Skip to content

Conversation

@shinsj4653
Copy link

Description

Fixes an issue where the filter parameter would match unintended patterns due to substring collision. For example, searching for "US Tax Identification Number Scanner" would also match "Cyprus Tax Identification Number Scanner" because "Cyprus" ends with "us".

Closes #3370

Changes

  • Modified dataSourceDatadogSensitiveDataScannerStandardPatternRead() to prioritize exact match over partial match
  • When filter exactly matches a pattern name, that pattern is returned immediately
  • Partial match (case-insensitive contains) is used as fallback when no exact match exists
  • Added unit tests for the new matching logic
  • Added acceptance test case for exact match scenario

Root Cause

The filter logic only used strings.Contains() for matching, which caused false positives when the search term appeared as a substring in other pattern names.

// Before: Only partial match
if strings.Contains(strings.ToLower(name), strings.ToLower(searchedName)) {
foundStandardPatterns = append(foundStandardPatterns, resource)
}

// After: Exact match takes priority
if name == searchedName {
exactMatch = &match
break
}

Testing

=== RUN   TestExactMatchPriority
=== RUN   TestExactMatchPriority/exact_match_foundPASS
=== RUN   TestExactMatchPriority/exact_match_priority_over_partialPASS
=== RUN   TestExactMatchPriority/partial_match_singlePASS
=== RUN   TestExactMatchPriority/partial_match_multiple_errorPASS
=== RUN   TestExactMatchPriority/no_matchPASS
--- PASS: TestExactMatchPriority
  • Unit tests for exact match priority logic - all 5 cases pass
  • Build verification - success
  • Existing functionality preserved (partial match still works as fallback)

… multiple patterns due to substring collision
@shinsj4653 shinsj4653 requested review from a team as code owners January 7, 2026 07:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

datadog_sensitive_data_scanner_standard_pattern lower case search causes side effects

1 participant