Catch more cases for IAM (Yelp#414)

* Catch more cases for IAM * Fix build
IBM · Mar 3, 2021 · 467f9f1 · 467f9f1
1 parent aa5f98b
commit 467f9f1
Show file tree

Hide file tree

Showing 3 changed files with 5 additions and 3 deletions.
diff --git a/detect_secrets/plugins/base.py b/detect_secrets/plugins/base.py
@@ -326,7 +326,7 @@ def assign_regex_generator(prefix_regex, password_keyword_regex, password_regex)
 
         <prefix_regex>(-|_|)<password_keyword_regex> <assignment> <password_regex>
 
-        assignment would include =,:,:=,::
+        assignment would include =,:,:=,::,,,(
         keyname and value supports optional quotes
         """
         begin = r'(?:(?<=\W)|(?<=^))'
@@ -335,7 +335,7 @@ def assign_regex_generator(prefix_regex, password_keyword_regex, password_regex)
         opt_close_square_bracket = r'(?:\]|)'
         opt_dash_undrscr = r'(?:_|-|)'
         opt_space = r'(?: *)'
-        assignment = r'(?:=|:|:=|=>| +|::)'
+        assignment = r'(?:=|:|:=|=>| +|::|,|\()'
         return re.compile(
             r'{begin}{opt_open_square_bracket}{opt_quote}{prefix_regex}{opt_dash_undrscr}'
             '{password_keyword_regex}{opt_quote}{opt_close_square_bracket}{opt_space}'

diff --git a/detect_secrets/plugins/ibm_cloud_iam.py b/detect_secrets/plugins/ibm_cloud_iam.py
@@ -14,7 +14,7 @@ class IbmCloudIamDetector(RegexBasedDetector):
         r'ibm(?:_|-|)cloud|ibm(?:_|-|)iam|ibm|iam|cloud|test|)'
     opt_dash_undrscr = r'(?:_|-|)'
     opt_api = r'(?:api|)'
-    key_or_pass = r'(?:key|keyid|pwd|password|pass|token)'
+    key_or_pass = r'(?:key|keyid|pwd|password|pass|token|authenticator)'
     secret = r'([a-zA-Z0-9_\-]{44})'
     denylist = [
         RegexBasedDetector.assign_regex_generator(

diff --git a/tests/plugins/ibm_cloud_iam_test.py b/tests/plugins/ibm_cloud_iam_test.py
@@ -48,6 +48,8 @@ class TestIbmCloudIamDetector(object):
             ('test_apikey = "{cloud_iam_key}"'.format(cloud_iam_key=CLOUD_IAM_KEY), True),
             ('ibm-cloud-pwd = {cloud_iam_key}'.format(cloud_iam_key=CLOUD_IAM_KEY), True),
             ('apikey:{cloud_iam_key}'.format(cloud_iam_key=CLOUD_IAM_KEY), True),
+            ('IAMAuthenticator("{cloud_iam_key}")'.format(cloud_iam_key=CLOUD_IAM_KEY), True),
+            ('.set("apikey", "{cloud_iam_key}")'.format(cloud_iam_key=CLOUD_IAM_KEY), True),
             ('iam_api_key="%s" % IBM_IAM_API_KEY_ENV', False),
             ('CLOUD_APIKEY: "insert_key_here"', False),
             ('cloud-iam-key:=afakekey', False),