targetRules field in [[allowLists]] is ignored
- Dominant language
- Go
- Stars
- 29.3k
- Forks
- 2.2k
- PR merge metrics
- No merged PRs in 30d
Description
**Describe the bug**
Cannot ignore certain rule in the paths using extended configuration with common allowlists
**To Reproduce**
Create sample file `log.xml` in the directory:
```xml
```
Place gitleaks configuration in the same directory:
```
title = "Custom Gitleaks configuration"
[extend]
useDefault = true
[[allowlists]]
targetRules = ["generic-api-key"]
description = "Our test assets trigger false-positives"
paths = ['''log\.xml$''']
```
Scan directory
```
❯ gitleaks dir --verbose --no-banner --log-level trace
2:00PM DBG using github.com/wasilibs/go-re2 regex engine
2:00PM DBG using existing gitleaks config .gitleaks.toml from `(--source)/.gitleaks.toml`
2:00PM DBG extending config with default config
2:00PM DBG skipping file: global allowlist path=.gitleaks.toml
2:00PM TRC scanning path path=log.xml
Finding: ...e="Rename Refactor" Key="8e4f73c6-79b6-4500-aa26-55bbf2188fb4" ChangeDateTime="04/...
Secret: 8e4f73c6-79b6-4500-aa26-55bbf2188fb4
RuleID: generic-api-key
Entropy: 3.842857
File: log.xml
Line: 3
Fingerprint: log.xml:generic-api-key:3
2:00PM INF scanned ~470 bytes (470 bytes) in 37ms
2:00PM WRN leaks found: 1
```
**Expected behavior**
All findings of the rule `generic-api-key` should be ignored in the `log.xml` file.
> INF no leaks found
**Basic Info (please complete the following information):**
- OS: Windows / Linux
- Gitleaks Version: 8.27.2
**Additional context**
`targetRules` field is copy-pasted as provided in example configuration in the documentation.
If I remove the line with `targetRules`, the path is ignored
```
[[allowlists]]
description = "Our test assets trigger false-positives"
paths = ['''log\.xml$''']
```
Result is: no leaks found
cc @zricethezav
Contributor guide
Research direction
Reproduce the issue with the shown log.xml and .gitleaks.toml configuration, comparing an allowlist with and without targetRules. Trace how targetRules and paths are applied during the gitleaks directory scan; done means the generic-api-key finding in log.xml is ignored when both fields are present.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- cli, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 38/100