Merge branch 'AST-75295-custom-rules' of https://github.com/Checkmarx/2ms into AST-00000-custom-rules-small-fixes

Author: cx-diogo-rocha

.2ms.yml

@@ -2987,3 +2987,35 @@ ignore-result:
 - ba40bd0cfa331c71899179dbb35b2a6eb452a482 # secret found in ruleids.go
 - eeaf67842fc9be3123b8e2aea470608c2f362033 # test/development data from generic_credential.go
 - 25960f13ce160dba4f08f210370fccdca6cb51eb # FP, id not credential
+- 1019ff5ad384a9770c0db24dbeaa00499b8dba63 # unit test from e2e_test.go
+- 15a18f3e8ee97ed9fe5b7abd5840f8968a45afa0 # unit test from e2e_test.go
+- 1e61ab2a417e54226a532871b7134d026bf1d6cd # unit test from engine_test.go
+- 3833ee626018f25781466413a8b78b925314d828 # unit test from engine_test.go
+- 45b29b568529fc466bed681f705a16a87f50e6f7 # unit test from engine_test.go
+- 47b590343654def2150b375a76640ceb41477719 # unit test from engine_test.go
+- 507579c214d7bdbcfa68beee419a02badabcf99a # unit test from engine_test.go
+- 5306279b0926f22bc33366cfa7c913f72c326a2a # unit test from engine_test.go
+- 5eb82b4df0cca86ee0b21be432212a3fb9929d69 # unit test from engine_test.go
+- 673360e98a233713640729ca92718b833082380c # unit test from engine_test.go
+- 6a98649f8c9e407297f49bab69914b1b78efed4b # unit test from e2e_test.go
+- 6d228656ed5cd4d350ce8c97e7f68436399e7139 # unit test from e2e_test.go
+- 89f1b6508e21b00cbd77a540f6dfec5c08fefe95 # unit test from engine_test.go
+- 8a823c69a876c06c45e8b9d6a01ee576f72b4047 # unit test from e2e_test.go
+- 9429401f76006e61ecf6b10175952d106ce48b5e # unit test from engine_test.go
+- a00431efb72a9865f31a5a4c30f34ef6806ca312 # unit test from engine_test.go
+- a21b7f852dd9e043538c94095f5b656ca7a2bf56 # secret found in ruleids.go
+- a28534b80dff06089cf547ca728b21d2d93bd0fc # unit test from e2e_test.go
+- a34b74beb6851dced6e24ee5d5d96c46f9b4c131 # unit test from engine_test.go
+- ac2c149e54ee0df4308e6c306054b07a4717faac # unit test from engine_test.go
+- b1e59e3d53cde93a7cac720d213bd99908464fe4 # unit test from engine_test.go
+- c76e96c2c969d7722eefcc86071efcac4dc2e8ef # unit test from engine_test.go
+- c8cfc3f14d58bd6cdf18d25054b2577253c4a809 # unit test from e2e_test.go
+- cbea2411762b0ce7bd59e7461dac69069ea2e1e9 # unit test from e2e_test.go
+- d8e6840f7b21d75f3b44ec1404af4e391b67d7e2 # unit test from e2e_test.go
+- da346403524ee25eb52c68b8dbd900dfad47c4f3 # unit test from engine_test.go
+- e1a9caae63a86477a809a77a18ef745c3d3682ca # unit test from e2e_test.go
+- e2a10da9e03cb5c7ed9e8399e22c81fd6a10c237 # unit test from engine_test.go
+- e6cb4b56f380f519250ef0bd150327710d49f220 # secret found in ruleids.go
+- edb22f489a7846d8a39074541c92d27e3a88c123 # unit test from engine_test.go
+- fe01911702da491dde97b22544ea2fd7027698a4 # unit test from engine_test.go
+- 5ad4e2c9342c26b419d89ce606af840b222ddc29 # FP

