Skip to content

Commit 9085197

Browse files
TimWollailuuu1994
TimWolla
authored and
iluuu1994
committed
Implement the "Redacting parameters in back traces" RFC
https://wiki.php.net/rfc/redact_parameters_in_back_traces
1 parent c68591f commit 9085197

24 files changed

+1113
-10
lines changed

‎UPGRADING

+5
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,11 @@ PHP 8.2 UPGRADE NOTES
3131
2. New Features
3232
========================================
3333

34+
- Core:
35+
. Added the #\[\SensitiveParameter] attribute to redact sensitive data in
36+
backtraces.
37+
RFC: https://wiki.php.net/rfc/redact_parameters_in_back_traces
38+
3439
- Curl:
3540
. Added CURLINFO_EFFECTIVE_METHOD option and returning the effective
3641
HTTP method in curl_getinfo() return value.

‎Zend/tests/function_arguments/sensitive_parameter.phpt

+51
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
--TEST--
2+
The SensitiveParameter attribute suppresses the single sensitive argument.
3+
--FILE--
4+
<?php
5+
6+
function test(#[SensitiveParameter] $sensitive)
7+
{
8+
debug_print_backtrace();
9+
var_dump(debug_backtrace());
10+
var_dump((new Exception)->getTrace());
11+
}
12+
13+
test('sensitive');
14+
15+
?>
16+
--EXPECTF--
17+
#0 %ssensitive_parameter.php(10): test(Object(SensitiveParameterValue))
18+
array(1) {
19+
[0]=>
20+
array(4) {
21+
["file"]=>
22+
string(%d) "%ssensitive_parameter.php"
23+
["line"]=>
24+
int(10)
25+
["function"]=>
26+
string(4) "test"
27+
["args"]=>
28+
array(1) {
29+
[0]=>
30+
object(SensitiveParameterValue)#%d (0) {
31+
}
32+
}
33+
}
34+
}
35+
array(1) {
36+
[0]=>
37+
array(4) {
38+
["file"]=>
39+
string(%d) "%ssensitive_parameter.php"
40+
["line"]=>
41+
int(10)
42+
["function"]=>
43+
string(4) "test"
44+
["args"]=>
45+
array(1) {
46+
[0]=>
47+
object(SensitiveParameterValue)#%d (0) {
48+
}
49+
}
50+
}
51+
}

‎Zend/tests/function_arguments/sensitive_parameter_arrow_function.phpt

+28
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
--TEST--
2+
The SensitiveParameter attribute suppresses the single sensitive argument for arrow functions.
3+
--FILE--
4+
<?php
5+
6+
$test = fn (#[SensitiveParameter] $sensitive) => (new Exception)->getTrace();
7+
8+
var_dump($test('sensitive'));
9+
10+
?>
11+
--EXPECTF--
12+
array(1) {
13+
[0]=>
14+
array(4) {
15+
["file"]=>
16+
string(%d) "%ssensitive_parameter_arrow_function.php"
17+
["line"]=>
18+
int(5)
19+
["function"]=>
20+
string(9) "{closure}"
21+
["args"]=>
22+
array(1) {
23+
[0]=>
24+
object(SensitiveParameterValue)#%d (0) {
25+
}
26+
}
27+
}
28+
}

‎Zend/tests/function_arguments/sensitive_parameter_closure.phpt

+51
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
--TEST--
2+
The SensitiveParameter attribute suppresses the single sensitive argument for closures.
3+
--FILE--
4+
<?php
5+
6+
$test = function (#[SensitiveParameter] $sensitive)
7+
{
8+
debug_print_backtrace();
9+
var_dump(debug_backtrace());
10+
var_dump((new Exception)->getTrace());
11+
};
12+
13+
$test('sensitive');
14+
15+
?>
16+
--EXPECTF--
17+
#0 %ssensitive_parameter_closure.php(10): {closure}(Object(SensitiveParameterValue))
18+
array(1) {
19+
[0]=>
20+
array(4) {
21+
["file"]=>
22+
string(%d) "%ssensitive_parameter_closure.php"
23+
["line"]=>
24+
int(10)
25+
["function"]=>
26+
string(9) "{closure}"
27+
["args"]=>
28+
array(1) {
29+
[0]=>
30+
object(SensitiveParameterValue)#%d (0) {
31+
}
32+
}
33+
}
34+
}
35+
array(1) {
36+
[0]=>
37+
array(4) {
38+
["file"]=>
39+
string(%d) "%ssensitive_parameter_closure.php"
40+
["line"]=>
41+
int(10)
42+
["function"]=>
43+
string(9) "{closure}"
44+
["args"]=>
45+
array(1) {
46+
[0]=>
47+
object(SensitiveParameterValue)#%d (0) {
48+
}
49+
}
50+
}
51+
}

‎Zend/tests/function_arguments/sensitive_parameter_correctly_captures_original.phpt

