fix(security): durcir les placeholders URL documentaires

scripts/check_secrets.py

@@ -37,7 +37,15 @@ _URL_SECRET_RE = re.compile(
     r"(?ix)[?&](?:api[_-]?key|access[_-]?token|auth(?:orization)?|icalsecurise|password|secret|token)"
     r"=([^&#\s]{3,})"
 )
-_URL_PLACEHOLDER_RE = re.compile(r"(?x)^(?:\{[^{}\r\n]+\}|<[^<>\r\n]+>|\.+|[•…*]+)$")
+_URL_PLACEHOLDER_RE = re.compile(
+    r"(?ix)^(?:"
+    r"\{(?:token|jeton|secret|valeur|value|param(?:etre)?|version|prenom|"
+    r"etablissement|hote|host)\}|"
+    r"<(?:token|jeton|secret|valeur|value|param(?:etre)?|version|prenom|"
+    r"etablissement|hote|host)>|"
+    r"\.{3,}|[•…]+"
+    r")$"
+)
 _EXTRA_NAMES = frozenset({"pronote_sync"})
 
 
@@ -186,8 +194,11 @@ def find_secrets(
             )
             if is_literal_secret:
                 findings.append(SecretFinding(relative_path, number, "affectation-litterale"))
-            url_match = _URL_SECRET_RE.search(line)
-            if url_match and not _URL_PLACEHOLDER_RE.fullmatch(url_match.group(1)):
+            has_real_url_secret = any(
+                not _URL_PLACEHOLDER_RE.fullmatch(match.group(1))
+                for match in _URL_SECRET_RE.finditer(line)
+            )
+            if has_real_url_secret:
                 findings.append(SecretFinding(relative_path, number, "parametre-url"))
     return sorted(findings, key=lambda finding: (str(finding.path), finding.line, finding.rule))