feat(secrets): support git history scan in multiline parsers

checkov/main.py

@@ -667,8 +667,8 @@ def run(self, banner: str = checkov_banner) -> int | None:
                 repo_root_for_plan_enrichment=self.config.repo_root_for_plan_enrichment,
                 resource_attr_to_omit=self.config.mask,
                 # TODO modify the output for git_history secret and remove the rewrite of enable_git_history_secret_scan
-                # enable_git_history_secret_scan=self.config.scan_secrets_history,
-                enable_git_history_secret_scan=False,  # expose after unite git history with secret scan
+                enable_git_history_secret_scan=self.config.scan_secrets_history,
+                # enable_git_history_secret_scan=False,  # expose after unite git history with secret scan
                 git_history_timeout=self.config.secrets_history_timeout
             )
 

checkov/secrets/plugins/detector_utils.py

@@ -185,7 +185,7 @@ def extract_from_string(pattern: dict[Pattern[str], int] | None, string: str) ->
     for value_regex, group_number in pattern.items():
         match = value_regex.search(string)
         if match:
-            matches |= {match.group(group_number)}
+            matches |= {match.group(group_number).rstrip('\n')}
     return matches
 
 

checkov/secrets/scan_git_history.py

@@ -105,7 +105,8 @@ def _get_commits_diff(self) -> Dict[str, Dict[str, str | Dict[str, str]]]:
                 base_diff_format = f'diff --git a/{file_diff.a_path} b/{file_diff.b_path}' \
                                    f'\nindex 0000..0000 0000\n--- a/{file_diff.a_path}\n+++ b/{file_diff.b_path}\n'
                 commits_diff.setdefault(current_commit_hash, {})
-                commits_diff[current_commit_hash][file_diff.a_path] = base_diff_format + file_diff.diff.decode()
+                file_name = file_diff.a_path if file_diff.a_path else file_diff.b_path
+                commits_diff[current_commit_hash][file_name] = base_diff_format + file_diff.diff.decode()
         return commits_diff