[geoffw0]

Add a unified Swift sensitive data library and use it in unified/swift/cleartext-logging.

Shared data library:

• similarly to other languages, I've created a unified Swift sensitive data library to handle Swift-specific parts of identifying sensitive data sources. We still use the underlying shared sensitive data library for the heuristics etc.
• I've expanded what I took from the cleartext logging query, so we match a few more test cases.

Cleartext logging:

• I ported the test cases from original swift, and added a few cases in areas I was thinking about. We now have good test coverage for this query (and by extension the library).
• the query now uses the unified Swift sensitive data library described above.
• the query now uses the source location for the alert, rather than the sink (as is more common for data flow queries). I was asked to do this to reduce result duplication / noise on customer projects. I've also made the alert message more similar to what we have in other languages - but not identical due to having the source as the alert location.

Not done yet:

• there are still some cases to do with enums that the shared library doesn't handle (low priority follow-up work).
• I've done nothing with the sinks yet (high priority follow-up work).

[Copilot]

🟡 Changes recommended

The receiver-chain logic incorrectly marks enclosing comparisons as sensitive while missing chains rooted in sensitive identifiers, causing both false positives and missed sensitive-data logging.

2 open issues

• Restrict parent links to receiver-chain relationships · New
• Seed receiver chains from sensitive identifiers · New

What changed in this PR

Adds reusable sensitive-data detection for unified Swift analysis and integrates it into the cleartext-logging query.

Changes:

• Detect sensitive identifiers, member-access chains, and call results using shared heuristics.
• Move alert locations to sources and update the alert message.
• Port and expand Swift tests, documenting known missing and spurious results.

File	Description
unified/​ql/​test/​query-tests/​security/​CWE-312/​CleartextLogging/​CleartextLoggingTest.swift	Adds Swift logging and sensitive-data test cases.
unified/​ql/​test/​query-tests/​security/​CWE-312/​CleartextLogging/​CleartextLogging.expected	Records expanded results and source-based alert locations.
unified/​ql/​src/​queries/​security/​CWE-312/​CleartextLogging.ql	Uses the new library and updates alert locations and wording.
unified/​ql/​lib/​codeql/​unified/​security/​SensitiveData.qll	Introduces reusable sensitive-data source classification.

_{Review effort: Max (dynamic)}