Teach CleartextLogging not to flag constant sources.

Author: Max Schaefer

ql/src/semmle/go/security/CleartextLoggingCustomizations.qll

@@ -12,6 +12,11 @@ module CleartextLogging {
    * A data-flow source for clear-text logging of sensitive information.
    */
   abstract class Source extends DataFlow::Node {
+    Source() {
+      // hard-coded strings are uninteresting
+      not exists(getStringValue())
+    }
+
     /** Gets a string that describes the type of this data-flow source. */
     abstract string describe();
   }

ql/test/query-tests/Security/CWE-312/passwords.go

@@ -126,3 +126,9 @@ func test() {
 	log.Println(config.x)        // NOT OK
 	log.Println(config.y)        // NOT OK
 }
+
+const password = "horsebatterystaplecorrect"
+
+func test2() {
+	log.Println(password) // OK
+}