From 7c7facf03271c81fa3b06af4bc6944bb2fecc9ca Mon Sep 17 00:00:00 2001
From: Cody Rose <webmaster@codyro.se>
Date: Wed, 28 Jan 2026 15:09:04 -0500
Subject: [PATCH] Add some false positive tests #4703

There are automated tests that validate the behavior of IsKnownFalsePositive and FilterKnownFalsePositives, but none that validate GetFalsePositiveCheck. I hope to soon delete FilterKnownFalsePositives, which would leave this area of the code under-tested. This commit adds some tests for GetFalsePositiveCheck so that we can eventually remove FilterKnownFalsePositives without losing overall test coverage.
---
 pkg/detectors/falsepositives_test.go | 44 ++++++++++++++++++++++++++++
 1 file changed, 44 insertions(+)

diff --git a/pkg/detectors/falsepositives_test.go b/pkg/detectors/falsepositives_test.go
index 7d3cedafc..6884ebca4 100644
--- a/pkg/detectors/falsepositives_test.go
+++ b/pkg/detectors/falsepositives_test.go
@@ -32,6 +32,50 @@ func (d customFalsePositiveChecker) IsFalsePositive(result Result) (bool, string
 	return IsKnownFalsePositive(string(result.Raw), map[FalsePositive]struct{}{"a specific magic string": {}}, false)
 }
 
+// This test validates that GetFalsePositiveCheck, when invoked on a detector that does not implement
+// CustomFalsePositiveChecker, returns a predicate that behaves as expected.
+func TestGetFalsePositiveCheck_DefaultLogic(t *testing.T) {
+	testCases := []struct {
+		raw             string
+		isFalsePositive bool
+	}{
+		{"00000", true},  // "default" false positive list
+		{"number", true}, // from wordlist
+		{"00000000-0000-0000-0000-000000000000", true}, // from uuid list
+		{"xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx", true}, // from uuid list
+		{"hga8adshla3434g", false},
+		{"f795f7db-2dfe-4095-96f3-8f8370c735f9", false},
+	}
+
+	for _, tt := range testCases {
+		isFalsePositive, _ := GetFalsePositiveCheck(fakeDetector{})(Result{Raw: []byte(tt.raw)})
+		assert.Equal(t, tt.isFalsePositive, isFalsePositive, "secret %q had unexpected false positive status", tt.raw)
+	}
+}
+
+// This test validates that GetFalsePositiveCheck, when invoked on a detector that implements
+// CustomFalsePositiveChecker, returns a predicate that behaves as expected. (Specifically, the predicate should not
+// flag secrets that are present in the standard false positive lists.)
+func TestGetFalsePositiveCheck_CustomLogic(t *testing.T) {
+	testCases := []struct {
+		raw             string
+		isFalsePositive bool
+	}{
+		{"a specific magic string", true}, // the specific value the custom checker is looking for
+		{"00000", false},
+		{"number", false},
+		{"00000000-0000-0000-0000-000000000000", false},
+		{"xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx", false},
+		{"hga8adshla3434g", false},
+		{"f795f7db-2dfe-4095-96f3-8f8370c735f9", false},
+	}
+
+	for _, tt := range testCases {
+		isFalsePositive, _ := GetFalsePositiveCheck(customFalsePositiveChecker{})(Result{Raw: []byte(tt.raw)})
+		assert.Equal(t, tt.isFalsePositive, isFalsePositive, "secret %q had unexpected false positive status", tt.raw)
+	}
+}
+
 func TestFilterKnownFalsePositives_DefaultLogic(t *testing.T) {
 	results := []Result{
 		{Raw: []byte("00000")},  // "default" false positive list