Skip to content

Commit 348ca3c

Browse files
TimWollaTimWolla
committed
Implement the "Redacting parameters in back traces" RFC
https://wiki.php.net/rfc/redact_parameters_in_back_traces
1 parent 2aceb0b commit 348ca3c

23 files changed

+1143
-10
lines changed

‎Zend/tests/function_arguments/sensitive_parameter.phpt

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
--TEST--
2+
The SensitiveParameter attribute suppresses the single sensitive argument.
3+
--FILE--
4+
<?php
5+
6+
function test(#[SensitiveParameter] $sensitive)
7+
{
8+
debug_print_backtrace();
9+
var_dump(debug_backtrace());
10+
var_dump((new Exception)->getTrace());
11+
}
12+
13+
test('sensitive');
14+
15+
?>
16+
--EXPECTF--
17+
#0 %ssensitive_parameter.php(10): test(Object(SensitiveParameterValue))
18+
array(1) {
19+
[0]=>
20+
array(4) {
21+
["file"]=>
22+
string(%d) "%ssensitive_parameter.php"
23+
["line"]=>
24+
int(10)
25+
["function"]=>
26+
string(4) "test"
27+
["args"]=>
28+
array(1) {
29+
[0]=>
30+
object(SensitiveParameterValue)#%d (0) {
31+
}
32+
}
33+
}
34+
}
35+
array(1) {
36+
[0]=>
37+
array(4) {
38+
["file"]=>
39+
string(%d) "%ssensitive_parameter.php"
40+
["line"]=>
41+
int(10)
42+
["function"]=>
43+
string(4) "test"
44+
["args"]=>
45+
array(1) {
46+
[0]=>
47+
object(SensitiveParameterValue)#%d (0) {
48+
}
49+
}
50+
}
51+
}

‎Zend/tests/function_arguments/sensitive_parameter_arrow_function.phpt

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
--TEST--
2+
The SensitiveParameter attribute suppresses the single sensitive argument for arrow functions.
3+
--FILE--
4+
<?php
5+
6+
$test = fn (#[SensitiveParameter] $sensitive) => (new Exception)->getTrace();
7+
8+
var_dump($test('sensitive'));
9+
10+
?>
11+
--EXPECTF--
12+
array(1) {
13+
[0]=>
14+
array(4) {
15+
["file"]=>
16+
string(%d) "%ssensitive_parameter_arrow_function.php"
17+
["line"]=>
18+
int(5)
19+
["function"]=>
20+
string(9) "{closure}"
21+
["args"]=>
22+
array(1) {
23+
[0]=>
24+
object(SensitiveParameterValue)#%d (0) {
25+
}
26+
}
27+
}
28+
}

‎Zend/tests/function_arguments/sensitive_parameter_closure.phpt

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
--TEST--
2+
The SensitiveParameter attribute suppresses the single sensitive argument for closures.
3+
--FILE--
4+
<?php
5+
6+
$test = function (#[SensitiveParameter] $sensitive)
7+
{
8+
debug_print_backtrace();
9+
var_dump(debug_backtrace());
10+
var_dump((new Exception)->getTrace());
11+
};
12+
13+
$test('sensitive');
14+
15+
?>
16+
--EXPECTF--
17+
#0 %ssensitive_parameter_closure.php(10): {closure}(Object(SensitiveParameterValue))
18+
array(1) {
19+
[0]=>
20+
array(4) {
21+
["file"]=>
22+
string(%d) "%ssensitive_parameter_closure.php"
23+
["line"]=>
24+
int(10)
25+
["function"]=>
26+
string(9) "{closure}"
27+
["args"]=>
28+
array(1) {
29+
[0]=>
30+
object(SensitiveParameterValue)#%d (0) {
31+
}
32+
}
33+
}
34+
}
35+
array(1) {
36+
[0]=>
37+
array(4) {
38+
["file"]=>
39+
string(%d) "%ssensitive_parameter_closure.php"
40+
["line"]=>
41+
int(10)
42+
["function"]=>
43+
string(9) "{closure}"
44+
["args"]=>
45+
array(1) {
46+
[0]=>
47+
object(SensitiveParameterValue)#%d (0) {
48+
}
49+
}
50+
}
51+
}

