Repository navigation
Shared: Treat trusted_schema names as non-sensitive - #22962
Conversation
There was a problem hiding this comment.
🟡 Changes recommended
An active moderate finding remains because the Go change note incorrectly claims that set_trusted_schema will not be classified as sensitive, while the Go queries use their own heuristic.
1 open issue
What changed in this PR
This pull request updates the shared sensitive-data heuristic so SQLite’s trusted_schema and trustedSchema names are not classified as secrets, reducing false positives in affected queries.
Changes:
- Excludes trusted-schema names from the shared secret-name heuristic.
- Adds Rust regression coverage for schema names, the setter method, and
trusted_token. - Adds language-specific analysis change notes.
| File | Summary |
|---|---|
swift/ql/lib/change-notes/2026-10-30-trusted-schema-not-sensitive.md |
Documents the Swift analysis improvement. |
shared/concepts/codeql/concepts/internal/SensitiveDataHeuristics.qll |
Excludes trusted-schema names from secret detection. |
rust/ql/test/library-tests/sensitivedata/test.rs |
Covers snake_case, camelCase, setter-method behavior, and continued detection of trusted_token. |
rust/ql/lib/change-notes/2026-10-30-trusted-schema-not-sensitive.md |
Documents the Rust analysis improvement. |
ruby/ql/lib/change-notes/2026-10-30-trusted-schema-not-sensitive.md |
Documents the Ruby analysis improvement. |
python/ql/lib/change-notes/2026-10-30-trusted-schema-not-sensitive.md |
Documents the Python analysis improvement. |
javascript/ql/lib/change-notes/2026-10-30-trusted-schema-not-sensitive.md |
Documents the JavaScript analysis improvement. |
go/ql/lib/change-notes/2026-10-30-trusted-schema-not-sensitive.md |
Documents a claimed Go analysis improvement; review identified that Go uses a separate unchanged heuristic. |
This pull request requires changes.
Review effort: Lite (auto)
| --- | ||
| category: minorAnalysis | ||
| --- | ||
| * The sensitive data heuristics treat names built on `trusted_schema`, such as SQLite's `set_trusted_schema` setting, as non-sensitive. This removes false positive results from queries that use the sensitive data library (for example `go/clear-text-logging`). |
There was a problem hiding this comment.
This is correct: most languages use this shared library, but not Go, so it shouldn't have a change note.
github-actions
Bot
added
JS
documentation
Python
Go
Ruby
Rust
geoffw0
left a comment
geoffw0
left a comment
There was a problem hiding this comment.
Thank you for this improvement.
|
I'll start DCA runs to check this does behave as expected. I don't think we necessarily need approvals for all languages individually to merge this. |
|
All the DCA runs look good to me. Merging. Thank you @LucaCappelletti94 ! |
|
... apparently the rules don't let me merge this at this time. Possibly that means that other approvals are required as well now, or something else needs doing??? |
|
Also consider PR service is having problems https://www.githubstatus.com/ |
|
Ahah, got it (I think I wasn't fully signed in when I hit merge the first time). |
That could've been the problem. |
The secret-name heuristic in
SensitiveDataHeuristics.qllmatches any name containingtrusted, soset_trusted_schemacounts as a source of secret data. That name is SQLite'strusted_schemaswitch (PRAGMA trusted_schema,SQLITE_DBCONFIG_TRUSTED_SCHEMA), a hardening flag that carries no secret. Diesel exposes it asSqliteConnection::set_trusted_schema, andrust/cleartext-loggingreports any formatting of its result as cleartext logging of sensitive information.The regular expression already excludes
trusted_iterwith a lookahead, so this extends that lookahead to_?schema. Both the snake case and camel case spellings become non-sensitive, while names such astrusted_tokenstay secret.