From 467f9f1c0d87002e90b667525e50b976a5885fdf Mon Sep 17 00:00:00 2001
From: XIANJUN ZHU <xianjun@us.ibm.com>
Date: Wed, 3 Mar 2021 14:40:32 -0500
Subject: [PATCH] Catch more cases for IAM (#414)

* Catch more cases for IAM

* Fix build
---
 detect_secrets/plugins/base.py          | 4 ++--
 detect_secrets/plugins/ibm_cloud_iam.py | 2 +-
 tests/plugins/ibm_cloud_iam_test.py     | 2 ++
 3 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/detect_secrets/plugins/base.py b/detect_secrets/plugins/base.py
index d1882d112..1aeff1abb 100644
--- a/detect_secrets/plugins/base.py
+++ b/detect_secrets/plugins/base.py
@@ -326,7 +326,7 @@ def assign_regex_generator(prefix_regex, password_keyword_regex, password_regex)
 
         <prefix_regex>(-|_|)<password_keyword_regex> <assignment> <password_regex>
 
-        assignment would include =,:,:=,::
+        assignment would include =,:,:=,::,,,(
         keyname and value supports optional quotes
         """
         begin = r'(?:(?<=\W)|(?<=^))'
@@ -335,7 +335,7 @@ def assign_regex_generator(prefix_regex, password_keyword_regex, password_regex)
         opt_close_square_bracket = r'(?:\]|)'
         opt_dash_undrscr = r'(?:_|-|)'
         opt_space = r'(?: *)'
-        assignment = r'(?:=|:|:=|=>| +|::)'
+        assignment = r'(?:=|:|:=|=>| +|::|,|\()'
         return re.compile(
             r'{begin}{opt_open_square_bracket}{opt_quote}{prefix_regex}{opt_dash_undrscr}'
             '{password_keyword_regex}{opt_quote}{opt_close_square_bracket}{opt_space}'
diff --git a/detect_secrets/plugins/ibm_cloud_iam.py b/detect_secrets/plugins/ibm_cloud_iam.py
index c83d15560..a771bec1c 100644
--- a/detect_secrets/plugins/ibm_cloud_iam.py
+++ b/detect_secrets/plugins/ibm_cloud_iam.py
@@ -14,7 +14,7 @@ class IbmCloudIamDetector(RegexBasedDetector):
         r'ibm(?:_|-|)cloud|ibm(?:_|-|)iam|ibm|iam|cloud|test|)'
     opt_dash_undrscr = r'(?:_|-|)'
     opt_api = r'(?:api|)'
-    key_or_pass = r'(?:key|keyid|pwd|password|pass|token)'
+    key_or_pass = r'(?:key|keyid|pwd|password|pass|token|authenticator)'
     secret = r'([a-zA-Z0-9_\-]{44})'
     denylist = [
         RegexBasedDetector.assign_regex_generator(
diff --git a/tests/plugins/ibm_cloud_iam_test.py b/tests/plugins/ibm_cloud_iam_test.py
index 79442c294..10c0a7fa2 100644
--- a/tests/plugins/ibm_cloud_iam_test.py
+++ b/tests/plugins/ibm_cloud_iam_test.py
@@ -48,6 +48,8 @@ class TestIbmCloudIamDetector(object):
             ('test_apikey = "{cloud_iam_key}"'.format(cloud_iam_key=CLOUD_IAM_KEY), True),
             ('ibm-cloud-pwd = {cloud_iam_key}'.format(cloud_iam_key=CLOUD_IAM_KEY), True),
             ('apikey:{cloud_iam_key}'.format(cloud_iam_key=CLOUD_IAM_KEY), True),
+            ('IAMAuthenticator("{cloud_iam_key}")'.format(cloud_iam_key=CLOUD_IAM_KEY), True),
+            ('.set("apikey", "{cloud_iam_key}")'.format(cloud_iam_key=CLOUD_IAM_KEY), True),
             ('iam_api_key="%s" % IBM_IAM_API_KEY_ENV', False),
             ('CLOUD_APIKEY: "insert_key_here"', False),
             ('cloud-iam-key:=afakekey', False),