CodeQL library for Java/Kotlin
codeql/java-all 9.2.1 (changelog, source)
Search

Predicate getCommonSensitiveInfoFPRegex

Gets a regular expression for matching common names of variables that indicate the value being held does not contain sensitive information, but is a false positive for getCommonSensitiveInfoRegex.

  • “tokenizer” is often used for java.util.StringTokenizer.
  • “tokenImage” appears in parser code generated by JavaCC.
  • Pagination/iteration tokens: “nextToken” (AWS SDK), “pageToken” (GCP), etc.
  • Token metadata: “tokenType” (OAuth), “tokenEndpoint” (OIDC), “tokenCount”, etc.
  • Secret metadata: “secretName” (K8s/AWS), “secretId” (Azure), “secretVersion”, etc.

Import path

import semmle.code.java.security.SensitiveActions
string getCommonSensitiveInfoFPRegex()