NASA-AMMOS / NASA-AMMOS/slim

[Bug]: False positive alerts in AbsolutePathDetectorExperimental plugin

Open
#99 11 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug high complexity most requested software lifecycle
Dominant language
JavaScript
Stars
36
Forks
14
PR merge metrics
No merged PRs in 30d

Description

Checked for duplicates

Yes - I've already checked

Website or Best Practice Guide?

Website

Describe the bug

When I ran the AbsolutePathDetectorExperimental plugin in the detect-secrets tool, I noticed it flagged lines of code comments as potential secrets, such as:

  • /*~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ LOG STASH ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~*/
  • // fields returned by Elasticsearch (less fields = faster UI)

These are false positives as they are comments and not absolute paths.

What did you expect?

I expected the plugin to differentiate between actual code and code comments, and not flag comments as potential secrets.

Reproducible steps
1. Install and configure the detect-secrets tool.
2. Run the AbsolutePathDetectorExperimental plugin on a codebase containing the aforementioned comment lines.
3. Observe that these comments are flagged as potential secrets.
Environment
- Version of detect-secrets tool: `https://github.com/NASA-AMMOS/slim-detect-secrets.git@exp`
- Operating System: [e.g. MacOSX]

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the false positives with the AbsolutePathDetectorExperimental plugin using the comment examples in the issue. Locate the plugin implementation and its existing tests, then verify that comment-only lines are ignored while actual absolute paths remain detected.

Written by the indexing model from the issue text.

Assessment

Domain
security, tooling
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.