Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Finding sometimes is incorrectly reported to span multiple lines #1352

Open
m1cm1c opened this issue Feb 21, 2024 · 0 comments
Open

Finding sometimes is incorrectly reported to span multiple lines #1352

m1cm1c opened this issue Feb 21, 2024 · 0 comments
Labels
bug Something isn't working

Comments

@m1cm1c
Copy link

m1cm1c commented Feb 21, 2024

Describe the bug
Sometimes, the reported start end end line are different even though the end line has nothing to do with the finding

To Reproduce

  1. Create a new directory containing only a single file (.env.prod) with the following content:
DB_HOST=example.com
DB_PORT=443
DB_USERNAME=postgres
DB_PASSWORD=8ae31cacf141669ddfb5da
DB_NAME=best_db
DB_SSL=true
  1. Run gitleaks detect --no-git --report-path o
  2. In o , you will find the following report:
[
 {
  "Description": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
  "StartLine": 4,
  "EndLine": 5,
  "StartColumn": 5,
  "EndColumn": 1,
  "Match": "PASSWORD=8ae31cacf141669ddfb5da",
  "Secret": "8ae31cacf141669ddfb5da",
  "File": ".env.prod",
  "SymlinkFile": "",
  "Commit": "",
  "Entropy": 3.5383105,
  "Author": "",
  "Email": "",
  "Date": "",
  "Message": "",
  "Tags": [],
  "RuleID": "generic-api-key",
  "Fingerprint": ".env.prod:generic-api-key:4"
 }
]

Expected behavior
The start line is correct. However, the start column already is wrong because start column 5 means that the finding is

SSWORD=8ae31cacf141669ddfb5da
DB

if columns are 0-indexed and

ASSWORD=8ae31cacf141669ddfb5da
D

if columns are 1-indexed.

However, what really seems very wrong is the jump into line 5 because DB_NAME has nothing to do with the password.

Screenshots
If applicable, add screenshots to help explain your problem.

Basic Info (please complete the following information):

  • OS: Manjaro
  • Gitleaks Version: 8.18.2

cc @zricethezav

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

1 participant