+70
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
--TEST--
2+
The SensitiveParameterValue replacement value correctly captures the original value.
3+
--FILE--
4+
<?php
5+
6+
function test(
7+
$foo,
8+
#[SensitiveParameter] $bar,
9+
$baz
10+
) {
11+
throw new Exception('Error');
12+
}
13+
14+
try {
15+
test('foo', 'bar', 'baz');
16+
echo 'Not reached';
17+
} catch (Exception $e) {
18+
echo $e->getMessage(), PHP_EOL;
19+
$testFrame = $e->getTrace()[0];
20+
var_dump($testFrame['function']);
21+
var_dump(count($testFrame['args']));
22+
var_dump($testFrame['args'][0]);
23+
assert($testFrame['args'][1] instanceof SensitiveParameterValue);
24+
var_dump($testFrame['args'][1]->getValue());
25+
var_dump($testFrame['args'][2]);
26+
echo "Success", PHP_EOL;
27+
}
28+
29+
function test2(
30+
$foo,
31+
#[SensitiveParameter] ...$variadic,
32+
) {
33+
throw new Exception('Error 2');
34+
}
35+
36+
try {
37+
test2('foo', 'variadic1', 'variadic2', 'variadic3');
38+
echo 'Not reached';
39+
} catch (Exception $e) {
40+
echo $e->getMessage(), PHP_EOL;
41+
$testFrame = $e->getTrace()[0];
42+
var_dump($testFrame['function']);
43+
var_dump(count($testFrame['args']));
44+
var_dump($testFrame['args'][0]);
45+
assert($testFrame['args'][1] instanceof SensitiveParameterValue);
46+
var_dump($testFrame['args'][1]->getValue());
47+
assert($testFrame['args'][2] instanceof SensitiveParameterValue);
48+
var_dump($testFrame['args'][2]->getValue());
49+
assert($testFrame['args'][3] instanceof SensitiveParameterValue);
50+
var_dump($testFrame['args'][3]->getValue());
51+
echo "Success", PHP_EOL;
52+
}
53+
54+
?>
55+
--EXPECTF--
56+
Error
57+
string(4) "test"
58+
int(3)
59+
string(3) "foo"
60+
string(3) "bar"
61+
string(3) "baz"
62+
Success
63+
Error 2
64+
string(5) "test2"
65+
int(4)
66+
string(3) "foo"
67+
string(9) "variadic1"
68+
string(9) "variadic2"
69+
string(9) "variadic3"
70+
Success

‎Zend/tests/function_arguments/sensitive_parameter_eval_call.phpt

+72
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
--TEST--
2+
The SensitiveParameter attribute suppresses the single sensitive argument in a function called in eval().
3+
--FILE--
4+
<?php
5+
6+
function test(#[SensitiveParameter] $sensitive)
7+
{
8+
debug_print_backtrace();
9+
var_dump(debug_backtrace());
10+
var_dump((new Exception)->getTrace());
11+
}
12+
13+
eval(<<<'EOT'
14+
test('sensitive');
15+
EOT);
16+
17+
?>
18+
--EXPECTF--
19+
#0 %ssensitive_parameter_eval_call.php(11) : eval()'d code(1): test(Object(SensitiveParameterValue))
20+
#1 %ssensitive_parameter_eval_call.php(11): eval()
21+
array(2) {
22+
[0]=>
23+
array(4) {
24+
["file"]=>
25+
string(%d) "%ssensitive_parameter_eval_call.php(11) : eval()'d code"
26+
["line"]=>
27+
int(1)
28+
["function"]=>
29+
string(4) "test"
30+
["args"]=>
31+
array(1) {
32+
[0]=>
33+
object(SensitiveParameterValue)#%d (0) {
34+
}
35+
}
36+
}
37+
[1]=>
38+
array(3) {
39+
["file"]=>
40+
string(%d) "%ssensitive_parameter_eval_call.php"
41+
["line"]=>
42+
int(11)
43+
["function"]=>
44+
string(4) "eval"
45+
}
46+
}
47+
array(2) {
48+
[0]=>
49+
array(4) {
50+
["file"]=>
51+
string(%d) "%ssensitive_parameter_eval_call.php(11) : eval()'d code"
52+
["line"]=>
53+
int(1)
54+
["function"]=>
55+
string(4) "test"
56+
["args"]=>
57+
array(1) {
58+
[0]=>
59+
object(SensitiveParameterValue)#%d (0) {
60+
}
61+
}
62+
}
63+
[1]=>
64+
array(3) {
65+
["file"]=>
66+
string(%d) "%ssensitive_parameter_eval_call.php"
67+
["line"]=>
68+
int(11)
69+
["function"]=>
70+
string(4) "eval"
71+
}
72+
}

‎Zend/tests/function_arguments/sensitive_parameter_eval_define.phpt

+53
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
--TEST--
2+
The SensitiveParameter attribute suppresses the single sensitive argument in a function created in eval().
3+
--FILE--
4+
<?php
5+
6+
eval(<<<'EOT'
7+
function test(#[SensitiveParameter] $sensitive)
8+
{
9+
debug_print_backtrace();
10+
var_dump(debug_backtrace());
11+
var_dump((new Exception)->getTrace());
12+
}
13+
EOT);
14+
15+
test('sensitive');
16+
17+
?>
18+
--EXPECTF--
19+
#0 %ssensitive_parameter_eval_define.php(12): test(Object(SensitiveParameterValue))
20+
array(1) {
21+
[0]=>
22+
array(4) {
23+
["file"]=>
24+
string(%d) "%ssensitive_parameter_eval_define.php"
25+
["line"]=>
26+
int(12)
27+
["function"]=>
28+
string(4) "test"
29+
["args"]=>
30+
array(1) {
31+
[0]=>
32+
object(SensitiveParameterValue)#%d (0) {
33+
}
34+
}
35+
}
36+
}
37+
array(1) {
38+
[0]=>
39+
array(4) {
40+
["file"]=>
41+
string(%d) "%ssensitive_parameter_eval_define.php"
42+
["line"]=>
43+
int(12)
44+
["function"]=>
45+
string(4) "test"
46+
["args"]=>
47+
array(1) {
48+
[0]=>
49+
object(SensitiveParameterValue)#%d (0) {
50+
}
51+
}
52+
}
53+
}

0 commit comments

Comments
 (0)