Skip to content

fix: line content for repeated secrets and 10K byte lines - #399

Open
cx-diogo-rocha wants to merge 7 commits into
masterfrom
AST-151006-fix-line-content
Open

fix: line content for repeated secrets and 10K byte lines#399
cx-diogo-rocha wants to merge 7 commits into
masterfrom
AST-151006-fix-line-content

Conversation

@cx-diogo-rocha

Copy link
Copy Markdown
Contributor

Closes #

Proposed Changes
Fixes to line content on these cases:

  • Repeated secrets in same line all shared same lineContent, now line lineContent correctly wraps around each instance of the secret
  • Lines bigger than 10k bytes had their line content always be the start of the line, now lineContent correctly wraps around the secret by looking at startColumn of the secret

Checklist

  • I covered my changes with tests.
  • I Updated the documentation that is affected by my changes:
    • Change in the CLI arguments
    • Change in the configuration file

I submit this contribution under the Apache-2.0 license.

@cx-diogo-rocha
cx-diogo-rocha requested a review from a team September 10, 2026 10:15
@cx-diogo-rocha
cx-diogo-rocha requested a review from a team as a code owner September 10, 2026 10:15
Comment thread pkg/rules.go Outdated
return rules.GetDefaultRules(includeDeprecated)
}

func GetRegexSuffix() string { return ruledefine.SecretSuffix }

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
func GetRegexSuffix() string { return ruledefine.SecretSuffix }
func GetRegexSuffix() string {
return ruledefine.SecretSuffix
}

Comment thread engine/engine.go
adjustedEndColumn--
}

lineContent, err := linecontent.GetLineContent(value.Line, value.Secret, adjustedStartColumn)

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If hasNewline == true, both adjustedStartColumn and adjustedEndColumn will be reduced by 1. However, line 553 might remove multiple \r characters and that isn't being accounted for in the same way as \n. This previously wasn't used for linecontent.GetLineContent, but now that it is, won't this cause issues if \r characters are removed without correcting adjustedStartColumn ?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

\r should only happen in Windows new lines and in that case adjusting the columns would break the secret position. For example

api_key=\r\n
integration_api_key_prod_abc123def456

Has endColumn 37 (on second line), and this is true with or without the presence of \r. But if we adjust the EndColumn with removal of \r, it would be 36 and become incorrect

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants