Escape strings when formatting check messages (#1493)

resources/test/fixtures/flake8_bandit/S105.py

@@ -51,3 +51,12 @@ secret == "s3cr3t"
 token == "s3cr3t"
 secrete == "s3cr3t"
 password == safe == "s3cr3t"
+
+if token == "1\n2":
+    pass
+
+if token == "3\t4":
+    pass
+
+if token == "5\r6":
+    pass

src/checks.rs

@@ -2850,14 +2850,13 @@ impl CheckKind {
             CheckKind::HardcodedBindAllInterfaces => {
                 "Possible binding to all interfaces".to_string()
             }
-            CheckKind::HardcodedPasswordString(string) => {
-                format!("Possible hardcoded password: `\"{string}\"`")
-            }
-            CheckKind::HardcodedPasswordFuncArg(string) => {
-                format!("Possible hardcoded password: `\"{string}\"`")
-            }
-            CheckKind::HardcodedPasswordDefault(string) => {
-                format!("Possible hardcoded password: `\"{string}\"`")
+            CheckKind::HardcodedPasswordString(string)
+            | CheckKind::HardcodedPasswordFuncArg(string)
+            | CheckKind::HardcodedPasswordDefault(string) => {
+                format!(
+                    "Possible hardcoded password: `\"{}\"`",
+                    string.escape_debug()
+                )
             }
             // flake8-blind-except
             CheckKind::BlindExcept(name) => format!("Do not catch blind exception: `{name}`"),

src/flake8_bandit/snapshots/ruff__flake8_bandit__tests__S105_S105.py.snap

@@ -342,4 +342,34 @@ expression: checks
     column: 28
   fix: ~
   parent: ~
+- kind:
+    HardcodedPasswordString: "1\n2"
+  location:
+    row: 55
+    column: 12
+  end_location:
+    row: 55
+    column: 18
+  fix: ~
+  parent: ~
+- kind:
+    HardcodedPasswordString: "3\t4"
+  location:
+    row: 58
+    column: 12
+  end_location:
+    row: 58
+    column: 18
+  fix: ~
+  parent: ~
+- kind:
+    HardcodedPasswordString: "5\r6"
+  location:
+    row: 61
+    column: 12
+  end_location:
+    row: 61
+    column: 18
+  fix: ~
+  parent: ~