fix(redaction): treat a prefixed quote as a literal opener

Prefixed multiline assignments such as r""" were whole-masked on the
first line, which destroyed the quotes the literal pass needs. Later
lines stayed marked in-literal, so inner secrets survived on the snippet.

Author: cursoragent

socket_basics/core/utils/redaction.py

@@ -146,6 +146,11 @@ def mask_value(value: Any, reveal: int = _DEFAULT_REVEAL,
 # such as ``# see get_secret()`` disable masking for the value in front of it.
 _CALL_EXPRESSION = re.compile(r'^[\w.\[\]]+\s*\(')
 
+# Optional prefixes on a quoted literal. ``r"""`` / ``f"..."`` / ``b'...'``
+# still open a value the literal pass can find; the quote, not the prefix,
+# is what that pass matches.
+_STRING_PREFIX = re.compile(r'^[bBfFrRuU]*')
+
 # Rule-name fragments whose finding *is* the credential. ``hardcoded-ip`` and
 # the password-policy rules deliberately do not appear: their snippets are
 # logic, and masking them would remove the reason the finding was raised.
@@ -252,8 +257,16 @@ def _mask_statement(code: str, offset: int, in_literal) -> str:
     # nothing to act on. A quoted value is the literal pass's job -- but only
     # where the quote opens a literal that pass can find. A snippet cut mid
     # string has an opening quote and no closing one, so nothing matches and
-    # the value would survive untouched.
-    opens_literal = value.startswith(('"', "'", '`')) and in_literal(offset + len(head))
+    # the value would survive untouched. A prefix such as ``r`` or ``f`` is
+    # not the quote, but the quote after it still is: starring the opener
+    # would drop those quotes, later lines would stay marked in-literal, and
+    # the body would survive the literal pass.
+    prefix_len = _STRING_PREFIX.match(value).end()
+    opens_literal = (
+        prefix_len < len(value)
+        and value[prefix_len] in '"\'`'
+        and in_literal(offset + len(head) + prefix_len)
+    )
     if opens_literal or _CALL_EXPRESSION.match(value):
         return code
 
@@ -292,10 +305,10 @@ def redact_literals(text: Any) -> str:
     finding actionable, while the value does not.
 
     Where the shape of the value is not recognized the whole value is masked
-    rather than guessed at, so a subscript, a ternary or a prefixed literal
-    (``f"..."``, ``r'...'``) loses more of the line than a plain assignment
-    does. That direction is deliberate: the rule ID, file and line still
-    identify the finding, and the alternative is leaving a credential in place.
+    rather than guessed at, so a subscript or a ternary loses more of the
+    line than a plain assignment does. That direction is deliberate: the
+    rule ID, file and line still identify the finding, and the alternative
+    is leaving a credential in place.
     """
     if not isinstance(text, str) or not text:
         return text if isinstance(text, str) else ''

tests/test_secret_redaction.py

@@ -309,6 +309,19 @@ def test_a_literal_spanning_lines_keeps_the_line_structure(self):
         assert redacted.count("\n") == 2
         assert "hunter2" not in redacted
 
+    def test_a_prefixed_multiline_literal_is_masked(self):
+        # The prefix is not a quote, so whole-masking the first line would
+        # replace the opener with stars. Later lines stay marked in-literal,
+        # assignment and comment masking skip them, and the body survives.
+        for prefix in ("r", "f", "b", "rf", "fr", "br", "R", "rb"):
+            for quote in ('"', "'"):
+                snippet = (
+                    f"PASSWORD = {prefix}" + quote * 3
+                    + "\npassword=hunter2\n# hunter2\n"
+                    + quote * 3
+                )
+                assert "hunter2" not in redact_literals(snippet), snippet
+
 
 class TestCredentialRuleSelection:
     @pytest.mark.parametrize(