Added change note, adjusted spacing in comment

aegilops · aegilops · commit 528c45100783 · 2025-11-17T11:02:59.000Z
diff --git a/java/ql/lib/semmle/code/java/security/SensitiveLoggingQuery.qll b/java/ql/lib/semmle/code/java/security/SensitiveLoggingQuery.qll
@@ -47,7 +47,7 @@ private class TypeType extends RefType {
 /**
  * A sanitizer that may remove sensitive information from a string before logging.
  *
- *  It allows for substring operations taking the first N (or last N, for Kotlin) characters, limited to 7 or fewer.
+ * It allows for substring operations taking the first N (or last N, for Kotlin) characters, limited to 7 or fewer.
  */
 private class SensitiveLoggerSanitizerCalled extends SensitiveLoggerBarrier {
   SensitiveLoggerSanitizerCalled() {
diff --git a/java/ql/src/change-notes/2025-11-17-sensitive-logging-new-sanitizers.md b/java/ql/src/change-notes/2025-11-17-sensitive-logging-new-sanitizers.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Calls to `substring` (for Java), `take` (for Kotlin) and similar functions, when called with a fixed length less than or equal to 7, are now treated as sanitizers for the `java/sensitive-log` query.

Original file line number	Diff line number	Diff line change
`@@ -47,7 +47,7 @@ private class TypeType extends RefType {`
`47`	`47`	`/**`
`48`	`48`	`* A sanitizer that may remove sensitive information from a string before logging.`
`49`	`49`	`*`
`50`		`- * It allows for substring operations taking the first N (or last N, for Kotlin) characters, limited to 7 or fewer.`
	`50`	`+ * It allows for substring operations taking the first N (or last N, for Kotlin) characters, limited to 7 or fewer.`
`51`	`51`	`*/`
`52`	`52`	`private class SensitiveLoggerSanitizerCalled extends SensitiveLoggerBarrier {`
`53`	`53`	`SensitiveLoggerSanitizerCalled() {`
-Original file line number
+Diff line change
@@ @@ -0,0 +1,4 @@ @@
 +---
 +category: minorAnalysis
 +---
 +* Calls to `substring` (for Java), `take` (for Kotlin) and similar functions, when called with a fixed length less than or equal to 7, are now treated as sanitizers for the `java/sensitive-log` query.