Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Line of code calculation is wrong for sequential identical secrets #2502

Open
0x736E opened this issue Feb 24, 2024 · 0 comments
Open

Line of code calculation is wrong for sequential identical secrets #2502

0x736E opened this issue Feb 24, 2024 · 0 comments
Labels

Comments

@0x736E
Copy link

0x736E commented Feb 24, 2024

Please review the Community Note before submitting

TruffleHog Version

v3.4.3 to present

Trace Output

N/A

Expected Behavior

Should calculate the line of code correctly.

Actual Behavior

The line of code is not correctly calculated.

When the same "raw" secret value is stored sequentially, the line of code value for each subsequent occurrence is the same as the first instance instead of each having their correct line number calculated.

Steps to Reproduce

  1. Create a file with multiple instances (at least two) of the exact same secret, one after another. The secret must contain the exact same value, and type.
  2. Optionally add the file to a git repo
  3. Scan the file with TruffleHog v3.4.3 or later.

Environment

  • OS: All
  • Version: v3.4.3 or later

Additional Context

Root cause analysis documented in detail here: https://github.com/0x736E/trufflehog_v3_loc_bug

When there are multiple secrets of the same type, in the same data "chunk", TruffleHog incorrectly reports all secrets with the same raw value as having the same line of code.

References

@0x736E 0x736E added the bug label Feb 24, 2024
@0x736E 0x736E changed the title rew Line of code calculation is wrong for sequential identical secrets Feb 24, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Development

No branches or pull requests

1 participant