‎Zend/tests/function_arguments/sensitive_parameter_correctly_captures_original.phpt

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
--TEST--
2+
The SensitiveParameterValue replacement value correctly captures the original value.
3+
--FILE--
4+
<?php
5+
6+
function test(
7+
$foo,
8+
#[SensitiveParameter] $bar,
9+
$baz
10+
) {
11+
throw new Exception('Error');
12+
}
13+
14+
try {
15+
test('foo', 'bar', 'baz');
16+
echo 'Not reached';
17+
} catch (Exception $e) {
18+
echo $e->getMessage(), PHP_EOL;
19+
$testFrame = $e->getTrace()[0];
20+
var_dump($testFrame['function']);
21+
var_dump(count($testFrame['args']));
22+
var_dump($testFrame['args'][0]);
23+
assert($testFrame['args'][1] instanceof SensitiveParameterValue);
24+
var_dump($testFrame['args'][1]->getValue());
25+
var_dump($testFrame['args'][2]);
26+
echo "Success", PHP_EOL;
27+
}
28+
29+
function test2(
30+
$foo,
31+
#[SensitiveParameter] ...$variadic,
32+
) {
33+
throw new Exception('Error 2');
34+
}
35+
36+
try {
37+
test2('foo', 'variadic1', 'variadic2', 'variadic3');
38+
echo 'Not reached';
39+
} catch (Exception $e) {
40+
echo $e->getMessage(), PHP_EOL;
41+
$testFrame = $e->getTrace()[0];
42+
var_dump($testFrame['function']);
43+
var_dump(count($testFrame['args']));
44+
var_dump($testFrame['args'][0]);
45+
assert($testFrame['args'][1] instanceof SensitiveParameterValue);
46+
var_dump($testFrame['args'][1]->getValue());
47+
assert($testFrame['args'][2] instanceof SensitiveParameterValue);
48+
var_dump($testFrame['args'][2]->getValue());
49+
assert($testFrame['args'][3] instanceof SensitiveParameterValue);
50+
var_dump($testFrame['args'][3]->getValue());
51+
echo "Success", PHP_EOL;
52+
}
53+
54+
?>
55+
--EXPECTF--
56+
Error
57+
string(4) "test"
58+
int(3)
59+
string(3) "foo"
60+
string(3) "bar"
61+
string(3) "baz"
62+
Success
63+
Error 2
64+
string(5) "test2"
65+
int(4)
66+
string(3) "foo"
67+
string(9) "variadic1"
68+
string(9) "variadic2"
69+
string(9) "variadic3"
70+
Success

