feat(secret): truncate matched line if it is long (fanal#494)

secret/scanner.go

@@ -392,6 +392,11 @@ func findLocation(start, end int, content []byte) (int, int, string) {
 
 	match := string(content[start:end])
 	matchLine := string(content[lineStart:lineEnd])
+	if len(matchLine) > 100 {
+		truncatedLineStart := lo.Ternary(start-30 < 0, 0, start-30)
+		truncatedLineEnd := lo.Ternary(end+20 > len(content), len(content), end+20)
+		matchLine = string(content[truncatedLineStart:truncatedLineEnd])
+	}
 
 	// Mask credentials
 	matchLine = strings.TrimSpace(strings.ReplaceAll(matchLine, match, "*****"))

secret/scanner_test.go

@@ -75,6 +75,15 @@ func TestSecretScanner(t *testing.T) {
 		EndLine:   1,
 		Match:     "GITHUB_PAT=*****",
 	}
+	wantFinding7 := types.SecretFinding{
+		RuleID:    "github-pat",
+		Category:  secret.CategoryGitHub,
+		Title:     "GitHub Personal Access Token",
+		Severity:  "CRITICAL",
+		StartLine: 1,
+		EndLine:   1,
+		Match:     "aaaaaaaaaaaaaaaaaa GITHUB_PAT=***** bbbbbbbbbbbbbbbbbbb",
+	}
 
 	tests := []struct {
 		name          string
@@ -216,6 +225,14 @@ func TestSecretScanner(t *testing.T) {
 				Findings: []types.SecretFinding{wantFinding3, wantFinding4},
 			},
 		},
+		{
+			name:          "truncate long line",
+			inputFilePath: "testdata/long-line-secret.txt",
+			want: types.Secret{
+				FilePath: "testdata/long-line-secret.txt",
+				Findings: []types.SecretFinding{wantFinding7},
+			},
+		},
 	}
 
 	for _, tt := range tests {

secret/testdata/long-line-secret.txt

@@ -0,0 +1 @@
+aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa GITHUB_PAT=ghp_012345678901234567890123456789abcdef bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb