Python: preserve sensitive configuration key precision

[yoff]

Important

Experimental draft stacked on #21925. This must not merge independently of its parent.

The base was revalidated immediately before creation at github/codeql:yoff/python-shared-cfg-dataflow-flip = 1a8e317b4a328bea1059453a2ab3ba6eada09e3f.

Causal evidence

This is not an Airflow model correction. Python's generic SensitiveFunctionCall heuristic marks _get_config_value_from_secret_backend(...) as a secret source because the resolved function name matches the sensitive-name regular expression. Global summaries then preserve the topological return path through Airflow's _get_env_var_option / _get_secret_option, Configuration.get, getlist, and get_mandatory_list_value, but they do not retain the control correlation between (section, key) in self.sensitive_config_values and each caller's concrete arguments.

Consequently, core.EXECUTOR and core.DAGS_FOLDER can inherit the secret source even though those pairs are not members of Airflow's runtime sensitive-key registry and cannot take the secret-backend branches. A secret-backend getter being reachable for some registered keys does not imply that every concrete key handled by the shared getter is sensitive.

The first commit reproduces this with an Airflow-shaped local flow and a passing SPURIOUS expectation. The second commit removes that annotation after the precision fix.

Scope

The change deliberately leaves core dataflow and summary routing unchanged: those paths are topologically valid and useful to other analyses. Instead, SensitiveDataSources identifies a known non-sensitive configuration lookup only when:

• every resolved target maps conventional section and key parameters;
• all local sources agree on unique string literals;
• the receiver, section, and key are the only actual inputs;
• neither resolved nor syntactic callee names indicate sensitive data; and
• section/key names do not match sensitive or conservative configuration-secret indicators.

The clear-text logging, clear-text storage, and weak sensitive-data hashing customizations expose those nodes through their existing sanitizer extension points. There are no Airflow names or key values in the implementation.

Exact Airflow evidence

On a locally extracted CodeQL database for apache/airflow@a9da0f7fb48dc7526b2745be3e8fe64e1c775da2:

• the parent query produced 81 result rows; this branch produces 41;
• the core.EXECUTOR family at executor_loader.py:225/234 is removed;
• the core.DAGS_FOLDER family at utils/file.py:68/96 is removed;
• the final barrier matches 354 call sites / 212 unique concrete pairs; none overlap Airflow's 9 metadata-declared sensitive (section, key) pairs; and
• evaluation was 11.4s on the parent versus 4.9s on the final query in this local run.

The DCA report's cli_parser.py:64 row is the motivating core.EXECUTOR route. The local extraction did not reproduce that exact sink location, so its evidence remains the DCA comparison plus the independently reproduced shared configuration route; the exact local database did reproduce and remove the related executor and file-path families above.

Conservative controls

Tests retain flow for:

• concrete PASSWORD, FERNET_KEY, and PASSWORD_FILE selectors;
• dynamic keys;
• direct secret-named getter calls; and
• calls with an additional sensitive fallback argument.

Ambiguous or unresolved calls also remain conservative because every resolved target must satisfy the refinement.

Limitations

This is still a name-based heuristic refinement. It intentionally recognizes only configuration APIs using conventional section / key formal names and does not attempt arbitrary application registry reasoning. Calls with additional value inputs are excluded because the sanitizer blocks the complete lookup result, not one incoming edge. The broad Airflow result delta is why this remains an experimental draft despite the zero-overlap registry audit.

Validation

• python/ql/test/library-tests/dataflow/sensitive-data
• python/ql/test/query-tests/Security/CWE-312-CleartextLogging
• python/ql/test/query-tests/Security/CWE-312-CleartextStorage
• python/ql/test/query-tests/Security/CWE-312-CleartextStorage-py3
• python/ql/test/query-tests/Security/CWE-327-WeakSensitiveDataHashing
• QL formatting checks for all modified QL files