Description
Is your feature request related to a problem? Please describe.
To determine if a finding is a valid secret, some context of the found location is helpful.
When scanning a git repository, the file with the finding may have been removed, renamed, or the section with the finding removed or shifted. Opening the current version of the file often does not help to get the context
To get the context, the following git command can be used instead
git show [COMMIT-HASH] -L [LINENO-3],[LINENO+3]:[FILE_PATH]
All information for this command can be seen in the report from gitleaks. However, it can be a little annoying to assemble the command by hand
Describe the solution you'd like
Would it make sense to include this command in the console output for a finding, for quick copy/pasting?
Describe alternatives you've considered
-
It is of course entirely possible to make a shell script for generating this command from a json report. But it might be nice to include this functionality in gitleaks itself.
-
It took me quite a while to realize that this is actually easy to do with git. A short notice in the readme might suffice instead.
-
Instead of the git command, a link to github/gitlab would also be helpful. It is possible to link to a specific line in a specific revision of a file. However, the link format for github and gitlab are different, and there is no simple way to determine whether a given git remote might be an enterprise github or gitlab server, so this would only work for repositories hosted on the default github or gitlab
Additional context
cc @zricethezav
Activity