Description

This detector identifies hardcoded PostgreSQL passwords in Go applications using the pgx database driver. It specifically looks for database connection strings (DSN) that contain embedded credentials constructed through sprintf-like functions, which represents a security risk as passwords are stored directly in source code.

Detection Strategy

• The Go source code imports the pgx PostgreSQL driver library (github.com/jackc/pgx)

• A function call is made to a pgx connection method that accepts a DSN parameter (like pgx.Connect, pgx.ConnectConfig, etc.)

• The DSN parameter is constructed using a sprintf-style function that contains embedded credentials

• The sprintf construction includes both username and password components that can be statically determined from the source code

Vulnerable code example

package main

import (
	"context"
	"fmt"
	"github.com/jackc/pgx/v5"
)
...

✅ Secure code example

package main

import (
	"context"
	"fmt"
	"os"
	"github.com/jackc/pgx/v5"
)...