deepsecrets 2.0.0__tar.gz → 2.1.0__tar.gz

{deepsecrets-2.0.0 → deepsecrets-2.1.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: deepsecrets
-Version: 2.0.0
+Version: 2.1.0
 Summary: A better tool for secrets scanning
 License: MIT
 License-File: LICENSE
@@ -16,16 +16,15 @@ Classifier: Operating System :: OS Independent
 Classifier: Environment :: Console
 Classifier: Topic :: Security
 Requires-Dist: aenum (==3.1.17)
-Requires-Dist: dotwiz (==0.4.0)
 Requires-Dist: jschema-to-python (==1.2.3)
 Requires-Dist: jsx-lexer (==2.0.1)
-Requires-Dist: mmh3 (==5.2.1)
+Requires-Dist: mmh3 (==5.3.0)
 Requires-Dist: ordered-set (==4.1.0)
 Requires-Dist: puppetparser (==0.2.14)
-Requires-Dist: pydantic (==2.13.4)
-Requires-Dist: pygments (==2.20.0)
+Requires-Dist: pydantic (==2.13.5)
+Requires-Dist: pygments (==2.21.0)
 Requires-Dist: pyyaml (==6.0.3)
-Requires-Dist: regex (==2026.5.9)
+Requires-Dist: regex (==2026.9.3)
 Requires-Dist: rich (==15.0.0)
 Requires-Dist: sarif-om (==1.0.4)
 Project-URL: Bug Tracker, https://github.com/ntoskernel/deepsecrets/issues

{deepsecrets-2.0.0 → deepsecrets-2.1.0}/deepsecrets/cli.py

@@ -7,6 +7,7 @@ from jschema_to_python.to_json import to_json
 
 from deepsecrets import MODULE_NAME, console
 from deepsecrets.config import SCANNER_VERSION, SCANNER_VERSION_NUMERIC, Config, config, Output
+from deepsecrets.core.engines.hashed_secret import HashedSecretEngine
 from deepsecrets.core.engines.regex import RegexEngine
 from deepsecrets.core.engines.semantic import SemanticEngine
 from deepsecrets.core.model.finding import Finding
@@ -217,6 +218,13 @@ class DeepSecretsCliTool:
             'Use this flag if you want to render found secrets in plaintext but be extremely careful.',
         )
 
+        parser.add_argument(
+            '--report-diagnostics',
+            action='store_true',
+            help='Add scan diagnostics to a SARIF report: every file found under the target directory in\n'
+            'run.artifacts (scan time in ms, status, skip reason) and per-file errors in run.invocations.\n',
+        )
+
         parser.add_argument('--benchmarking-mode', help=argparse.SUPPRESS, action='store_true')
         parser.add_argument('--oneshot', help=argparse.SUPPRESS, type=str, default=None)
 
@@ -232,6 +240,9 @@ class DeepSecretsCliTool:
         if user_args.disable_masking:
             config.set_disable_masking(True)
 
+        # set on every parse: the config singleton outlives one run
+        config.set_report_diagnostics(user_args.report_diagnostics)
+
         if user_args.benchmarking_mode:
             config._set_benchmarking_mode(True)
 
@@ -274,7 +285,7 @@ class DeepSecretsCliTool:
 
         conf_hashed_ruleset = user_args.hashed_values
         if conf_hashed_ruleset is not None and conf_hashed_ruleset != DISABLED:
-            config.engines.append(RegexEngine)
+            config.engines.append(HashedSecretEngine)
             config.add_ruleset(HashedSecretsRulesetBuilder, conf_hashed_ruleset)
 
         conf_false_findings_ruleset = user_args.false_findings
@@ -297,11 +308,11 @@ class DeepSecretsCliTool:
 
         if config.output.type == 'json':
             console.print('\n')
-            if SCANNER_VERSION_NUMERIC[0] == 2 and SCANNER_VERSION_NUMERIC[1] < 1:
+            if SCANNER_VERSION_NUMERIC[0] == 2 and SCANNER_VERSION_NUMERIC[1] < 2:
                 console.print(
                     Align(
                         Panel(
-                            "The internal JSON report format is now DEPRECATED and will be removed in release 2.1.0\n\nConsider switching now.",
+                            "The internal JSON report format is now DEPRECATED and will be removed in release 2.2.0\n\nConsider switching now.",
                             padding=(1, 2),
                             title=Text('SARIF IS NOW DEFAULT OUTPUT FORMAT', style='reverse'),
                             highlight=True,
@@ -321,7 +332,7 @@ class DeepSecretsCliTool:
                 console.print(
                     Align(
                         Panel(
-                            f"The internal JSON report format was DEPRECATED since the release 2.0.0.\nNow ({SCANNER_VERSION}) it is REMOVED. Switch to SARIF\n.",
+                            f"The internal JSON report format was DEPRECATED since the release 2.2.0.\nNow ({SCANNER_VERSION}) it is REMOVED. Switch to SARIF\n.",
                             padding=(1, 2),
                             title=Text('SARIF IS NOW DEFAULT OUTPUT FORMAT', style='reverse'),
                             highlight=True,

{deepsecrets-2.0.0 → deepsecrets-2.1.0}/deepsecrets/config.py

@@ -11,7 +11,7 @@ from deepsecrets.core.utils.fs import get_abspath, path_exists
 FALLBACK_PROCESS_COUNT = 4
 
 SCANNER_NAME = "DeepSecrets"
-SCANNER_VERSION = "2.0.0"
+SCANNER_VERSION = "2.1.0"
 SCANNER_VERSION_NUMERIC = [int(subver) for subver in SCANNER_VERSION.split('.')]
 SCANNER_URL = "https://github.com/ntoskernel/deepsecrets"
 
@@ -36,6 +36,7 @@ class Config:
     process_count: int
     return_code_if_findings: bool
     disable_masking: bool
+    report_diagnostics: bool = False
     verbose: bool = False
 
     _benchmarking_mode: bool
@@ -46,6 +47,7 @@ class Config:
         self.global_exclusion_paths = []
         self.return_code_if_findings = False
         self.disable_masking = False
+        self.report_diagnostics = False
 
         self._benchmarking_mode = False
         self.oneshot_path = None
@@ -66,6 +68,9 @@ class Config:
     def set_disable_masking(self, state: bool):
         self.disable_masking = state
 
+    def set_report_diagnostics(self, state: bool):
+        self.report_diagnostics = state
+
     def _set_path(self, path: str, field: str) -> None:
         if not path_exists(path):
             raise FileNotFoundException(f'{field} path does not exist ({path})')

{deepsecrets-2.0.0 → deepsecrets-2.1.0}/deepsecrets/core/engines/hashed_secret.py

@@ -17,7 +17,6 @@ class HashedSecretEngine(IEngine):
             if not self.is_rule_applicable(token=token, rule=rule):
                 continue
 
-            token.calculate_hashed_value(rule.algorithm)
             results.extend(self._check_rule(token, rule))
 
         return results
@@ -30,7 +29,7 @@ class HashedSecretEngine(IEngine):
     def _check_rule(self, token: Token, rule: HashedSecretRule) -> List[Finding]:
         findings: List[Finding] = []
 
-        if token.hashed_value != rule.hashed_val:
+        if token.calculate_hashed_value(rule.algorithm) != rule.hashed_val:
             return findings
 
         findings.append(

{deepsecrets-2.0.0 → deepsecrets-2.1.0}/deepsecrets/core/helpers/variable_evaluator.py

@@ -103,32 +103,12 @@ class VariableEvaluator:
         return result
 
     def confidence_from_evaluation_result(self, result: EvaluationResult):
-        entropy_part = 0
-        var_part = result.naming_and_content_score / 25 * 10
-
-        if result.entropy_score > 0:
-            if result.naming_and_content_score <= 20:
-                # var_naming: 0 -> 5
-                # entropy: 0 -> 5
-                var_part = result.naming_and_content_score / 25 * 5
-                entropy_part = result.entropy_score / 40 * 5
-            else:
-                var_part = 5
-                entropy_part = result.entropy_score / 40 * 5
-
-            entropy_part = entropy_part * min(result.nonsence_value_score + 0.5, 1)
-            # ep non
-
-        if entropy_part > 5:
-            entropy_part = 5
-
-        if entropy_part < 0:
-            entropy_part = 0
-
-        if var_part > 10:
-            var_part = 10
-
-        if var_part < 0:
-            var_part = 0
-
-        return round(var_part + entropy_part)
+        # Monotonic in every input: more naming evidence, more entropy or a less natural value never lowers it.
+        # Naming: 0.2 per point up to 20, then 0.6 per point up to 25, so a strong name alone reaches 7 (HIGH)
+        # and needs a random-looking value to reach VERY-HIGH. Value: entropy score 0..40 -> 0..5, halved for
+        # natural-looking values. See docs/research/variable-scoring-balance.md.
+        naming = min(max(result.naming_and_content_score, 0), 25)
+        var_part = 0.2 * min(naming, 20) + 0.6 * max(naming - 20, 0)
+        entropy_part = min(max(result.entropy_score, 0), 40) / 40 * 5 * min(result.nonsence_value_score + 0.5, 1)
+
+        return round(min(var_part + entropy_part, 10))

{deepsecrets-2.0.0 → deepsecrets-2.1.0}/deepsecrets/core/model/file.py

@@ -1,3 +1,4 @@
+import bisect
 import regex as re
 from typing import Dict, List, Optional, Tuple
 
@@ -16,6 +17,9 @@ class File:
     name: str
     extension: Optional[str]
 
+    # (line_offsets it was built from, line numbers, running maximum of line ends); rebuilt on demand
+    _line_index: Optional[Tuple[Dict, List[int], List[int]]] = None
+
     def __init__(
         self,
         path: str,
@@ -62,7 +66,8 @@ class File:
         if self.path is None:
             return None
 
-        by_dot = self.path.split('.')
+        # split the file name only: a dot in a parent directory is not an extension
+        by_dot = self.path.split('/')[-1].split('.')
         if len(by_dot) == 1:
             return None
 
@@ -92,11 +97,30 @@ class File:
         return self._get_line_number_for_position(position=position)
 
     def _get_line_number_for_position(self, position: int) -> Optional[int]:
-        for linum, offsets in self.line_offsets.items():
-            if offsets[1] < position:
-                continue
-            return linum
-        return None
+        # The first line (in line_offsets order) whose end is at or after the position. Bisecting a running
+        # maximum of the line ends finds exactly that line, even where the ends are not ascending (KI-DM-03).
+        line_numbers, max_ends = self._get_line_index()
+        index = bisect.bisect_left(max_ends, position)
+        if index == len(max_ends):
+            return None
+        return line_numbers[index]
+
+    def _get_line_index(self) -> Tuple[List[int], List[int]]:
+        index = self._line_index
+        if index is None or index[0] is not self.line_offsets or len(index[1]) != len(self.line_offsets):
+            line_numbers = list(self.line_offsets.keys())
+            max_ends: List[int] = []
+            for linum in line_numbers:
+                end = self.line_offsets[linum][1]
+                max_ends.append(end if not max_ends or end > max_ends[-1] else max_ends[-1])
+            self._line_index = (self.line_offsets, line_numbers, max_ends)
+        return self._line_index[1], self._line_index[2]
+
+    def __getstate__(self) -> Dict:
+        # Files travel back from workers with every finding; the index is cheap to rebuild
+        state = self.__dict__.copy()
+        state.pop('_line_index', None)
+        return state
 
     def get_line_contents(self, line_number: int) -> Optional[str]:
         if line_number is None:
@@ -125,15 +149,15 @@ class File:
         if between[1] > self.length:
             between[1] = self.length
 
-        search_window = self.content[between[0] : between[1]]
+        # The needle is a literal, so a substring search returns the same first occurrence inside the window
+        # as the escaped regex this replaced, without compiling one pattern per token.
+        if not str:
+            return (between[0], between[0])
 
-        pattern = re.escape(str)
-        pattern = pattern.replace('\\\n', '\n').replace('\\\t', '\t')
-        detects = re.finditer(pattern, search_window)
-        for detect in detects:
-            span = detect.span()
-            return (between[0] + span[0], between[0] + span[1])
-        return None
+        start = self.content.find(str, between[0], between[1])
+        if start == -1:
+            return None
+        return (start, start + len(str))
 
     def get_column_number(self, position: int) -> int:
         line_number = self.get_line_number(position=position)

deepsecrets-2.1.0/deepsecrets/core/model/internal/processing.py

@@ -0,0 +1,36 @@
+from dataclasses import field, dataclass
+from typing import Dict, List, Optional, Sequence
+from deepsecrets.core.model.file import File
+from deepsecrets.core.model.finding import Finding
+from deepsecrets.core.model.rules.rule import Rule
+
+
+@dataclass(frozen=True)
+class AnalyzerBundle:
+    """What every worker needs to analyse a file. Sent to each worker once, by the pool initializer.
+
+    It crosses the process boundary by pickling, so every value must be picklable under `spawn`:
+    no lambdas, closures or open handles, and only classes importable from a module.
+    """
+
+    workdir: str
+    # engine name -> enabled
+    engines: Dict[str, bool] = field(default_factory=dict)
+    # ruleset name -> rules
+    rulesets: Dict[str, Sequence[Rule]] = field(default_factory=dict)
+    benchmarking_mode: bool = False
+
+
+@dataclass
+class PerFileAnalysisResult:
+    internal_task_id: int
+    findings: List[Finding]
+    errors: List[str]
+
+    # milliseconds: the whole-second field this replaced recorded 0 for almost every file
+    processing_time_ms: float = field(default=0.0)
+    # 'ok', 'empty' (0 bytes) or 'unreadable' (the file could not be opened)
+    status: str = field(default='ok')
+
+    # ONLY FOR BENCHMARKING MODE
+    _file: Optional[File] = None

{deepsecrets-2.0.0 → deepsecrets-2.1.0}/deepsecrets/core/model/response/base.py

@@ -61,3 +61,14 @@ class BaseResponseBuilder:
         masked_detection = detection[:start_len] + symbol * mask_len + detection[start_len + mask_len :]
 
         return snippet.replace(detection, masked_detection)
+
+    def _mask_by_offsets(self, snippet: str, snippet_start: int, finding: Finding, symbol: str = '*') -> str:
+        # For a detection that is not wholly inside the snippet (a multi-line secret
+        # seen through a single-line context), text matching cannot find it,
+        # so the part of the finding's span that falls inside the snippet is masked.
+        lo = max(finding.start_offset - snippet_start, 0)
+        hi = min(finding.end_offset - snippet_start, len(snippet))
+        if hi <= lo:
+            return snippet
+
+        return snippet[:lo] + symbol * (hi - lo) + snippet[hi:]

{deepsecrets-2.0.0 → deepsecrets-2.1.0}/deepsecrets/core/model/response/builtin.py

@@ -51,7 +51,16 @@ class BuiltinFormatResponseBuilder(BaseResponseBuilder):
 
             if self.masking_enabled:
                 if resp_finding.line is not None:
-                    resp_finding.line = resp_finding.line.replace(resp_finding.string, '*' * len(resp_finding.string))
+                    if resp_finding.string in resp_finding.line:
+                        resp_finding.line = resp_finding.line.replace(
+                            resp_finding.string, '*' * len(resp_finding.string)
+                        )
+                    else:
+                        resp_finding.line = self._mask_by_offsets(
+                            snippet=resp_finding.line,
+                            snippet_start=finding.file.get_line_start_offset(finding.start_line_number),
+                            finding=finding,
+                        )
 
                 resp_finding.string = '*' * len(resp_finding.string)
 

{deepsecrets-2.0.0 → deepsecrets-2.1.0}/deepsecrets/core/model/response/dojo_sarif.py

@@ -1,3 +1,4 @@
+import os
 from dataclasses import dataclass
 from typing import List, Set
 
@@ -11,11 +12,15 @@ from sarif_om import (
     Message,
     Location,
     PhysicalLocation,
+    Artifact,
     ArtifactLocation,
     ArtifactContent,
+    Invocation,
+    Notification,
     Region,
 )
 from deepsecrets.config import SCANNER_NAME, SCANNER_URL, SCANNER_VERSION
+from deepsecrets.core.utils.fs import get_relative_path
 
 from deepsecrets.core.model.finding import Finding
 from deepsecrets.core.model.response.base import BaseResponseBuilder
@@ -90,8 +95,8 @@ class DojoSarifResponseBuilder(BaseResponseBuilder):
         return TierAwareSarifRuleMeta(
             id=f'{base_rule_id}{suffix}',
             payload={
-                'shortDescription': {'text': f'{base_description} ({tier.get('label')} Confidence)'},
-                'properties': {'precision': tier.get('precision'), 'security-severity': tier.get('severity')},
+                'shortDescription': {'text': f'{base_description} ({tier.get("label")} Confidence)'},
+                'properties': {'precision': tier.get("precision"), 'security-severity': tier.get("severity")},
             },
         )
 
@@ -117,13 +122,11 @@ class DojoSarifResponseBuilder(BaseResponseBuilder):
 
     def with_current_mode(self, mode: ScanMode):
         super().with_current_mode(mode)
-        self.report.runs[0].original_uri_base_ids = (
-            {
-                SRC_PATH_BASE_ID: {
-                    'uri': self.mode.config.workdir_path,
-                },
+        self.report.runs[0].original_uri_base_ids = {
+            SRC_PATH_BASE_ID: {
+                'uri': self.mode.config.workdir_path,
             },
-        )
+        }
         return self
 
     def _convert_rules(self, rules: Set[TierAwareSarifRuleMeta]) -> List[ReportingDescriptor]:
@@ -175,8 +178,56 @@ class DojoSarifResponseBuilder(BaseResponseBuilder):
 
         sarif_rules = self._convert_rules(set([self._sarif_rule_meta_from_rule(rule) for rule in rules]))
         self.report.runs[0].tool.driver.rules = sarif_rules
+
+        mode = getattr(self, 'mode', None)
+        if mode is not None and getattr(mode.config, 'report_diagnostics', False):
+            self._add_diagnostics(self.report.runs[0])
         return self.report
 
+    def _add_diagnostics(self, run: Run) -> None:
+        """Every file found under the target dir as an artifact, and per-file errors as notifications."""
+        workdir = self.mode.config.workdir_path
+        outcomes = getattr(self.mode, 'files', {})
+
+        artifacts = []
+        notifications = []
+        for path, outcome in sorted(outcomes.items()):
+            uri = get_relative_path(path, workdir) if workdir else path
+            # a file that was scheduled but never came back has no result of its own
+            properties = {'status': 'error' if outcome.status == 'scheduled' else outcome.status}
+            if outcome.collected:
+                properties['scanTimeMs'] = outcome.time_ms
+            if outcome.skip_reason:
+                properties['skipReason'] = outcome.skip_reason
+            try:
+                length = os.path.getsize(path)
+            except OSError:
+                length = -1
+            artifacts.append(
+                Artifact(
+                    location=ArtifactLocation(uri=uri, uri_base_id='%SRCROOT%'),
+                    length=length,
+                    properties=properties,
+                )
+            )
+            for error in outcome.errors:
+                notifications.append(
+                    Notification(
+                        level='error',
+                        message=Message(text=error),
+                        locations=[
+                            Location(
+                                physical_location=PhysicalLocation(
+                                    artifact_location=ArtifactLocation(uri=uri, uri_base_id='%SRCROOT%')
+                                )
+                            )
+                        ],
+                    )
+                )
+
+        run.artifacts = artifacts
+        run.invocations = [Invocation(execution_successful=True, tool_execution_notifications=notifications)]
+
     def get_context_region(self, finding: Finding, masking: bool = True):
 
         start_column = finding.file.get_column_number(position=finding.start_offset)
@@ -184,10 +235,14 @@ class DojoSarifResponseBuilder(BaseResponseBuilder):
 
         boundaries, _ = self._get_context_boundaries(finding, start_column, end_column)
         base_offset = finding.file.get_line_start_offset(finding.start_line_number)
-        snippet = finding.file.content[base_offset + boundaries[0] : base_offset + boundaries[1]]
+        snippet_start = base_offset + boundaries[0]
+        snippet = finding.file.content[snippet_start : base_offset + boundaries[1]]
 
         if masking:
-            snippet = self._mask(snippet=snippet, detection=finding.detection)
+            if finding.detection in snippet:
+                snippet = self._mask(snippet=snippet, detection=finding.detection)
+            else:
+                snippet = self._mask_by_offsets(snippet=snippet, snippet_start=snippet_start, finding=finding)
 
         return Region(
             start_line=finding.start_line_number,

{deepsecrets-2.0.0 → deepsecrets-2.1.0}/deepsecrets/core/model/rules/regex.py

@@ -73,14 +73,13 @@ class RegexRule(Rule):  # type: ignore
         contents.append(token.content if isinstance(token, Token) else token)
         contents.extend(token.uncovered_content if isinstance(token, Token) else [])
 
+        # Call the compiled patterns directly: the module-level regex functions re-enter the pattern
+        # cache on every call, which costs several times the match itself on short tokens.
         for i, content in enumerate(contents):
-            if (
-                self.negative_pattern is not None
-                and re.search(pattern=self.negative_pattern, string=content) is not None
-            ):
+            if self.negative_pattern is not None and self.negative_pattern.search(content) is not None:
                 continue
 
-            matches = re.finditer(self.pattern, content)
+            matches = self.pattern.finditer(content)
 
             for match in matches:
                 if not self._verify(match):

{deepsecrets-2.0.0 → deepsecrets-2.1.0}/deepsecrets/core/model/rules/variable_scoring.py

@@ -1,8 +1,8 @@
 from enum import Enum
 import operator
-from typing import Dict, Optional
+from typing import Dict, List, Optional
 
-from pydantic import model_validator
+from pydantic import BaseModel, ConfigDict, Field, field_serializer, field_validator, model_validator
 from deepsecrets.core.model.rules.regex import RegexRule
 from deepsecrets.core.model.semantic import Context
 import regex as re
@@ -38,11 +38,35 @@ ops = {
 }
 
 
+class ScoringCondition(BaseModel):
+    """A case-insensitive regex check against one context field, used by `when` / `unless`."""
+
+    target: Target
+    pattern: re.Pattern
+
+    model_config = ConfigDict(arbitrary_types_allowed=True)
+
+    @field_validator('pattern', mode='before')
+    @classmethod
+    def compile_pattern(cls, pattern):
+        return re.compile(pattern, re.IGNORECASE) if isinstance(pattern, str) else pattern
+
+    @field_serializer('pattern')
+    def serialize_pattern(self, pattern: re.Pattern, _info):
+        return pattern.pattern
+
+    def matches(self, context: Context) -> bool:
+        return self.pattern.search(str(getattr(context, target_to_fields[self.target]))) is not None
+
+
 class VariableScoringRule(RegexRule):
     score: int
     target: Target
     method: Optional[str] = None
     threshold: Optional[float] = None
+    # the rule can only fire when every `when` condition matches and no `unless` condition does
+    when: List[ScoringCondition] = Field(default=[])
+    unless: List[ScoringCondition] = Field(default=[])
 
     def _is_threshold_type(self):
         return self.threshold is not None and self.method is not None
@@ -60,11 +84,16 @@ class VariableScoringRule(RegexRule):
         return getattr(context, field)
 
     def match_by_context(self, context: Context) -> bool:
+        if not all(condition.matches(context) for condition in self.when):
+            return False
+        if any(condition.matches(context) for condition in self.unless):
+            return False
+
         content = self._get_content_for_matching(context)
         if self._is_threshold_type():
             match = ops.get(self.method)(content, self.threshold)
         else:
-            match = re.search(self.pattern, content)
+            match = self.pattern.search(content)
         if match is not None and match is not False:
             return True
         return False

{deepsecrets-2.0.0 → deepsecrets-2.1.0}/deepsecrets/core/model/token.py

@@ -1,7 +1,7 @@
 from __future__ import annotations
 
 from enum import Enum, auto
-from typing import Any, List, Optional, Type
+from typing import Any, Dict, List, Optional, Type
 
 from deepsecrets.core.model.file import File
 from deepsecrets.core.model.rules.hashing import HashingAlgorithm
@@ -34,7 +34,7 @@ class Token:
     file: 'File'
     type: List[Type]
     length: int
-    hashed_value: Optional[str]
+    hashed_values: Dict[HashingAlgorithm, str]
     semantic: Optional[Semantic]
     previous: Optional['Token']
     next: Optional['Token']
@@ -44,7 +44,7 @@ class Token:
         self.content = content
         self.span = span
         self.length = len(content) if self.content else 0
-        self.hashed_value = None
+        self.hashed_values = {}
         self.previous = None
         self.next = None
         self.type: List[Type] = []  # type: ignore
@@ -57,11 +57,12 @@ class Token:
     def val_hash(self) -> int:
         return hash(self.content)
 
-    def calculate_hashed_value(self, algorithm: HashingAlgorithm) -> None:
-        if self.hashed_value:
-            return
+    def calculate_hashed_value(self, algorithm: HashingAlgorithm) -> str:
+        # cached per algorithm: rules for the same token length may use different algorithms
+        if algorithm not in self.hashed_values:
+            self.hashed_values[algorithm] = get_hash(payload=self.content, algorithm=algorithm)
 
-        self.hashed_value = get_hash(payload=self.content, algorithm=algorithm)
+        return self.hashed_values[algorithm]
 
     def __repr__(self) -> str:  # pragma: no cover
         if self.semantic is None and self.type is not None: