fix(redaction): keep backslash-continued string spans

A " or ' match that wraps with \ is a real literal, not a pairing
artifact. Dropping it starred the first-line value, including the
opener, so a credential on the continuation line survived masking.

Author: cursoragent

socket_basics/core/utils/redaction.py

@@ -170,6 +170,11 @@ def mask_value(value: Any, reveal: int = _DEFAULT_REVEAL,
 # Triple-quote delimiters, counted to detect a block that never closes.
 _TRIPLE_QUOTE = re.compile(r'\"\"\"|\'\'\'')
 
+# A newline that is not a backslash continuation. Distinguishes a pairing
+# artifact (an unclosed ``"`` / ``'`` that matched a stray quote later) from a
+# legitimate line-continued string, which most bundled languages allow.
+_UNESCAPED_NEWLINE = re.compile(r'(?<!\\)(?:\\\\)*\n')
+
 # Rule-name fragments whose finding *is* the credential. ``hardcoded-ip`` and
 # the password-policy rules deliberately do not appear: their snippets are
 # logic, and masking them would remove the reason the finding was raised.
@@ -355,12 +360,15 @@ def _mask_literal(match: 're.Match[str]') -> str:
     # rules cover, so a match that does is not a literal -- it is an unclosed
     # quote that paired with a stray one further down, and the span between them
     # would hide whatever it covers, including a real assignment on a later
-    # line. Backticks and triple quotes span lines legitimately and are kept.
+    # line. A backslash-escaped newline is line continuation, which those
+    # languages do allow; OpenGrep's ``extra.lines`` includes every line of
+    # that match, so the span has to stay or the continuation is never masked.
+    # Backticks and triple quotes span lines without escaping and are kept.
     spans = [
         match.span() for match in _STRING_LITERAL.finditer(text)
         if len(match.group('quote')) > 1
         or match.group('quote') == '`'
-        or '\n' not in match.group(0)
+        or not _UNESCAPED_NEWLINE.search(match.group(0))
     ]
 
     def in_literal(position: int) -> bool:

tests/test_secret_redaction.py

@@ -316,6 +316,20 @@ def test_an_unterminated_literal_is_masked_rather_than_deferred(self):
         for snippet in ('password = "hunter2\n# broken', "password = 'hunter2\n-- sql"):
             assert "hunter2" not in redact_literals(snippet), snippet
 
+    def test_a_backslash_continued_literal_is_masked(self):
+        """A ``\\`` newline is a real literal, not a pairing artifact.
+
+        Dropping the span stars the first-line value, including the opener,
+        so the masking pass cannot see the rest of the string. A credential
+        on the continuation line would then survive.
+        """
+        for snippet in (
+            'password = "\\\nhunter2"',
+            "password = 'first\\\nhunter2'",
+            'password = r"\\\nhunter2"',
+        ):
+            assert "hunter2" not in redact_literals(snippet), snippet
+
     def test_a_literal_spanning_lines_keeps_the_line_structure(self):
         redacted = redact_literals(self.TRIPLE_DOUBLE)
         assert redacted.count("\n") == 2