HTML decoder reports transformed line numbers

[gaborbernat]

Please review the Community Note
before submitting.

TruffleHog Version

3.97.0

Expected Behavior

Both decoder results should point to line 6, where the synthetic value appears in the source file. TruffleHog could also
suppress the transformed duplicate when the plain decoder finds the same value.

Actual Behavior

The plain decoder reports line 6. The HTML decoder reports line 3 for the same value.

{"decoder":"PLAIN","line":6,"raw":"synthetic-secret-value-123456"}
{"decoder":"HTML","line":3,"raw":"synthetic-secret-value-123456"}

Steps to Reproduce

Create input.txt:

# Date format: <yyyymmdd>




token = "synthetic-secret-value-123456"

Create config.yaml:

detectors:
  - name: Line Mapping Repro
    keywords:
      - token
    regex:
      token: |-
        (?m)^token[ \t]*=[ \t]*"([^"]+)"$

Run:

trufflehog filesystem --no-update --json --concurrency=1 \
  --config=config.yaml --include-detectors=CustomRegex \
  --no-verification input.txt

Root Cause

The HTML heuristic accepts <yyyymmdd> as a tag. HTML extraction then collapses blank lines before detection.
FragmentLineOffset counts newlines in the transformed chunk and adds that count to the original chunk's starting line,
so the transformed result cannot identify its source line.

The bug affects any decoder that changes line structure without retaining a mapping to the source bytes.

References

• Incorrect Line reported for Base64-encoded JSON Credentials #1434 tracks the same source-mapping problem for Base64-decoded content.
• Add HTML decoder for secret detection in HTML-formatted sources #4840 introduced the HTML decoder.