Skip to content

Fix Bitbucket line highlighting URLs#4854

Open
shahzadhaider1 wants to merge 5 commits intotrufflesecurity:mainfrom
shahzadhaider1:INS-115-bitbucket-links-are-malformed
Open

Fix Bitbucket line highlighting URLs#4854
shahzadhaider1 wants to merge 5 commits intotrufflesecurity:mainfrom
shahzadhaider1:INS-115-bitbucket-links-are-malformed

Conversation

@shahzadhaider1
Copy link
Copy Markdown
Contributor

@shahzadhaider1 shahzadhaider1 commented Mar 31, 2026

Problem

Bitbucket source links generated by TruffleHog do not highlight the correct line when clicked.

  • Bitbucket Cloud: GenerateLink() produces /commits/{hash} URLs with no file path or line fragment. UpdateLinkLineNumber() explicitly skips Bitbucket with a comment saying "it doesn't support line links", which is incorrect.
  • Bitbucket Server/Data Center: URLs use custom domains that determineProvider() doesn't recognize, so they fall through to the default case which appends GitHub-style #L{line} fragments. This format does not work on Bitbucket Server.

Root Cause

determineProvider() only detects Bitbucket Cloud (bitbucket.org). Bitbucket Server URLs are unrecognized and treated as GitHub/GitLab. Neither Cloud nor Server gets the correct line fragment format.

Fix

GenerateLink(): Bitbucket Cloud now generates /src/{commit}/{file} URLs (matching the existing behavior in the scanner's makeCommitURL) with #lines-{line} fragments.
UpdateLinkLineNumber():

  • Bitbucket Cloud (bitbucket.org): appends #lines-{line}
  • Bitbucket Server/Data Center (detected via /projects/.../repos/... path structure): appends #{line} (bare number)

determineProvider(): New providerBitbucketServer detection using isBitbucketServerURL() which checks for the distinctive /projects/ + /repos/ path pattern in Bitbucket Server URLs.

Correct URL formats

Platform: Bitbucket Cloud
View: Source File
Fragment format: #lines-{line}

Platform: Bitbucket Server
View: Source File
Fragment format: #{line}

References

Verification

Working examples:

Checklist:

  • Tests passing (make test-community)?
  • Lint passing (make lint this requires golangci-lint)?

Testing

Scan now produces results that include the line number in the secret location URL and upon clicking those URLs, the secrets are correctly highlighted, as shown in the screenshots below:
image
image
image


Note

Low Risk
Low risk: changes are confined to URL generation/updating logic and add targeted tests; main impact is altered Bitbucket link formats which could affect consumers relying on the previous (incorrect) URLs.

Overview
Fixes Bitbucket link generation so reported secret locations deep-link to the correct file and line.

Bitbucket Cloud links now use /src/{commit}/{file}#lines-{n} and UpdateLinkLineNumber can add/replace the lines- fragment; Bitbucket Server/Data Center URLs are newly detected via /projects/.../repos/... paths and updated using #{n} fragments. Tests are expanded to cover the new Bitbucket Cloud/Server behaviors.

Reviewed by Cursor Bugbot for commit 27b3a64. Bugbot is set up for automated code reviews on this repo. Configure here.

@shahzadhaider1 shahzadhaider1 marked this pull request as ready for review March 31, 2026 13:19
@shahzadhaider1 shahzadhaider1 requested a review from a team March 31, 2026 13:19
@shahzadhaider1 shahzadhaider1 requested review from a team as code owners March 31, 2026 13:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants