From 025551985c655351c569db7e4404b1390f7f126d Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Sun, 14 Jun 2026 12:16:21 +0000
Subject: [PATCH] Optimize iteration in extract_secrets and obfuscate_secrets
 to prevent allocations

By using in-place mutation during the primary `iter_mut()` traversal of the `Value::Object(map)`, we avoid explicitly storing matching keys in an intermediate `keys_to_update` (or `keys_to_obfuscate`) vector and looping over them a second time. This saves memory allocations and redundant HashMap lookups.

Co-authored-by: ffalcinelli <1167082+ffalcinelli@users.noreply.github.com>
---
 src/utils/secrets/mod.rs | 28 +++++++---------------------
 1 file changed, 7 insertions(+), 21 deletions(-)

diff --git a/src/utils/secrets/mod.rs b/src/utils/secrets/mod.rs
index 55d4627..998212f 100644
--- a/src/utils/secrets/mod.rs
+++ b/src/utils/secrets/mod.rs
@@ -132,8 +132,6 @@ fn format_env_var_name(prefix: &str, key: &str) -> String {
 pub fn extract_secrets(value: &mut Value, prefix: &str, secrets: &mut HashMap<String, String>) {
     match value {
         Value::Object(map) => {
-            let mut keys_to_update = Vec::new();
-
             let id = get_object_identifier(map);
 
             let current_prefix = if let Some(id_str) = id {
@@ -149,7 +147,9 @@ pub fn extract_secrets(value: &mut Value, prefix: &str, secrets: &mut HashMap<St
             for (k, v) in map.iter_mut() {
                 if let Value::String(s) = v {
                     if is_secret_key(k, &current_prefix) && !is_boolean_string(s) {
-                        keys_to_update.push(k.clone());
+                        let env_var_name = format_env_var_name(&current_prefix, k);
+                        secrets.insert(env_var_name.clone(), s.clone());
+                        *s = format!("${{{}}}", env_var_name);
                     }
                 } else if v.is_object() || v.is_array() {
                     let new_prefix = if current_prefix.is_empty() {
@@ -160,14 +160,6 @@ pub fn extract_secrets(value: &mut Value, prefix: &str, secrets: &mut HashMap<St
                     extract_secrets(v, &new_prefix, secrets);
                 }
             }
-
-            for k in keys_to_update {
-                if let Some(Value::String(s)) = map.get_mut(&k) {
-                    let env_var_name = format_env_var_name(&current_prefix, &k);
-                    secrets.insert(env_var_name.clone(), s.clone());
-                    *s = format!("${{{}}}", env_var_name);
-                }
-            }
         }
         Value::Array(arr) => {
             for (i, v) in arr.iter_mut().enumerate() {
@@ -235,8 +227,6 @@ fn obfuscate_string(s: &str) -> String {
 pub fn obfuscate_secrets(value: &mut Value, prefix: &str) {
     match value {
         Value::Object(map) => {
-            let mut keys_to_obfuscate = Vec::new();
-
             let id = get_object_identifier(map);
 
             let current_prefix = if let Some(id_str) = id {
@@ -250,8 +240,10 @@ pub fn obfuscate_secrets(value: &mut Value, prefix: &str) {
             };
 
             for (k, v) in map.iter_mut() {
-                if v.is_string() && is_secret_key(k, &current_prefix) {
-                    keys_to_obfuscate.push(k.clone());
+                if let Value::String(s) = v {
+                    if is_secret_key(k, &current_prefix) {
+                        *s = obfuscate_string(s);
+                    }
                 } else if v.is_object() || v.is_array() {
                     let new_prefix = if current_prefix.is_empty() {
                         k.clone()
@@ -261,12 +253,6 @@ pub fn obfuscate_secrets(value: &mut Value, prefix: &str) {
                     obfuscate_secrets(v, &new_prefix);
                 }
             }
-
-            for k in keys_to_obfuscate {
-                if let Some(Value::String(s)) = map.get_mut(&k) {
-                    *s = obfuscate_string(s);
-                }
-            }
         }
         Value::Array(arr) => {
             for (i, v) in arr.iter_mut().enumerate() {