Go: Consider more strings as hardcoded credentials

[atorralba]

Using the heuristic for dummy passwords to discard sources in this query makes us miss sources like this one, so I think it's a good idea to remove the limitation.

[atorralba]

I also changed this so that the alert contains a link to the source (i.e. the hard-coded string).

[owen-mc]

The source you linked to looks a lot like a dummy password...

[atorralba]

The source you linked to looks a lot like a dummy password...

Yes. There's where the vulnerability is: that dummy password was used in production and attackers could forge JWT tokens because it was known (see CVE-2023-22463).

The dummy password heuristic makes sense for things like go/clear-text-logging, because even if such a password ends up in the logs, it's not a big deal (nothing sensitive was leaked after all if it's dummy, and users are intended to change it).

But when dealing with hard-coded passwords, even if they're dummy, they're still used for sensitive things like authentication or cryptographic operations. Even an empty string would be a problem.

[owen-mc]

Thanks for the explanation. It all looks good. And thanks for improving the alert message in passing.