Rust: Recognize more sensitive data sources

rust/ql/lib/codeql/rust/security/SensitiveData.qll

@@ -37,10 +37,10 @@ private class SensitiveDataFunction extends Function {
 /**
  * A function call data flow node that might produce sensitive data.
  */
-private class SensitiveDataCall extends SensitiveData {
+private class SensitiveDataFunctionCall extends SensitiveData {
   SensitiveDataClassification classification;
 
-  SensitiveDataCall() {
+  SensitiveDataFunctionCall() {
     classification =
       this.asExpr()
           .getAstNode()
@@ -53,6 +53,33 @@ private class SensitiveDataCall extends SensitiveData {
   override SensitiveDataClassification getClassification() { result = classification }
 }
 
+/**
+ * An enum variant that might produce sensitive data.
+ */
+private class SensitiveDataVariant extends Variant {
+  SensitiveDataClassification classification;
+
+  SensitiveDataVariant() {
+    HeuristicNames::nameIndicatesSensitiveData(this.getName().getText(), classification)
+  }
+
+  SensitiveDataClassification getClassification() { result = classification }
+}
+
+/**
+ * An enum variant call data flow node that might produce sensitive data.
+ */
+private class SensitiveDataVariantCall extends SensitiveData {
+  SensitiveDataClassification classification;
+
+  SensitiveDataVariantCall() {
+    classification =
+      this.asExpr().getAstNode().(CallExpr).getVariant().(SensitiveDataVariant).getClassification()
+  }
+
+  override SensitiveDataClassification getClassification() { result = classification }
+}
+
 /**
  * A variable that might contain sensitive data.
  */
@@ -67,7 +94,7 @@ private class SensitiveDataVariable extends Variable {
 }
 
 /**
- * A variable access data flow node that might produce sensitive data.
+ * A variable access data flow node that might be sensitive data.
  */
 private class SensitiveVariableAccess extends SensitiveData {
   SensitiveDataClassification classification;
@@ -84,3 +111,20 @@ private class SensitiveVariableAccess extends SensitiveData {
 
   override SensitiveDataClassification getClassification() { result = classification }
 }
+
+private Expr fieldExprParentField(FieldExpr fe) { result = fe.getParentNode() }
+
+/**
+ * A field access data flow node that might be sensitive data.
+ */
+private class SensitiveFieldAccess extends SensitiveData {
+  SensitiveDataClassification classification;
+
+  SensitiveFieldAccess() {
+    exists(FieldExpr fe | fieldExprParentField*(fe) = this.asExpr().getAstNode() |
+      HeuristicNames::nameIndicatesSensitiveData(fe.getIdentifier().getText(), classification)
+    )
+  }
+
+  override SensitiveDataClassification getClassification() { result = classification }
+}