engine/engine.go

@@ -387,13 +387,15 @@ func (e *Engine) detectSecrets(
 		if !isSecretIgnored(secret, e.ignoredIds, e.allowedValues, value.Line, value.Match, pluginName) {
 			// Atomically increment and check to avoid race condition
 			newCount := e.findingsCounter.Add(1)
-			if maxFindings > 0 && newCount > maxFindings {
+			if maxFindings > 0 && newCount >= maxFindings {
 				e.maxFindingsWarnOnce.Do(func() {
 					log.Warn().
 						Uint64("max_findings", maxFindings).
 						Msg("Maximum findings limit reached. Scan will stop early and report results up to this limit.")
 				})
-				break
+				if newCount > maxFindings {
+					break
+				}
 			}
 			secrets <- secret
 		} else {

engine/engine_test.go

@@ -1515,3 +1515,111 @@ third_token: ghp_abcdefghijklmnopqrstuvwxyz1234567890
 		})
 	}
 }
+
+func TestMaxFindingsWarning(t *testing.T) {
+	// Content with multiple secrets in single fragment
+	multipleSecrets := `
+github_token: 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
+another_token: ghp_1234567890abcdefghijklmnopqrstuvwxyz
+third_token: ghp_abcdefghijklmnopqrstuvwxyz1234567890
+fourth_token: ghp_9876543210zyxwvutsrqponmlkjihgfedcba
+fifth_token: ghp_aB3cD4eF5gH6iJ7kL8mN9oP0qR1sT2uV3wX4
+`
+
+	testCases := []struct {
+		name               string
+		limit              uint64
+		fragments          []string
+		expectedCount      int
+		shouldLogWarning   bool
+	}{
+		{
+			name:               "no limit - no warning",
+			limit:              0,
+			fragments:          []string{multipleSecrets},
+			expectedCount:      5,
+			shouldLogWarning:   false,
+		},
+		{
+			name:               "limit of 3 - warning logged when limit reached",
+			limit:              3,
+			fragments:          []string{multipleSecrets},
+			expectedCount:      3,
+			shouldLogWarning:   true,
+		},
+		{
+			name:  "limit of 2 across multiple fragments - warning logged",
+			limit: 2,
+			fragments: []string{
+				"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",
+				"ghp_1234567890abcdefghijklmnopqrstuvwxyz",
+				"ghp_abcdefghijklmnopqrstuvwxyz1234567890",
+			},
+			expectedCount:      2,
+			shouldLogWarning:   true,
+		},
+		{
+			name:               "limit of 1 - warning logged immediately",
+			limit:              1,
+			fragments:          []string{multipleSecrets},
+			expectedCount:      1,
+			shouldLogWarning:   true,
+		},
+		{
+			name:             "limit higher than findings - no warning",
+			limit:            10,
+			fragments:        []string{multipleSecrets},
+			expectedCount:    5,
+			shouldLogWarning: false,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			// Capture log output
+			var logsBuffer bytes.Buffer
+			log.Logger = log.Output(zerolog.ConsoleWriter{
+				Out:        &logsBuffer,
+				NoColor:    true,
+				TimeFormat: "",
+			}).Level(zerolog.WarnLevel)
+
+			eng, err := initEngine(&EngineConfig{
+				DetectorWorkerPoolSize: 1,
+				MaxFindings:            tc.limit,
+			})
+			require.NoError(t, err)
+			defer eng.Shutdown()
+
+			secretsChan := make(chan *secrets.Secret, 10)
+			fsPlugin := &plugins.FileSystemPlugin{}
+
+			for _, fragment := range tc.fragments {
+				err = eng.DetectFragment(item{content: &fragment}, secretsChan, fsPlugin.GetName())
+				require.NoError(t, err)
+			}
+
+			close(secretsChan)
+
+			count := 0
+			for range secretsChan {
+				count++
+			}
+
+			// Verify findings count
+			assert.Equal(t, tc.expectedCount, count)
+
+			// Verify warning message
+			loggedMessage := logsBuffer.String()
+			if tc.shouldLogWarning {
+				assert.Contains(t, loggedMessage, "Maximum findings limit reached",
+					"Expected warning message to be logged when limit is reached")
+				assert.Contains(t, loggedMessage, fmt.Sprintf("max_findings=%d", tc.limit),
+					"Expected max_findings value in log message")
+			} else {
+				assert.NotContains(t, loggedMessage, "Maximum findings limit reached",
+					"Warning message should not be logged when limit is not reached")
+			}
+		})
+	}
+}