Repository: gitleaks/gitleaks (go)

Issue:
Rule-specific allowlist paths not working with extend useDefault = true
## Gitleaks Issue Report

**Describe the bug**
Rule-specific allowlist `paths` configuration does not seem to be applied or evaluated when extending the default configuration using `[extend] useDefault = true`. Findings within the specified path are still reported by the targeted rule, contrary to expectations.

**To Reproduce**
Steps to reproduce the behavior:

1. Create a `.gitleaks.toml` file with the following content:

    ```toml
    [extend]
    useDefault = true

    [[rules]]
      id = "generic-api-key"
      [[rules.allowlists]]
        description = "Exclude a specific file from generic-api-key rule"
        paths = [
          '''^path/to/your/problematic/file\.js$'''
        ]
    ```

2. Ensure a file exists at the path `path/to/your/problematic/file.js` (relative to the execution directory) containing content that triggers the `generic-api-key` rule (e.g., a false positive like `.keys,b=a.length-1;`).
3. Run the command: `gitleaks dir -v -c .gitleaks.toml -l debug`

**Expected behavior**
The file `path/to/your/problematic/file.js` should **not** be reported as a finding by the `generic-api-key` rule. The debug log should ideally show evidence that the rule-specific `paths` allowlist was evaluated and matched for this file and rule.

**Screenshots**
N/A. Debug logs provide the necessary evidence.

**Basic Info (please complete the following information):**

* OS: **macOS Sequoia 15.4.1**
* Gitleaks Version: v8.25.0

**Additional context**

* The primary goal is to use rule-specific `paths` allowlisting as described in the documentation, not global allowlists or `.gitleaksignore`.
* The configuration method (extending defaults and adding `[[rules.allowlists]]` with `paths` to a specific rule ID) appears consistent with the Gitleaks documentation examples.
* Debug logs (`-l debug`) clearly show that:
  * The configuration file is loaded.
  * Default config extension occurs.
  * **Global** allowlist paths (`[[allowlists]]`) are correctly evaluated and skip files.
  * **However, there is no log entry indicating the evaluation or application of the rule-specific `paths` allowlist** (`^path/to/your/problematic/file\.js$`) for the `generic-api-key` rule.
* The finding for the specified file and rule (`generic-api-key`) is still present in the final output.
* This discrepancy suggests a potential issue (bug or undocumented limitation) in how Gitleaks v8.25.0 handles the merging or application of rule-specific `paths` allowlists when `[extend] useDefault = true` is active.

cc @zricethezav


Pull request:
Fix rule-specific allowlist paths not working
### Description:
Fixes #1844. Doing `return` caused the function to potentially exit before testing all allowlists. An oversight on my part.

### Checklist:

* [x] Does your PR pass tests?
* [x] Have you written new tests for your changes?
* [x] Have you lint your code locally prior to submission?


Patch:
diff --git a/detect/detect.go b/detect/detect.go
index 793f67c..5a9d887 100644
--- a/detect/detect.go
+++ b/detect/detect.go
@@ -547,10 +547,10 @@ func checkCommitOrPathAllowed(
 			}
 			// These will be checked later.
 			if len(a.Regexes) > 0 {
-				return false, nil
+				continue
 			}
 			if len(a.StopWords) > 0 {
-				return false, nil
+				continue
 			}
 
 			isAllowed = allTrue(allowlistChecks)


Test patch:
diff --git a/detect/detect_test.go b/detect/detect_test.go
index df18383..1000e3d 100644
--- a/detect/detect_test.go
+++ b/detect/detect_test.go
@@ -376,6 +376,13 @@ const token = "mockSecret";
 				FilePath: "tmp.go",
 			},
 		},
+		"allowlist - ignore path when extending": {
+			cfgName: "valid/allowlist_rule_extend_default",
+			fragment: Fragment{
+				Raw:      `token = "aebfab88-7596-481d-82e8-c60c8f7de0c0"`,
+				FilePath: "path/to/your/problematic/file.js",
+			},
+		},
 		"allowlist - ignore regex": {
 			cfgName: "valid/allowlist_rule_regex",
 			fragment: Fragment{
diff --git a/testdata/config/valid/allowlist_rule_extend_default.toml b/testdata/config/valid/allowlist_rule_extend_default.toml
new file mode 100644
index 0000000..4fe41d5
--- /dev/null
+++ b/testdata/config/valid/allowlist_rule_extend_default.toml
@@ -0,0 +1,11 @@
+# https://github.com/gitleaks/gitleaks/issues/1844
+[extend]
+useDefault = true
+
+[[rules]]
+id = "generic-api-key"
+[[rules.allowlists]]
+description = "Exclude a specific file from generic-api-key rule"
+paths = [
+    '''^path/to/your/problematic/file\.js$'''
+]