# Buggy code
def _recursively_mask_objects(object_to_mask, blacklisted_object, mask_with):
    """
    This function is used by ``_mask_object()`` to mask passwords contained in
    an osquery data structure (formed as a list of dicts, usually). Since the
    lists can sometimes be nested, recurse through the lists.

    object_to_mask
        data structure to mask recursively

    blacklisted_object
        the blacklisted_objects entry from the mask.yaml

    mask_with
        masked values are replaced with this string
    """
    if isinstance(object_to_mask, list):
        for child in object_to_mask:
            _recursively_mask_objects(child, blacklisted_object, mask_with)
    elif blacklisted_object["attribute_to_check"] in object_to_mask:
        mask = False
        for blacklisted_pattern in blacklisted_object["blacklisted_patterns"]:
            if fnmatch.fnmatch(
                object_to_mask[blacklisted_object["attribute_to_check"]],
                blacklisted_pattern,
            ):
                mask = True
                break
        if mask:
            for key in blacklisted_object["attributes_to_mask"]:
                if key in object_to_mask:
                    object_to_mask[key] = mask_with


# Traceback (UnboundLocalError)
[ERROR   ] name MACHINE\System\CurrentControlSet\Control\Lsa\pku2u\AllowOnlineID was not in __secdata__
[ERROR   ] Exception occurred in nova module:
[ERROR   ] Traceback (most recent call last):
File "C:\PROGRA~2\Hubble\hubblestack\extmods\modules\hubble.py", line 291, in _run_audit
ret = func(data_list, tags, labels, **kwargs)
File "C:\PROGRA~2\Hubble\hubblestack\files\hubblestack_nova\win_secedit.py", line 133, in audit
match_output,
UnboundLocalError: local variable 'match_output' referenced before assignment

{'Compliance': '15%',
'Errors': [{'\\win_secedit.py': {'data': "UnboundLocalError: local variable 'match_output' referenced before assignment",
'error': 'exception occurred'}}],
'Failure': [{'CIS-9.3.8': 'Ensure "Windows Firewall- Public- Logging- Size limit (KB)" is set to "16,384 KB or greater"'},
{'CIS-9.2.10': 'Ensure "Windows Firewall- Private- Logging- Log successful connections" is set to "Yes"'},
{'CIS-9.1.10': 'Ensure "Windows Firewall- Domain- Logging- Log successful connections" is set to "Yes"'},

# Fixed code
def _recursively_mask_objects(
    object_to_mask, blacklisted_object, mask_with, globbing_enabled
):
    """
    This function is used by ``_mask_object()`` to mask passwords contained in
    an osquery data structure (formed as a list of dicts, usually). Since the
    lists can sometimes be nested, recurse through the lists.

    object_to_mask
        data structure to mask recursively

    blacklisted_object
        the blacklisted_objects entry from the mask.yaml

    mask_with
        masked values are replaced with this string

    globbing_enabled
        enable globbing in specified blacklisted patterns of mask file
    """
    if isinstance(object_to_mask, list):
        for child in object_to_mask:
            log.debug("Recursing object {0}".format(child))
            _recursively_mask_objects(
                child, blacklisted_object, mask_with, globbing_enabled
            )
    elif (
        globbing_enabled and blacklisted_object["attribute_to_check"] in object_to_mask
    ):
        mask = False
        for blacklisted_pattern in blacklisted_object["blacklisted_patterns"]:
            if fnmatch.fnmatch(
                object_to_mask[blacklisted_object["attribute_to_check"]],
                blacklisted_pattern,
            ):
                mask = True
                log.info(
                    "Attribute {0} will be masked.".format(
                        object_to_mask[blacklisted_object["attribute_to_check"]]
                    )
                )
                break
        if mask:
            for key in blacklisted_object["attributes_to_mask"]:
                if key in object_to_mask:
                    object_to_mask[key] = mask_with
    elif (
        (not globbing_enabled)
        and blacklisted_object["attribute_to_check"] in object_to_mask
        and object_to_mask[blacklisted_object["attribute_to_check"]]
        in blacklisted_object["blacklisted_patterns"]
    ):
        for key in blacklisted_object["attributes_to_mask"]:
            if key in object_to_mask:
                object_to_mask[key] = mask_with