Rust: Understand sensitive enum variants calls.

Author: geoffw0

rust/ql/lib/codeql/rust/security/SensitiveData.qll

@@ -37,10 +37,10 @@ private class SensitiveDataFunction extends Function {
 /**
  * A function call data flow node that might produce sensitive data.
  */
-private class SensitiveDataCall extends SensitiveData {
+private class SensitiveDataFunctionCall extends SensitiveData {
   SensitiveDataClassification classification;
 
-  SensitiveDataCall() {
+  SensitiveDataFunctionCall() {
     classification =
       this.asExpr()
           .getAstNode()
@@ -53,6 +53,33 @@ private class SensitiveDataCall extends SensitiveData {
   override SensitiveDataClassification getClassification() { result = classification }
 }
 
+/**
+ * An enum variant that might produce sensitive data.
+ */
+private class SensitiveDataVariant extends Variant {
+  SensitiveDataClassification classification;
+
+  SensitiveDataVariant() {
+    HeuristicNames::nameIndicatesSensitiveData(this.getName().getText(), classification)
+  }
+
+  SensitiveDataClassification getClassification() { result = classification }
+}
+
+/**
+ * An enum variant call data flow node that might produce sensitive data.
+ */
+private class SensitiveDataVariantCall extends SensitiveData {
+  SensitiveDataClassification classification;
+
+  SensitiveDataVariantCall() {
+    classification =
+      this.asExpr().getAstNode().(CallExpr).getVariant().(SensitiveDataVariant).getClassification()
+  }
+
+  override SensitiveDataClassification getClassification() { result = classification }
+}
+
 /**
  * A variable that might contain sensitive data.
  */

rust/ql/test/library-tests/sensitivedata/test.rs

@@ -293,8 +293,8 @@ fn test_private_info(
 	sink(info.financials.iban.as_str()); // $ MISSING: sensitive=private
 	sink(info.financials.iBAN.as_str()); // $ MISSING: sensitive=private
 
-	sink(ContactDetails::HomePhoneNumber("123".to_string())); // $ MISSING: sensitive=private
-	sink(ContactDetails::MobileNumber("123".to_string())); // $ MISSING: sensitive=private
+	sink(ContactDetails::HomePhoneNumber("123".to_string())); // $ sensitive=private
+	sink(ContactDetails::MobileNumber("123".to_string())); // $ sensitive=private
 	sink(ContactDetails::Email("a@b".to_string())); // $ MISSING: sensitive=private
 	if let ContactDetails::MobileNumber(num) = details {
 		sink(num.as_str()); // $ MISSING: sensitive=private