gitleaks / gitleaks/gitleaks

targetRules field in [[allowLists]] is ignored

Open
#1,919 1 comment 0 reactions 0 assignees View on GitHub
bug
Dominant language
Go
Stars
29.3k
Forks
2.2k
PR merge metrics
No merged PRs in 30d

Description

**Describe the bug**
Cannot ignore certain rule in the paths using extended configuration with common allowlists

**To Reproduce**
Create sample file `log.xml` in the directory:
```xml





```

Place gitleaks configuration in the same directory:
```
title = "Custom Gitleaks configuration"

[extend]
useDefault = true

[[allowlists]]
targetRules = ["generic-api-key"]
description = "Our test assets trigger false-positives"
paths = ['''log\.xml$''']
```

Scan directory
```
❯ gitleaks dir --verbose --no-banner --log-level trace
2:00PM DBG using github.com/wasilibs/go-re2 regex engine
2:00PM DBG using existing gitleaks config .gitleaks.toml from `(--source)/.gitleaks.toml`
2:00PM DBG extending config with default config
2:00PM DBG skipping file: global allowlist path=.gitleaks.toml
2:00PM TRC scanning path path=log.xml
Finding: ...e="Rename Refactor" Key="8e4f73c6-79b6-4500-aa26-55bbf2188fb4" ChangeDateTime="04/...
Secret: 8e4f73c6-79b6-4500-aa26-55bbf2188fb4
RuleID: generic-api-key
Entropy: 3.842857
File: log.xml
Line: 3
Fingerprint: log.xml:generic-api-key:3

2:00PM INF scanned ~470 bytes (470 bytes) in 37ms
2:00PM WRN leaks found: 1
```

**Expected behavior**

All findings of the rule `generic-api-key` should be ignored in the `log.xml` file.
> INF no leaks found

**Basic Info (please complete the following information):**
- OS: Windows / Linux
- Gitleaks Version: 8.27.2

**Additional context**
`targetRules` field is copy-pasted as provided in example configuration in the documentation.
If I remove the line with `targetRules`, the path is ignored
```
[[allowlists]]
description = "Our test assets trigger false-positives"
paths = ['''log\.xml$''']
```
Result is: no leaks found

cc @zricethezav

Contributor guide

Open the contributing guide

Research direction

Reproduce the issue with the shown log.xml and .gitleaks.toml configuration, comparing an allowlist with and without targetRules. Trace how targetRules and paths are applied during the gitleaks directory scan; done means the generic-api-key finding in log.xml is ignored when both fields are present.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
cli, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.