Skip to content

Fix Bitbucket line highlighting URLs#4854

Open
shahzadhaider1 wants to merge 4 commits intotrufflesecurity:mainfrom
shahzadhaider1:INS-115-bitbucket-links-are-malformed
Open

Fix Bitbucket line highlighting URLs#4854
shahzadhaider1 wants to merge 4 commits intotrufflesecurity:mainfrom
shahzadhaider1:INS-115-bitbucket-links-are-malformed

Conversation

@shahzadhaider1
Copy link
Copy Markdown
Contributor

@shahzadhaider1 shahzadhaider1 commented Mar 31, 2026

Problem

Bitbucket source links generated by TruffleHog do not highlight the correct line when clicked.

  • Bitbucket Cloud: GenerateLink() produces /commits/{hash} URLs with no file path or line fragment. UpdateLinkLineNumber() explicitly skips Bitbucket with a comment saying "it doesn't support line links", which is incorrect.
  • Bitbucket Server/Data Center: URLs use custom domains that determineProvider() doesn't recognize, so they fall through to the default case which appends GitHub-style #L{line} fragments. This format does not work on Bitbucket Server.

Root Cause

determineProvider() only detects Bitbucket Cloud (bitbucket.org). Bitbucket Server URLs are unrecognized and treated as GitHub/GitLab. Neither Cloud nor Server gets the correct line fragment format.

Fix

GenerateLink(): Bitbucket Cloud now generates /src/{commit}/{file} URLs (matching the existing behavior in the scanner's makeCommitURL) with #lines-{line} fragments.
UpdateLinkLineNumber():

  • Bitbucket Cloud (bitbucket.org): appends #lines-{line}
  • Bitbucket Server/Data Center (detected via /projects/.../repos/... path structure): appends #{line} (bare number)

determineProvider(): New providerBitbucketServer detection using isBitbucketServerURL() which checks for the distinctive /projects/ + /repos/ path pattern in Bitbucket Server URLs.

Correct URL formats

Platform: Bitbucket Cloud
View: Source File
Fragment format: #lines-{line}

Platform: Bitbucket Server
View: Source File
Fragment format: #{line}

References

Verification

Working examples:

Checklist:

  • Tests passing (make test-community)?
  • Lint passing (make lint this requires golangci-lint)?

Testing

Scan now produces results that include the line number in the secret location URL and upon clicking those URLs, the secrets are correctly highlighted, as shown in the screenshots below:
image
image
image


Note

Medium Risk
Changes how Bitbucket links are generated/updated, which can affect all reported secret location URLs for Bitbucket users (cloud and self-hosted). Risk is mainly correctness/regression in URL formatting and provider detection logic.

Overview
Fixes Bitbucket source-file URL generation so reported locations can deep-link and highlight the correct line.

GenerateLink now builds Bitbucket Cloud /src/{commit}/{file} URLs and appends #lines-{N} when a line is provided, and UpdateLinkLineNumber now adds/replaces Bitbucket Cloud line fragments instead of skipping them.

Adds Bitbucket Server/Data Center detection (via /projects/.../repos/... path structure) and updates line-number fragments for those links to use bare #{N}; tests are expanded to cover the new Bitbucket Cloud and Server behaviors.

Written by Cursor Bugbot for commit fde5ec2. This will update automatically on new commits. Configure here.

@shahzadhaider1 shahzadhaider1 marked this pull request as ready for review March 31, 2026 13:19
@shahzadhaider1 shahzadhaider1 requested a review from a team March 31, 2026 13:19
@shahzadhaider1 shahzadhaider1 requested review from a team as code owners March 31, 2026 13:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants