fix(scan): correct deduplication logic and integrate custom tab

Author: TheArqsz

src/main/java/com/arqsz/burpgitleaks/BurpExtender.java

@@ -7,6 +7,7 @@
 import com.arqsz.burpgitleaks.config.PluginSettings;
 import com.arqsz.burpgitleaks.config.RuleLoader;
 import com.arqsz.burpgitleaks.config.RuleLoader.GitleaksConfiguration;
+import com.arqsz.burpgitleaks.scan.GitleaksAuditIssueHandler;
 import com.arqsz.burpgitleaks.scan.GitleaksHttpHandler;
 import com.arqsz.burpgitleaks.scan.GitleaksScanCheck;
 import com.arqsz.burpgitleaks.ui.GitleaksContextMenuProvider;
@@ -44,7 +45,9 @@ public void initialize(MontoyaApi api) {
         ConfigResult configResult = loadInitialConfiguration(api, settings);
         GitleaksConfiguration config = configResult.config;
 
-        var components = registerComponents(api, config, settings);
+        TemplateManager templateManager = new TemplateManager(api.logging());
+
+        var components = registerComponents(api, config, settings, templateManager);
 
         handleStartupFeedback(api, config, configResult.errorMsg());
 
@@ -94,28 +97,29 @@ private ConfigResult loadInitialConfiguration(MontoyaApi api, PluginSettings set
     }
 
     private RegisteredComponents registerComponents(MontoyaApi api, GitleaksConfiguration config,
-            PluginSettings settings) {
-        TemplateManager templateManager = new TemplateManager(api.logging());
+            PluginSettings settings, TemplateManager templateManager) {
         this.issuesTab = new IssuesTab(api, ISSUES_TAB_NAME, templateManager);
 
         if (settings.isShowIssuesTab()) {
             registerIssuesTab();
         }
 
-        GitleaksScanCheck scanCheck = new GitleaksScanCheck(api, config, settings, issuesTab);
+        GitleaksScanCheck scanCheck = new GitleaksScanCheck(api, config, settings);
 
         BurpSuiteEdition edition = api.burpSuite().version().edition();
 
         if (edition == BurpSuiteEdition.COMMUNITY_EDITION) {
             api.logging().logToOutput("Community Edition detected: Activating manual traffic handler.");
-            this.communityHttpHandler = new GitleaksHttpHandler(api, scanCheck, settings);
+            this.communityHttpHandler = new GitleaksHttpHandler(api, scanCheck, settings, issuesTab);
             api.http().registerHttpHandler(communityHttpHandler);
         } else {
             api.scanner().registerPassiveScanCheck(scanCheck, ScanCheckType.PER_REQUEST);
+            GitleaksAuditIssueHandler auditHandler = new GitleaksAuditIssueHandler(issuesTab, settings);
+            api.scanner().registerAuditIssueHandler(auditHandler);
         }
 
         GitleaksContextMenuProvider menuProvider = new GitleaksContextMenuProvider(api, scanCheck, settings,
-                templateManager);
+                templateManager, issuesTab);
         api.userInterface().registerContextMenuItemsProvider(menuProvider);
 
         SettingsTab settingsTab = new SettingsTab(api, scanCheck, settings, config.rules(), (visible) -> {

src/main/java/com/arqsz/burpgitleaks/scan/GitleaksAuditIssueHandler.java

@@ -0,0 +1,29 @@
+package com.arqsz.burpgitleaks.scan;
+
+import com.arqsz.burpgitleaks.config.PluginSettings;
+import com.arqsz.burpgitleaks.ui.IssuesTab;
+
+import burp.api.montoya.scanner.audit.AuditIssueHandler;
+import burp.api.montoya.scanner.audit.issues.AuditIssue;
+
+public class GitleaksAuditIssueHandler implements AuditIssueHandler {
+
+    private final IssuesTab issuesTab;
+    private final PluginSettings settings;
+
+    public GitleaksAuditIssueHandler(IssuesTab issuesTab, PluginSettings settings) {
+        this.issuesTab = issuesTab;
+        this.settings = settings;
+    }
+
+    @Override
+    public void handleNewAuditIssue(AuditIssue auditIssue) {
+        if (!settings.isShowIssuesTab()) {
+            return;
+        }
+
+        if (auditIssue.name().startsWith("Secret leakage")) {
+            issuesTab.addIssue(auditIssue);
+        }
+    }
+}

src/main/java/com/arqsz/burpgitleaks/scan/GitleaksHttpHandler.java

@@ -4,6 +4,7 @@
 import java.util.concurrent.Executors;
 
 import com.arqsz.burpgitleaks.config.PluginSettings;
+import com.arqsz.burpgitleaks.ui.IssuesTab;
 
 import burp.api.montoya.MontoyaApi;
 import burp.api.montoya.core.ToolType;
@@ -22,11 +23,14 @@ public class GitleaksHttpHandler implements HttpHandler {
     private final GitleaksScanCheck scanCheck;
     private final PluginSettings settings;
     private final ExecutorService executor;
+    private final IssuesTab issuesTab;
 
-    public GitleaksHttpHandler(MontoyaApi api, GitleaksScanCheck scanCheck, PluginSettings settings) {
+    public GitleaksHttpHandler(MontoyaApi api, GitleaksScanCheck scanCheck, PluginSettings settings,
+            IssuesTab issuesTab) {
         this.api = api;
         this.scanCheck = scanCheck;
         this.settings = settings;
+        this.issuesTab = issuesTab;
         this.executor = Executors.newFixedThreadPool(3);
     }
 
@@ -65,6 +69,10 @@ private void runScan(HttpRequestResponse reqRes) {
 
         for (AuditIssue issue : result.auditIssues()) {
             api.siteMap().add(issue);
+
+            if (settings.isShowIssuesTab()) {
+                issuesTab.addIssue(issue);
+            }
         }
     }
 

src/main/java/com/arqsz/burpgitleaks/scan/GitleaksScanCheck.java

@@ -13,7 +13,6 @@
 import com.arqsz.burpgitleaks.config.GitleaksRule;
 import com.arqsz.burpgitleaks.config.PluginSettings;
 import com.arqsz.burpgitleaks.config.RuleLoader.GitleaksConfiguration;
-import com.arqsz.burpgitleaks.ui.IssuesTab;
 import com.arqsz.burpgitleaks.utils.Entropy;
 import com.google.re2j.Matcher;
 import com.google.re2j.Pattern;
@@ -49,20 +48,17 @@ public class GitleaksScanCheck implements PassiveScanCheck {
     private final PluginSettings settings;
     private final Logging logging;
     private final MontoyaApi api;
-    private final IssuesTab issuesTab;
 
     private record ScanState(
             List<GitleaksRule> rules,
             List<GitleaksAllowlist> allowlists,
             Trie keywordTrie) {
     }
 
-    public GitleaksScanCheck(MontoyaApi api, GitleaksConfiguration config, PluginSettings settings,
-            IssuesTab issuesTab) {
+    public GitleaksScanCheck(MontoyaApi api, GitleaksConfiguration config, PluginSettings settings) {
         this.api = api;
         this.logging = api.logging();
         this.settings = settings;
-        this.issuesTab = issuesTab;
         updateConfig(config);
     }
 
@@ -302,10 +298,6 @@ private AuditIssue createAuditIssue(GitleaksRule rule, String secret, String ful
                 AuditIssueSeverity.HIGH,
                 baseReq.withResponseMarkers(markers));
 
-        if (settings.isShowIssuesTab()) {
-            issuesTab.addIssue(issue);
-        }
-
         return issue;
     }
 

src/main/java/com/arqsz/burpgitleaks/ui/GitleaksContextMenuProvider.java

@@ -16,6 +16,7 @@
 import com.arqsz.burpgitleaks.verification.TemplateManager;
 
 import burp.api.montoya.MontoyaApi;
+import burp.api.montoya.core.BurpSuiteEdition;
 import burp.api.montoya.http.message.HttpRequestResponse;
 import burp.api.montoya.scanner.AuditResult;
 import burp.api.montoya.scanner.audit.issues.AuditIssue;
@@ -31,12 +32,14 @@ public class GitleaksContextMenuProvider implements ContextMenuItemsProvider {
     private final ExecutorService executor;
     private final PluginSettings settings;
     private final VerificationMenuFactory menuFactory;
+    private final IssuesTab issuesTab;
 
     public GitleaksContextMenuProvider(MontoyaApi api, GitleaksScanCheck scanCheck,
-            PluginSettings settings, TemplateManager templateManager) {
+            PluginSettings settings, TemplateManager templateManager, IssuesTab issuesTab) {
         this.api = api;
         this.scanCheck = scanCheck;
         this.settings = settings;
+        this.issuesTab = issuesTab;
         this.executor = Executors.newSingleThreadExecutor();
         this.menuFactory = new VerificationMenuFactory(api, templateManager);
     }
@@ -100,16 +103,27 @@ private void performManualScan(List<HttpRequestResponse> items) {
             }
 
             for (AuditIssue newIssue : result.auditIssues()) {
-                if (isAlreadyReported(newIssue)) {
+                boolean addedToTab = false;
+                if (settings.isShowIssuesTab()) {
+                    addedToTab = issuesTab.addIssue(newIssue);
+                }
+
+                boolean alreadyInSiteMap = isAlreadyReported(newIssue);
+
+                if (!alreadyInSiteMap) {
+                    api.siteMap().add(newIssue);
+                }
+
+                api.logging().logToOutput("Manual scan found issue: " + alreadyInSiteMap);
+
+                if (!alreadyInSiteMap || addedToTab) {
+                    issuesFound++;
+                } else {
                     duplicatesIgnored++;
                     if (settings.isDebugEnabled()) {
                         api.logging().logToOutput("Ignored duplicate: " + newIssue.name() + " @ " + newIssue.baseUrl());
                     }
-                    continue;
                 }
-
-                api.siteMap().add(newIssue);
-                issuesFound++;
             }
         }
 
@@ -152,6 +166,10 @@ private String buildResultToastMessage(int issuesFound, int duplicatesIgnored) {
     }
 
     private boolean isAlreadyReported(AuditIssue newIssue) {
+        if (api.burpSuite().version().edition() == BurpSuiteEdition.COMMUNITY_EDITION) {
+            return true;
+        }
+
         List<AuditIssue> existingIssues = api.siteMap().issues(
                 SiteMapFilter.prefixFilter(newIssue.baseUrl()));
 

src/main/java/com/arqsz/burpgitleaks/ui/IssuesTab.java

@@ -58,7 +58,6 @@ public class IssuesTab extends JPanel {
     private final HttpResponseEditor responseViewer;
     private final JEditorPane advisoryPane;
 
-    private final TemplateManager templateManager;
     private final VerificationMenuFactory menuFactory;
 
     private String tabTitle;
@@ -74,7 +73,6 @@ public IssuesTab(MontoyaApi api, String tabTitle, TemplateManager templateManage
             this.tabTitle = tabTitle;
         }
 
-        this.templateManager = templateManager;
         this.menuFactory = new VerificationMenuFactory(api, templateManager);
 
         this.model = new IssuesTableModel();
@@ -228,13 +226,30 @@ public void popupMenuCanceled(PopupMenuEvent e) {
         });
     }
 
-    public void addIssue(AuditIssue issue) {
-        SwingUtilities.invokeLater(() -> {
+    public boolean addIssue(AuditIssue issue) {
+        if (SwingUtilities.isEventDispatchThread()) {
             boolean added = model.add(issue);
             if (added) {
                 updateTabTitle(model.getRowCount());
             }
-        });
+            return added;
+        }
+
+        final boolean[] result = new boolean[1];
+
+        try {
+            SwingUtilities.invokeAndWait(() -> {
+                result[0] = model.add(issue);
+                if (result[0]) {
+                    updateTabTitle(model.getRowCount());
+                }
+            });
+        } catch (Exception e) {
+            api.logging().logToError("Error adding issue to tab: " + e.getMessage());
+            return false;
+        }
+
+        return result[0];
     }
 
     private void deleteSelectedIssues() {