HTML decoder reports transformed line numbers

Please review the Community Note before submitting.

TruffleHog Version

3.97.0

Expected Behavior

Both decoder results should point to line 6, where the synthetic value appears in the source file. TruffleHog could also suppress the transformed duplicate when the plain decoder finds the same value.

Actual Behavior

The plain decoder reports line 6. The HTML decoder reports line 3 for the same value.

{"decoder":"PLAIN","line":6,"raw":"synthetic-secret-value-123456"}
{"decoder":"HTML","line":3,"raw":"synthetic-secret-value-123456"}

Steps to Reproduce

Create input.txt:

# Date format: <yyyymmdd>




token = "synthetic-secret-value-123456"

Create config.yaml:

detectors:
  - name: Line Mapping Repro
    keywords:
      - token
    regex:
      token: |-
        (?m)^token[ \t]*=[ \t]*"([^"]+)"$

Run:

trufflehog filesystem --no-update --json --concurrency=1 \
  --config=config.yaml --include-detectors=CustomRegex \
  --no-verification input.txt

Root Cause

The HTML heuristic accepts <yyyymmdd> as a tag. HTML extraction then collapses blank lines before detection. FragmentLineOffset counts newlines in the transformed chunk and adds that count to the original chunk's starting line, so the transformed result cannot identify its source line.

The bug affects any decoder that changes line structure without retaining a mapping to the source bytes.

References

• #1434 tracks the same source-mapping problem for Base64-decoded content.
• #4840 introduced the HTML decoder.