Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[BUG] Unable to mark markdown code blocks ignored #7

Open
barlock opened this issue May 17, 2021 · 2 comments
Open

[BUG] Unable to mark markdown code blocks ignored #7

barlock opened this issue May 17, 2021 · 2 comments

Comments

@barlock
Copy link

barlock commented May 17, 2021

Describe the bug
With a markdown code block that a secret is detected in. I'm unable to ignore the code block (and not affect the documentation).

To Reproduce
Steps to reproduce the behavior:

  1. Add the following to a markdown file
    ```bash
    export ARTIFACTORY_API_KEY="<From above>"
    export ARTIFACTORY_USER="[email protected]"
    
    # 👇 the `\` is to allow github to render a markdown code block inside another 
    # code block. It would be deleted in the test
    \```
  2. Run pre-commit
  3. See the error
    Secret Type: Secret Keyword
    Location:    docs/index.md:16
    
  4. There's no way to mark the line with ARTIFACTORY_API_KEY as allowed without changing how the documentation renders.

Expected behavior
There should be a way to ignore this false positive without ignoring the whole file.

Impact
Medium. I have to ignore the whole file instead of a single line

Additional context:

  • Operating System, MacOs
  • Languages scanned etc; Markdown
@mjdavisibm
Copy link

mjdavisibm commented Dec 8, 2022

I am having a similar issue, with markdown. I can not seem to find a way to put a comment in markdown.
e.g.

# Documentation

| Attribute | Where to look |
| ---| ---|                                            
| password                 | Secret: `mas-mongo-ce-admin-admin`->`password`           | 
| CA certificate           | ConfigMap: `mas-mongo-ce-cert-map`                              | 
| TLS Certificate          | Secret: `mas-mongo-ce-cert-secret`->`tls.crt`                   | 

running pre-commit gives

[INFO] Stashing unstaged files to /Users/matt/.cache/pre-commit/patch1670533655-25798.
Detect secrets...........................................................Failed
- hook id: detect-secrets
- exit code: 1

Potential secrets about to be committed to git repo! Please rectify.

Secret Type: Secret Keyword
Location:    MongoDB Enterprise.md:5

Secret Type: Secret Keyword
Location:    MongoDB Enterprise.md:7

Possible mitigations:

  - Mark false positives with an inline `pragma: allowlist secret`
    comment
  - Commit with `--no-verify` if this is a one-time false positive

If a secret has already been committed, visit
https://help.github.com/articles/removing-sensitive-data-from-a-
repository

[INFO] Restored changes from /Users/matt/.cache/pre-commit/patch1670533655-25798.

@bigpick
Copy link
Member

bigpick commented Dec 7, 2023

This should be covered via the --exclude-lines CLI argument; by doing an --exclude-lines "export ARTIFACTORY_API_KEY=\"<From above>\"" now,

cat issue7/test.md

```bash
export ARTIFACTORY_API_KEY="<From above>"
export ARTIFACTORY_USER="[email protected]"

# 👇 the `\` is to allow github to render a markdown code block inside another
# code block. It would be deleted in the test
\```

detect-secrets scan --update .secrets.baseline --exclude-lines "export ARTIFACTORY_API_KEY=\"<From above>\"" --all-files issue7

detect-secrets audit .secrets.baseline
Nothing to audit!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants