Skip to content

# trufflehog:ignore not honored for Postgres URLs without an explicit port #4962

@mrstanwell

Description

@mrstanwell

TruffleHog Version

  • 3.95.3

Trace Output

https://gist.github.com/mrstanwell/dbd00c7ae2996dedcf8a83aca6d06b16

Expected Behavior

# trufflehog:ignore on a line containing a Postgres URL suppresses the finding regardless of whether the URL includes an explicit port number.

Actual Behavior

When a Postgres URL omits the port (e.g. postgresql://user:pass@host/db), # trufflehog:ignore does not suppress the finding. Adding an explicit :5432 to the same URL makes the annotation work correctly.

Steps to Reproduce

# Case 1: no explicit port — trufflehog:ignore is NOT honored (exit 183)
printf 'DB=postgresql://user:secret@host/db  # trufflehog:ignore\n' > /tmp/config.env
trufflehog filesystem /tmp/config.env --fail
echo "exit: $?"

# Case 2: explicit port — trufflehog:ignore IS honored (exit 0)
printf 'DB=postgresql://user:secret@host:5432/db  # trufflehog:ignore\n' > /tmp/config.env
trufflehog filesystem /tmp/config.env --fail
echo "exit: $?"

Workaround

Add a port number to the postgres URL and the # trufflehog:ignore directive will be honored.

Environment

  • OS: macOS 15.7.3

Additional Context

I notice that the output shows Raw result: postgresql://user:secret@host:5432, even when there was no actual port number in the URL in the file. That is not, in fact, a "raw" result; and I suspect it is causing a !found result in FragmentLineOffset, thus pre-empting the check for the ignore tag. (I considered submitting a fix, but I don't know why the URL is being normalized with the port number included, or what the implications would be of not doing that...)

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions