensitive data library (for example `py/clear-text-logging-sensitive-data`).

ruby/ql/lib/change-notes/2026-10-30-trusted-schema-not-sensitive.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The sensitive data heuristics treat names built on `trusted_schema`, such as SQLite's `set_trusted_schema` setting, as non-sensitive. This removes false positive results from queries that use the sensitive data library (for example `rb/clear-text-logging-sensitive-data`).

rust/ql/lib/change-notes/2026-10-30-trusted-schema-not-sensitive.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The sensitive data heuristics treat names built on `trusted_schema`, such as SQLite's `set_trusted_schema` setting, as non-sensitive. This removes false positive results from queries that use the sensitive data library (for example `rust/cleartext-logging`).

rust/ql/test/library-tests/sensitivedata/test.rs

@@ -97,10 +97,17 @@ fn get_public_key() -> String { get_string() }
 fn get_secret_token() -> String { get_string() }
 fn get_next_token() -> String { get_string() }
 
+struct Connection;
+
+impl Connection {
+	fn set_trusted_schema(&mut self, enabled: bool) -> bool { enabled }
+}
+
 fn test_credentials(
 	account_key: &str, accnt_key: &str, license_key: &str, secret_key: &str, is_secret: bool, num_accounts: i64,
 	username: String, user_name: String, userid: i64, user_id: i64, my_user_id_64: i64, id: i64, uid: i64, uuid: i64, guid: i64, unique_id: i64,
 	sessionkey: &[u64; 4], session_key: &[u64; 4], hashkey: &[u64; 4], hash_key: &[u64; 4], sessionkeypath: &[u64; 4], account_key_path: &[u64; 4],
+	trusted_token: &str, trusted_schema: bool, trustedSchema: bool, conn: &mut Connection,
 	ms: &MyStruct
 ) {
 	// credentials
@@ -125,6 +132,7 @@ fn test_credentials(
 	sink(get_secure_key()); // $ MISSING: sensitive=secret
 	sink(get_private_key()); // $ MISSING: sensitive=secret
 	sink(get_secret_token()); // $ sensitive=secret
+	sink(trusted_token); // $ sensitive=secret
 
 	// not (necessarily) credentials
 
@@ -146,6 +154,9 @@ fn test_credentials(
 
 	sink(get_public_key());
 	sink(get_next_token());
+	sink(trusted_schema);
+	sink(trustedSchema);
+	sink(conn.set_trusted_schema(false));
 }
 
 struct MacAddr {

shared/concepts/codeql/concepts/internal/SensitiveDataHeuristics.qll

@@ -57,7 +57,7 @@ module HeuristicNames {
    * or trusted data.
    */
   string maybeSecret() {
-    result = "(?is).*((?<!is|is_)secret|(?<!un|un_|is|is_)trusted(?!_iter)|confidential).*"
+    result = "(?is).*((?<!is|is_)secret|(?<!un|un_|is|is_)trusted(?!_iter|_?schema)|confidential).*"
   }
 
   /**

swift/ql/lib/change-notes/2026-10-30-trusted-schema-not-sensitive.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The sensitive data heuristics treat names built on `trusted_schema`, such as SQLite's `set_trusted_schema` setting, as non-sensitive. This removes false positive results from queries that use the sensitive data library (for example `swift/cleartext-logging`).