From 4bce35a2a9479844b566c02ec0439df19c2324b2 Mon Sep 17 00:00:00 2001 From: yucheng Date: Fri, 11 Sep 2026 23:22:15 +0000 Subject: [PATCH] fix(hide-secrets): keep dashed flags as assignment trailers Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> --- .../enterprise_callbacks/secret_detection.py | 2 +- .../enterprise/enterprise_callbacks/test_secret_detection.py | 4 ++++ 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/enterprise/litellm_enterprise/enterprise_callbacks/secret_detection.py b/enterprise/litellm_enterprise/enterprise_callbacks/secret_detection.py index bd63d4f8baa..f0f85178672 100644 --- a/enterprise/litellm_enterprise/enterprise_callbacks/secret_detection.py +++ b/enterprise/litellm_enterprise/enterprise_callbacks/secret_detection.py @@ -455,7 +455,7 @@ _SHELL_ASSIGNMENT: Final = re.compile(r"(?P[^\s\[#;:=](?:[^:=]*[^\s:=])?)=( _SHELL_OPERATORS: Final = ";&|" -_SHELL_TRAILER: Final = re.compile(r"\\|#.*|\w[\w.-]*=\S*") +_SHELL_TRAILER: Final = re.compile(r"\\|#.*|-*\w[\w.-]*=\S*") _SCAN_SUFFIX: Final = ".py" diff --git a/tests/test_litellm/enterprise/enterprise_callbacks/test_secret_detection.py b/tests/test_litellm/enterprise/enterprise_callbacks/test_secret_detection.py index 6d5dcb23547..3f5819260e6 100644 --- a/tests/test_litellm/enterprise/enterprise_callbacks/test_secret_detection.py +++ b/tests/test_litellm/enterprise/enterprise_callbacks/test_secret_detection.py @@ -126,6 +126,8 @@ def test_scan_message_preserves_quoted_benign_identifiers(): ("DB_PASSWORD = Zx4Kp9Lm2Qr7Ns3Vt; systemctl restart app", "Zx4Kp9Lm2Qr7Ns3Vt"), ("DB_PASSWORD = Zx4Kp9Lm2Qr7Ns3Vt \\", "Zx4Kp9Lm2Qr7Ns3Vt"), ("DB_PASSWORD = Zx4Kp9Lm2Qr7Ns3Vt DB_HOST=db.internal", "Zx4Kp9Lm2Qr7Ns3Vt"), + ("DB_PASSWORD = Zx4Kp9Lm2Qr7Ns3Vt --db-host=db.internal", "Zx4Kp9Lm2Qr7Ns3Vt"), + ("DB_PASSWORD = Zx4Kp9Lm2Qr7Ns3Vt DEBUG=", "Zx4Kp9Lm2Qr7Ns3Vt"), ], ids=[ "env-password", @@ -165,6 +167,8 @@ def test_scan_message_preserves_quoted_benign_identifiers(): "spaced-assignment-then-a-shell-command", "spaced-assignment-then-a-line-continuation", "spaced-assignment-then-a-second-assignment", + "spaced-assignment-then-a-dashed-flag", + "spaced-assignment-then-an-empty-assignment", ], ) def test_scan_message_redacts_credentials_assigned_to_credential_keys(content, secret):