↪️ Merge pull request #152 from killuazhu/contribute-xml-whitelist

feature: support whitelist for xml
Yelp · Apr 8, 2019 · 94c30be · 94c30be
2 parents 8716e5b + 109a4eb
commit 94c30be
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 5 deletions.
diff --git a/detect_secrets/plugins/common/constants.py b/detect_secrets/plugins/common/constants.py
@@ -6,11 +6,12 @@
     for r in [
         r'[ \t]+{} *pragma: ?whitelist[ -]secret{}[ \t]*$'.format(start, end)
         for start, end in (
-            ('#', ''),              # e.g. python or yaml
-            ('//', ''),             # e.g. golang
-            (r'/\*', r' *\*/'),     # e.g. c
-            ('\'', ''),             # e.g. visual basic .net
-            ('--', ''),             # e.g. sql
+            ('#', ''),                    # e.g. python or yaml
+            ('//', ''),                   # e.g. golang
+            (r'/\*', r' *\*/'),           # e.g. c
+            ('\'', ''),                   # e.g. visual basic .net
+            ('--', ''),                   # e.g. sql
+            (r'<!--[# \t]*?', ' *?-->'),  # e.g. xml
             # many other inline comment syntaxes are not included,
             # because we want to be performant for
             # any(regex.search(line) for regex in WHITELIST_REGEXES)

diff --git a/tests/plugins/high_entropy_strings_test.py b/tests/plugins/high_entropy_strings_test.py
@@ -110,6 +110,10 @@ def test_analyze_multiple_strings_same_line(self, content_to_format, expected_re
             "'{secret}' '  pragma: whitelist secret",
             "'{secret}'  -- pragma: whitelist secret",
             "'{secret}' --  pragma: whitelist secret",
+            "'{secret}' <!--pragma: whitelist secret-->",
+            "'{secret}' <!-- # pragma: whitelist secret -->",
+            "'{secret}' <!-- pragma: whitelist secret -->",
+            "'{secret}' <!--  pragma: whitelist secret  -->",
             # Test high entropy exclude regex
             '"CanonicalUser": "{secret}"',
             # Not a string