# Buggy code
def _mask_event_data(
    object_to_be_masked,
    query_name,
    column,
    blacklisted_object,
    mask_with,
    globbing_enabled,
):
    """
    This method is responsible for masking potential secrets in event data generated by
    osquery daemon. This will handle logs format of both differential and snapshot types

    Logs generated by 'osqueryi' would not reach here due checks in parent method

    object_to_be_masked
        data structure to mask recursively

    query_name
        Perform masking only if query name in 'object_to_be_masked' matches the 'query_name'

    column
        column in which masking is to be performed

    blacklisted_object
        the blacklisted_objects entry from the mask.yaml

    mask_with
        masked values are replaced with this string

    globbing_enabled
        enable globbing in specified blacklisted patterns of mask file
    """
    if not query_name:
        query_name = object_to_be_masked["name"]

    if (
        object_to_be_masked["action"] == "snapshot"
        and query_name == object_to_be_masked["name"]
    ):
        # This means we have event data of type 'snapshot'
        for snap_object in object_to_be_masked["snapshot"]:
            if column not in snap_object or (
                isinstance(snap_object[column], basestring)
                and snap_object[column].strip() != ""
            ):
                log.error(
                    "masking data references a missing column {0} in query {1}".format(
                        column, query_name
                    )
                )
                break
            if isinstance(snap_object[column], basestring):
                value = snap_object[column]
                for pattern in blacklisted_object["blacklisted_patterns"]:
                    value = re.sub(pattern + "()", r"\1" + mask_with + r"\3", value)
                snap_object[column] = value
            else:
                _recursively_mask_objects(
                    snap_object[column], blacklisted_object, mask_with, globbing_enabled
                )
    elif query_name == object_to_be_masked["name"]:
        q_result = object_to_be_masked["columns"]
        if column not in q_result or (
            isinstance(q_result[column], basestring) and q_result[column].strip() != ""
        ):
            log.error(
                "masking data references a missing column {0} in query {1}".format(
                    column, query_name
                )
            )
        if isinstance(q_result[column], basestring):
            value = q_result[column]
            for pattern in blacklisted_object["blacklisted_patterns"]:
                value = re.sub(pattern + "()", r"\1" + mask_with + r"\3", value)
            q_result[column] = value
        else:
            _recursively_mask_objects(
                q_result[column], blacklisted_object, mask_with, globbing_enabled
            )
    else:
        # Unable to match query_name
        log.debug(
            "Skipping masking, as event data is not for query: {0}".format(query_name)
        )


# Traceback (UnboundLocalError)
[ERROR   ] name MACHINE\System\CurrentControlSet\Control\Lsa\pku2u\AllowOnlineID was not in __secdata__
[ERROR   ] Exception occurred in nova module:
[ERROR   ] Traceback (most recent call last):
File "C:\PROGRA~2\Hubble\hubblestack\extmods\modules\hubble.py", line 291, in _run_audit
ret = func(data_list, tags, labels, **kwargs)
File "C:\PROGRA~2\Hubble\hubblestack\files\hubblestack_nova\win_secedit.py", line 133, in audit
match_output,
UnboundLocalError: local variable 'match_output' referenced before assignment

{'Compliance': '15%',
'Errors': [{'\\win_secedit.py': {'data': "UnboundLocalError: local variable 'match_output' referenced before assignment",
'error': 'exception occurred'}}],
'Failure': [{'CIS-9.3.8': 'Ensure "Windows Firewall- Public- Logging- Size limit (KB)" is set to "16,384 KB or greater"'},
{'CIS-9.2.10': 'Ensure "Windows Firewall- Private- Logging- Log successful connections" is set to "Yes"'},
{'CIS-9.1.10': 'Ensure "Windows Firewall- Domain- Logging- Log successful connections" is set to "Yes"'},

# Fixed code
def _mask_event_data(
    object_to_be_masked,
    query_name,
    column,
    blacklisted_object,
    mask_with,
    globbing_enabled,
):
    """
    This method is responsible for masking potential secrets in event data generated by
    osquery daemon. This will handle logs format of both differential and snapshot types

    Logs generated by 'osqueryi' would not reach here due checks in parent method

    object_to_be_masked
        data structure to mask recursively

    query_name
        Perform masking only if query name in 'object_to_be_masked' matches the 'query_name'

    column
        column in which masking is to be performed

    blacklisted_object
        the blacklisted_objects entry from the mask.yaml

    mask_with
        masked values are replaced with this string

    globbing_enabled
        enable globbing in specified blacklisted patterns of mask file
    """
    if not query_name:
        query_name = object_to_be_masked["name"]

    custom_mask_column = blacklisted_object.get(
        "custom_mask_column", ""
    )  # Name of column that stores environment variables

    if (
        object_to_be_masked["action"] == "snapshot"
        and query_name == object_to_be_masked["name"]
    ):
        # This means we have event data of type 'snapshot'
        for snap_object in object_to_be_masked["snapshot"]:
            if custom_mask_column and custom_mask_column in snap_object:
                log.debug("Checking if custom mask patterns are set in environment")
                mask_column = snap_object[custom_mask_column]
                if mask_column and isinstance(mask_column, list):
                    for column_field in mask_column:
                        try:
                            if (
                                "variable_name" in column_field
                                and "value" in column_field
                                and column_field["variable_name"]
                                == blacklisted_object["custom_mask_key"]
                            ):
                                log.debug(
                                    "Constructing custom blacklisted patterns based on \
                                          environment variable '{0}'".format(
                                        blacklisted_object["custom_mask_key"]
                                    )
                                )
                                blacklisted_object["custom_blacklist"] = [
                                    p.strip()
                                    for p in column_field["value"].split(",")
                                    if p.strip()
                                    != blacklisted_object["custom_mask_key"]
                                ]
                            else:
                                log.debug(
                                    "Custom mask variable not set in environment. \
                                          Custom mask key used: {0}".format(
                                        blacklisted_object["custom_mask_key"]
                                    )
                                )
                        except Exception as e:
                            log.error(
                                "Failed to generate custom blacklisted patterns based on hubble mask key"
                            )
                            log.error("Got error: {0}".format(e))
            if column not in snap_object or (
                isinstance(snap_object[column], basestring)
                and snap_object[column].strip() != ""
            ):
                log.error(
                    "masking data references a missing column {0} in query {1}".format(
                        column, query_name
                    )
                )
                break
            if isinstance(snap_object[column], basestring):
                value = snap_object[column]
                for pattern in blacklisted_object["blacklisted_patterns"]:
                    value = re.sub(pattern + "()", r"\1" + mask_with + r"\3", value)
                snap_object[column] = value
            else:
                _perform_masking(
                    snap_object[column], blacklisted_object, mask_with, globbing_enabled
                )
    elif query_name == object_to_be_masked["name"]:
        q_result = object_to_be_masked["columns"]
        if custom_mask_column and custom_mask_column in q_result:
            log.debug("Checking if custom mask patterns are set in environment")
            mask_column = q_result[custom_mask_column]
            if mask_column and isinstance(mask_column, list):
                for column_field in mask_column:
                    try:
                        if (
                            "variable_name" in column_field
                            and "value" in column_field
                            and column_field["variable_name"]
                            == blacklisted_object["custom_mask_key"]
                        ):
                            log.debug(
                                "Constructing custom blacklisted patterns based on \
                                      environment variable '{0}'".format(
                                    blacklisted_object["custom_mask_key"]
                                )
                            )
                            blacklisted_object["custom_blacklist"] = [
                                p.strip()
                                for p in column_field["value"].split(",")
                                if p.strip() != blacklisted_object["custom_mask_key"]
                            ]
                        else:
                            log.debug(
                                "Custom mask variable not set in environment. \
                                          Custom mask key used: {0}".format(
                                    blacklisted_object["custom_mask_key"]
                                )
                            )
                    except Exception as e:
                        log.error(
                            "Failed to generate custom blacklisted patterns based on hubble mask key"
                        )
                        log.error("Got error: {0}".format(e))
        if column not in q_result or (
            isinstance(q_result[column], basestring) and q_result[column].strip() != ""
        ):
            log.error(
                "masking data references a missing column {0} in query {1}".format(
                    column, query_name
                )
            )
        if isinstance(q_result[column], basestring):
            value = q_result[column]
            for pattern in blacklisted_object["blacklisted_patterns"]:
                value = re.sub(pattern + "()", r"\1" + mask_with + r"\3", value)
            q_result[column] = value
        else:
            _perform_masking(
                q_result[column], blacklisted_object, mask_with, globbing_enabled
            )
    else:
        # Unable to match query_name
        log.debug(
            "Skipping masking, as event data is not for query: {0}".format(query_name)
        )