java: Added Java/Kotlin Sensitive Logging barriers (substrings)

[aegilops]

Logging of sensitive data can be mitigated by taking a substring of the data.

This affects the library used by java/sensitive-log (CWE 532).

The exact length suitable will vary by application, but this change takes a conservative approach and allows either substring or take/takeLast of up to 7 characters.

Complex redaction with a regular expression, replacement of particular characters, a substring not at the start or end of the string, or a conditional substring (such as with Apache StringUtils) are not supported in this sanitizer.

There is a new abstraction for sanitizer barriers, along with logic to detect substring operations that restrict logged data to a safe length in both Java and Kotlin code. The existing sanitizers are pulled into a new class called GenericSanitizer, which implements the new abstract class, alongside the new sanitizer.

The safe length restriction must be done in the analyzed code with a compile-time constant integer, but the integer can reach the substring operation using taint.

[Copilot]

Pull Request Overview

This PR adds support for detecting substring operations as sanitizer barriers in sensitive logging analysis for both Java and Kotlin. The implementation takes a conservative approach by allowing substring operations that extract up to 7 characters, which can help mitigate the logging of sensitive data.

Key Changes:

• Introduced abstract SensitiveLoggerBarrier class for sanitizer barriers
• Implemented substring-based sanitizers supporting Java String.substring() and Kotlin take()/takeLast() methods
• Refactored existing sanitizers into a new GenericSanitizer class

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
java/ql/lib/semmle/code/java/security/SensitiveLoggingQuery.qll	Core implementation adding SensitiveLoggerBarrier abstraction, SensitiveLoggerSanitizerCalled for substring operations with helper predicates, IntegerToArgConfig for constant propagation, and refactored GenericSanitizer
java/ql/test/query-tests/security/CWE-532/Test.java	Added test cases demonstrating safe usage of substring(4) and substring(0,4) on sensitive auth tokens

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

[nitpick] Extra space before "It allows". The documentation comment should have consistent spacing - either one space after the asterisk for all lines, or align the text.

Suggested change

	* It allows for substring operations taking the first N (or last N, for Kotlin) characters, limited to 7 or fewer.
	* It allows for substring operations taking the first N (or last N, for Kotlin) characters, limited to 7 or fewer.