Predicate getCommonSensitiveInfoFPRegex
Gets a regular expression for matching common names of variables that
indicate the value being held does not contain sensitive information,
but is a false positive for getCommonSensitiveInfoRegex.
- “tokenizer” is often used for java.util.StringTokenizer.
- “tokenImage” appears in parser code generated by JavaCC.
- Pagination/iteration tokens: “nextToken” (AWS SDK), “pageToken” (GCP), etc.
- Token metadata: “tokenType” (OAuth), “tokenEndpoint” (OIDC), “tokenCount”, etc.
- Secret metadata: “secretName” (K8s/AWS), “secretId” (Azure), “secretVersion”, etc.
Import path
import semmle.code.java.security.SensitiveActions