Skip to content

Fix Trufflehog SARIF Results Bugs#9

Merged
davidus27 merged 7 commits into
seznam:stagingfrom
ByteMastermind:staging
Apr 20, 2026
Merged

Fix Trufflehog SARIF Results Bugs#9
davidus27 merged 7 commits into
seznam:stagingfrom
ByteMastermind:staging

Conversation

@ByteMastermind
Copy link
Copy Markdown
Contributor

A bug was found when running the trufflehog inside GSAST without parameter --only-verified. After further investigation, several more bugs were found, namely:

  • Rule ID mapper key mismatch - The detectors_count_mapper in convert_trufflehog_to_sarif() was stored using detector_name as key but looked up using rule_id_hash.hexdigest(). Since defaultdict(int) returns 0 for any unseen key, almost all findings ended up with the same rule ID "trufflehog - git 1", causing different detector types to collide and get mixed together.

  • Duplicate rules created for every finding - A new rule was appended to driver_rules for every single finding, instead of once per unique detector type. With --only-verified off this meant thousands of duplicate rule entries in the SARIF output.

  • Results storage overwrite - In store_scan_results(), the loop over split SARIF files always used the same key stored_results[scanner_type], so each iteration overwrote the previous one. Only the last split file was kept, the rest were silently lost.

  • Empty line handling in has_findings_trufflehog() - The function didn't strip empty lines before calling json.loads(), so a trailing newline in the TruffleHog output caused a JSONDecodeError and the function returned False even when findings existed.

All these bugs should be handled by the suggested changes. I tested ONLY the json -> SARIF "pipeline" of GSAST, did not try it as a whole.

@davidus27 davidus27 merged commit 81bf631 into seznam:staging Apr 20, 2026
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants