[Bug]: False positive alerts in AbsolutePathDetectorExperimental plugin
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 36
- Forks
- 14
- PR merge metrics
- No merged PRs in 30d
Description
Checked for duplicates
Yes - I've already checked
Website or Best Practice Guide?
Website
Describe the bug
When I ran the AbsolutePathDetectorExperimental plugin in the detect-secrets tool, I noticed it flagged lines of code comments as potential secrets, such as:
/*~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ LOG STASH ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~*/// fields returned by Elasticsearch (less fields = faster UI)
These are false positives as they are comments and not absolute paths.
What did you expect?
I expected the plugin to differentiate between actual code and code comments, and not flag comments as potential secrets.
Reproducible steps
1. Install and configure the detect-secrets tool.
2. Run the AbsolutePathDetectorExperimental plugin on a codebase containing the aforementioned comment lines.
3. Observe that these comments are flagged as potential secrets.
Environment
- Version of detect-secrets tool: `https://github.com/NASA-AMMOS/slim-detect-secrets.git@exp`
- Operating System: [e.g. MacOSX]
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the false positives with the AbsolutePathDetectorExperimental plugin using the comment examples in the issue. Locate the plugin implementation and its existing tests, then verify that comment-only lines are ignored while actual absolute paths remain detected.
Written by the indexing model from the issue text.
Assessment
- Domain
- security, tooling
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100