TruffleHog Version
Trace Output
https://gist.github.com/mrstanwell/dbd00c7ae2996dedcf8a83aca6d06b16
Expected Behavior
# trufflehog:ignore on a line containing a Postgres URL suppresses the finding regardless of whether the URL includes an explicit port number.
Actual Behavior
When a Postgres URL omits the port (e.g. postgresql://user:pass@host/db), # trufflehog:ignore does not suppress the finding. Adding an explicit :5432 to the same URL makes the annotation work correctly.
Steps to Reproduce
# Case 1: no explicit port — trufflehog:ignore is NOT honored (exit 183)
printf 'DB=postgresql://user:secret@host/db # trufflehog:ignore\n' > /tmp/config.env
trufflehog filesystem /tmp/config.env --fail
echo "exit: $?"
# Case 2: explicit port — trufflehog:ignore IS honored (exit 0)
printf 'DB=postgresql://user:secret@host:5432/db # trufflehog:ignore\n' > /tmp/config.env
trufflehog filesystem /tmp/config.env --fail
echo "exit: $?"
Workaround
Add a port number to the postgres URL and the # trufflehog:ignore directive will be honored.
Environment
Additional Context
I notice that the output shows Raw result: postgresql://user:secret@host:5432, even when there was no actual port number in the URL in the file. That is not, in fact, a "raw" result; and I suspect it is causing a !found result in FragmentLineOffset, thus pre-empting the check for the ignore tag. (I considered submitting a fix, but I don't know why the URL is being normalized with the port number included, or what the implications would be of not doing that...)
TruffleHog Version
Trace Output
https://gist.github.com/mrstanwell/dbd00c7ae2996dedcf8a83aca6d06b16
Expected Behavior
# trufflehog:ignoreon a line containing a Postgres URL suppresses the finding regardless of whether the URL includes an explicit port number.Actual Behavior
When a Postgres URL omits the port (e.g.
postgresql://user:pass@host/db),# trufflehog:ignoredoes not suppress the finding. Adding an explicit:5432to the same URL makes the annotation work correctly.Steps to Reproduce
Workaround
Add a port number to the postgres URL and the
# trufflehog:ignoredirective will be honored.Environment
Additional Context
I notice that the output shows
Raw result: postgresql://user:secret@host:5432, even when there was no actual port number in the URL in the file. That is not, in fact, a "raw" result; and I suspect it is causing a!foundresult inFragmentLineOffset, thus pre-empting the check for the ignore tag. (I considered submitting a fix, but I don't know why the URL is being normalized with the port number included, or what the implications would be of not doing that...)