Skip to content

Fix Bitbucket line highlighting URLs#4854

Open
shahzadhaider1 wants to merge 6 commits intotrufflesecurity:mainfrom
shahzadhaider1:INS-115-bitbucket-links-are-malformed
Open

Fix Bitbucket line highlighting URLs#4854
shahzadhaider1 wants to merge 6 commits intotrufflesecurity:mainfrom
shahzadhaider1:INS-115-bitbucket-links-are-malformed

Conversation

@shahzadhaider1
Copy link
Copy Markdown
Contributor

@shahzadhaider1 shahzadhaider1 commented Mar 31, 2026

Problem

Bitbucket source links generated by TruffleHog do not highlight the correct line when clicked.

  • Bitbucket Cloud: GenerateLink() produces /commits/{hash} URLs with no file path or line fragment. UpdateLinkLineNumber() explicitly skips Bitbucket with a comment saying "it doesn't support line links", which is incorrect.
  • Bitbucket Server/Data Center: URLs use custom domains that determineProvider() doesn't recognize, so they fall through to the default case which appends GitHub-style #L{line} fragments. This format does not work on Bitbucket Server.

Root Cause

determineProvider() only detects Bitbucket Cloud (bitbucket.org). Bitbucket Server URLs are unrecognized and treated as GitHub/GitLab. Neither Cloud nor Server gets the correct line fragment format.

Fix

GenerateLink(): Bitbucket Cloud now generates /src/{commit}/{file} URLs (matching the existing behavior in the scanner's makeCommitURL) with #lines-{line} fragments.
UpdateLinkLineNumber():

  • Bitbucket Cloud (bitbucket.org): appends #lines-{line}
  • Bitbucket Server/Data Center (detected via /projects/.../repos/... path structure): appends #{line} (bare number)

determineProvider(): New providerBitbucketServer detection using isBitbucketServerURL() which checks for the distinctive /projects/ + /repos/ path pattern in Bitbucket Server URLs.

Correct URL formats

Platform: Bitbucket Cloud
View: Source File
Fragment format: #lines-{line}

Platform: Bitbucket Server
View: Source File
Fragment format: #{line}

References

Verification

Working examples:

Checklist:

  • Tests passing (make test-community)?
  • Lint passing (make lint this requires golangci-lint)?

Testing

Scan now produces results that include the line number in the secret location URL and upon clicking those URLs, the secrets are correctly highlighted, as shown in the screenshots below:
image
image
image


Note

Low Risk
Low risk: changes are limited to URL/provider detection and link formatting, with added unit tests; primary impact is on generated report links for Bitbucket Cloud/Server.

Overview
Fixes Bitbucket links so TruffleHog can deep-link to the correct source file and highlighted line.

GenerateLink now produces Bitbucket Cloud /src/{commit}/{file} URLs (optionally with #lines-{N}), and UpdateLinkLineNumber updates Bitbucket Cloud fragments using the lines-{N} format while adding Bitbucket Server/Data Center support via new provider detection (/projects/.../repos/...) that uses #{N} fragments. Tests are expanded to cover the new Bitbucket Cloud and Bitbucket Server behaviors.

Reviewed by Cursor Bugbot for commit 4f22ca1. Bugbot is set up for automated code reviews on this repo. Configure here.

@shahzadhaider1 shahzadhaider1 marked this pull request as ready for review March 31, 2026 13:19
@shahzadhaider1 shahzadhaider1 requested a review from a team March 31, 2026 13:19
@shahzadhaider1 shahzadhaider1 requested review from a team as code owners March 31, 2026 13:19
Copy link
Copy Markdown
Contributor

@alafiand alafiand left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This looks like a good fix to make these links more useful. I imagine downstream consumers of these links could have systems in place relying on the old URL format, but I can't imagine they will be upset to see that the links have been fixed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants