From 2bc1ced27a8274b2bac5dd2d6e548abaa7f6f971 Mon Sep 17 00:00:00 2001 From: "J. Nick Koston" Date: Thu, 8 Oct 2026 07:29:56 -1000 Subject: [PATCH] [core] Stop the secret reference scan at flow collection punctuation --- esphome/yaml_util.py | 6 +++--- tests/unit_tests/test_yaml_util.py | 6 ++++++ 2 files changed, 9 insertions(+), 3 deletions(-) diff --git a/esphome/yaml_util.py b/esphome/yaml_util.py index 119a9644726..0861670d7fd 100644 --- a/esphome/yaml_util.py +++ b/esphome/yaml_util.py @@ -447,9 +447,9 @@ def _load_include_candidates( ) -# `!secret key`, quoted or not. A text scan, not a YAML parse, so it can also match -# comments; that errs toward including more secrets. -_SECRET_REFERENCE_RE = re.compile(r"""!secret\s+['"]?([^\s'"]+)""") +# `!secret key`, quoted or not, also inside flow collections. A text scan, not a +# YAML parse, so it can also match comments; that errs toward more secrets. +_SECRET_REFERENCE_RE = re.compile(r"""!secret\s+['"]?([^\s'",\]}]+)""") def find_secret_references(text: str) -> set[str]: diff --git a/tests/unit_tests/test_yaml_util.py b/tests/unit_tests/test_yaml_util.py index 84ff11ce3d5..a268c7796a5 100644 --- a/tests/unit_tests/test_yaml_util.py +++ b/tests/unit_tests/test_yaml_util.py @@ -2195,3 +2195,9 @@ def test_load_yaml_fast_mode_records_dropped_merge_keys( yaml_util.load_yaml(yaml_file, track_document_range=False) assert yaml_util.take_dropped_merge_keys() == [("port", str(yaml_file))] + + +def test_find_secret_references_in_flow_collections() -> None: + """Flow mapping and sequence punctuation is not part of the secret name.""" + text = "a: {password: !secret wifi_pw}\nb: [!secret one, !secret 'two']\n" + assert yaml_util.find_secret_references(text) == {"wifi_pw", "one", "two"}