Rust: Query for cleartext logging of sensitive information

[geoffw0]

New query for cleartext logging of sensitive information in Rust. There are plans to add more sinks in future, but what's here should give us fairly good coverage.

[Copilot]

Copilot reviewed 13 out of 13 changed files in this pull request and generated 1 comment.

Tip: If you use Visual Studio Code, you can request a review from Copilot before you push from the "Source Control" tab. Learn more

[geoffw0]

We possibly want something like this as a general flow step. It matters for basically all the test cases that mention &password in the source I think. @paldepind what do you think?

[geoffw0]

I couldn't get tuple content to work in the models-as-data sink itself, so this might have to do for now.

[github-actions]

QHelp previews:

rust/ql/src/queries/security/CWE-312/CleartextLogging.qhelp

Cleartext logging of sensitive information

Sensitive user data and system information that is logged could be seen by an attacker when it is displayed. Also, external processes often store the standard output and standard error streams of an application, which will include logged sensitive information.

Recommendation

Do not log sensitive data. If it is necessary to log sensitive data, encrypt it before logging.

Example

The following example code logs user credentials (in this case, their password) in plaintext:

let password = "P@ssw0rd";
info!("User password changed to {password}");

Instead, you should encrypt the credentials, or better still omit them entirely:

let password = "P@ssw0rd";
info!("User password changed");

References

• M. Dowd, J. McDonald and J. Schuhm, The Art of Software Security Assessment, 1st Edition, Chapter 2 - 'Common Vulnerabilities of Encryption', p. 43. Addison Wesley, 2006.
• M. Howard and D. LeBlanc, Writing Secure Code, 2nd Edition, Chapter 9 - 'Protecting Secret Data', p. 299. Microsoft, 2002.
• OWASP: Logging Cheat Sheet - Data to exclude.
• Common Weakness Enumeration: CWE-312.
• Common Weakness Enumeration: CWE-359.
• Common Weakness Enumeration: CWE-532.