handling case where auditing ini/yaml files

detect_secrets/core/audit.py

@@ -8,6 +8,7 @@
 from collections import defaultdict
 
 from ..plugins.core import initialize
+from ..plugins.high_entropy_strings import HighEntropyStringsPlugin
 from .baseline import merge_results
 from .color import BashColor
 from .color import Color
@@ -147,6 +148,7 @@ def _save_baseline_to_file(filename, data):  # pragma: no cover
 
 
 def _secret_generator(baseline):
+    """Generates secrets to audit, from the baseline"""
     current_secret_index = 1
     num_secrets_to_parse = sum(map(
         lambda filename: len(list(filter(
@@ -250,7 +252,7 @@ def _highlight_secret(secret_line, secret, filename, plugin_settings):
         plugin_settings,
     )
 
-    for raw_secret in plugin.secret_generator(secret_line):
+    for raw_secret in _raw_secret_generator(plugin, secret_line):
         secret_obj = PotentialSecret(
             plugin.secret_type,
             filename,
@@ -265,15 +267,6 @@ def _highlight_secret(secret_line, secret, filename, plugin_settings):
         # We only want to highlight the right one.
         if secret_obj.secret_hash == secret['hashed_secret']:
             break
-    else:
-        # It hits here if the secret has been moved, from the original
-        # line number listed in the baseline.
-        raise SecretNotFoundOnSpecifiedLineError(
-            textwrap.dedent("""
-                ERROR: Secret not found on specified line number!
-                Try recreating your baseline to fix this issue.
-            """)[1:-1],
-        )
 
     index_of_secret = secret_line.index(raw_secret)
     return '{}{}{}'.format(
@@ -286,6 +279,26 @@ def _highlight_secret(secret_line, secret, filename, plugin_settings):
     )
 
 
+def _raw_secret_generator(plugin, secret_line):
+    """Generates raw secrets by re-scanning the line, with the specified plugin"""
+    for raw_secret in plugin.secret_generator(secret_line):
+        yield raw_secret
+
+    if issubclass(plugin.__class__, HighEntropyStringsPlugin):
+        with plugin.non_quoted_string_regex(strict=False):
+            for raw_secret in plugin.secret_generator(secret_line):
+                yield raw_secret
+
+    # It hits here if the secret has been moved, from the original
+    # line number listed in the baseline.
+    raise SecretNotFoundOnSpecifiedLineError(
+        textwrap.dedent("""
+            ERROR: Secret not found on specified line number!
+            Try recreating your baseline to fix this issue.
+        """)[1:-1],
+    )
+
+
 def _get_user_decision(prompt_secret_decision=True):
     """
     :type prompt_secret_decision: bool

detect_secrets/plugins/high_entropy_strings.py

@@ -101,13 +101,37 @@ def secret_generator(self, string):
             if entropy_value > self.entropy_limit:
                 yield result
 
+    @contextmanager
+    def non_quoted_string_regex(self, strict=True):
+        """For certain file formats, strings need not necessarily follow the
+        normal convention of being denoted by single or double quotes. In these
+        cases, we modify the regex accordingly.
+
+        Public, because detect_secrets.core.audit needs to reference it.
+
+        :type strict: bool
+        :param strict: if True, the regex will match the entire string.
+        """
+        old_regex = self.regex
+
+        regex_alternative = r'([{}]+)'.format(re.escape(self.charset))
+        if strict:
+            regex_alternative = r'^' + regex_alternative + r'$'
+
+        self.regex = re.compile(regex_alternative)
+
+        try:
+            yield
+        finally:
+            self.regex = old_regex
+
     def _analyze_ini_file(self, file, filename):
         """
         :returns: same format as super().analyze()
         """
         potential_secrets = {}
 
-        with self._non_quoted_string_regex():
+        with self.non_quoted_string_regex():
             for value, lineno in IniFileParser(file).iterator():
                 potential_secrets.update(self.analyze_string(
                     value,
@@ -131,7 +155,7 @@ def _analyze_yaml_file(self, file, filename):
         potential_secrets = {}
 
         to_search = [data]
-        with self._non_quoted_string_regex():
+        with self.non_quoted_string_regex():
             while len(to_search) > 0:
                 item = to_search.pop()
 
@@ -155,22 +179,6 @@ def _analyze_yaml_file(self, file, filename):
 
         return potential_secrets
 
-    @contextmanager
-    def _non_quoted_string_regex(self):
-        """For certain file formats, strings need not necessarily follow the
-        normal convention of being denoted by single or double quotes. In these
-        cases, we modify the regex accordingly.
-        """
-        old_regex = self.regex
-        self.regex = re.compile(
-            r'^([%s]+)$' % re.escape(self.charset),
-        )
-
-        try:
-            yield
-        finally:
-            self.regex = old_regex
-
 
 class HexHighEntropyString(HighEntropyStringsPlugin):
     """HighEntropyStringsPlugin for hex strings"""