rename ProcessEnvLabel to PartiallySensitiveMap

Author: erik-krogh

javascript/ql/src/semmle/javascript/security/dataflow/CleartextLogging.qll

@@ -35,16 +35,16 @@ module CleartextLogging {
     override predicate isSanitizer(DataFlow::Node node) { node instanceof Barrier }
 
     override predicate isSanitizerEdge(DataFlow::Node pred, DataFlow::Node succ, DataFlow::FlowLabel lbl) {
-      // Only unknown property reads on `process.env` propagate taint.
-      (not lbl instanceof ProcessEnvLabel or exists(succ.(DataFlow::PropRead).getPropertyName())) and 
+      // Only unknown property reads on sensitive objects propagate taint.
+      (not lbl instanceof PartiallySensitiveMap or exists(succ.(DataFlow::PropRead).getPropertyName())) and 
       succ.(DataFlow::PropRead).getBase() = pred
     }
 
     override predicate isAdditionalFlowStep(
       DataFlow::Node src, DataFlow::Node trg, DataFlow::FlowLabel inlbl, DataFlow::FlowLabel outlbl
     ) {
       trg.(DataFlow::PropRead).getBase() = src and
-      inlbl instanceof ProcessEnvLabel and 
+      inlbl instanceof PartiallySensitiveMap and 
       outlbl.isData() 
     }
 

javascript/ql/src/semmle/javascript/security/dataflow/CleartextLoggingCustomizations.qll

@@ -163,7 +163,7 @@ module CleartextLogging {
     }
   }
 
-
+  /** An access to the sensitive object `process.env`. */
   class ProcessEnvSource extends Source {
     ProcessEnvSource() {
       this = NodeJSLib::process().getAPropertyRead("env")
@@ -173,11 +173,16 @@ module CleartextLogging {
 
     override DataFlow::FlowLabel getLabel() {
       result.isData() or 
-      result instanceof ProcessEnvLabel
+      result instanceof PartiallySensitiveMap
     }
   }
-  class ProcessEnvLabel extends DataFlow::FlowLabel{
-    ProcessEnvLabel() {
+  
+  /**
+   * A flow label describing a map that might contain sensitive information in some properties.
+   * Property reads on such maps where the property name is fixed is unlikely to leak sensitive information. 
+   */
+  class PartiallySensitiveMap extends DataFlow::FlowLabel {
+    PartiallySensitiveMap() {
       this = "processEnv"
     }
   }