‎Zend/tests/function_arguments/sensitive_parameter_eval_call.phpt

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
--TEST--
2+
The SensitiveParameter attribute suppresses the single sensitive argument in a function called in eval().
3+
--FILE--
4+
<?php
5+
6+
function test(#[SensitiveParameter] $sensitive)
7+
{
8+
debug_print_backtrace();
9+
var_dump(debug_backtrace());
10+
var_dump((new Exception)->getTrace());
11+
}
12+
13+
eval(<<<'EOT'
14+
test('sensitive');
15+
EOT);
16+
17+
?>
18+
--EXPECTF--
19+
#0 %ssensitive_parameter_eval_call.php(11) : eval()'d code(1): test(Object(SensitiveParameterValue))
20+
#1 %ssensitive_parameter_eval_call.php(11): eval()
21+
array(2) {
22+
[0]=>
23+
array(4) {
24+
["file"]=>
25+
string(%d) "%ssensitive_parameter_eval_call.php(11) : eval()'d code"
26+
["line"]=>
27+
int(1)
28+
["function"]=>
29+
string(4) "test"
30+
["args"]=>
31+
array(1) {
32+
[0]=>
33+
object(SensitiveParameterValue)#%d (0) {
34+
}
35+
}
36+
}
37+
[1]=>
38+
array(3) {
39+
["file"]=>
40+
string(%d) "%ssensitive_parameter_eval_call.php"
41+
["line"]=>
42+
int(11)
43+
["function"]=>
44+
string(4) "eval"
45+
}
46+
}
47+
array(2) {
48+
[0]=>
49+
array(4) {
50+
["file"]=>
51+
string(%d) "%ssensitive_parameter_eval_call.php(11) : eval()'d code"
52+
["line"]=>
53+
int(1)
54+
["function"]=>
55+
string(4) "test"
56+
["args"]=>
57+
array(1) {
58+
[0]=>
59+
object(SensitiveParameterValue)#%d (0) {
60+
}
61+
}
62+
}
63+
[1]=>
64+
array(3) {
65+
["file"]=>
66+
string(%d) "%ssensitive_parameter_eval_call.php"
67+
["line"]=>
68+
int(11)
69+
["function"]=>
70+
string(4) "eval"
71+
}
72+
}

‎Zend/tests/function_arguments/sensitive_parameter_eval_define.phpt

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
--TEST--
2+
The SensitiveParameter attribute suppresses the single sensitive argument in a function created in eval().
3+
--FILE--
4+
<?php
5+
6+
eval(<<<'EOT'
7+
function test(#[SensitiveParameter] $sensitive)
8+
{
9+
debug_print_backtrace();
10+
var_dump(debug_backtrace());
11+
var_dump((new Exception)->getTrace());
12+
}
13+
EOT);
14+
15+
test('sensitive');
16+
17+
?>
18+
--EXPECTF--
19+
#0 %ssensitive_parameter_eval_define.php(12): test(Object(SensitiveParameterValue))
20+
array(1) {
21+
[0]=>
22+
array(4) {
23+
["file"]=>
24+
string(%d) "%ssensitive_parameter_eval_define.php"
25+
["line"]=>
26+
int(12)
27+
["function"]=>
28+
string(4) "test"
29+
["args"]=>
30+
array(1) {
31+
[0]=>
32+
object(SensitiveParameterValue)#%d (0) {
33+
}
34+
}
35+
}
36+
}
37+
array(1) {
38+
[0]=>
39+
array(4) {
40+
["file"]=>
41+
string(%d) "%ssensitive_parameter_eval_define.php"
42+
["line"]=>
43+
int(12)
44+
["function"]=>
45+
string(4) "test"
46+
["args"]=>
47+
array(1) {
48+
[0]=>
49+
object(SensitiveParameterValue)#%d (0) {
50+
}
51+
}
52+
}
53+
}

‎Zend/tests/function_arguments/sensitive_parameter_extra_arguments.phpt

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
--TEST--
2+
The SensitiveParameter attribute does not suppress superfluous arguments if the last parameter is sensitive.
3+
--FILE--
4+
<?php
5+
6+
function test(
7+
$non_sensitive,
8+
#[SensitiveParameter] $sensitive,
9+
)
10+
{
11+
debug_print_backtrace();
12+
var_dump(debug_backtrace());
13+
var_dump((new Exception)->getTrace());
14+
}
15+
16+
test('foo', 'bar', 'baz');
17+
18+
?>
19+
--EXPECTF--
20+
#0 %ssensitive_parameter_extra_arguments.php(13): test('foo', Object(SensitiveParameterValue), 'baz')
21+
array(1) {
22+
[0]=>
23+
array(4) {
24+
["file"]=>
25+
string(%d) "%ssensitive_parameter_extra_arguments.php"
26+
["line"]=>
27+
int(13)
28+
["function"]=>
29+
string(4) "test"
30+
["args"]=>
31+
array(3) {
32+
[0]=>
33+
string(3) "foo"
34+
[1]=>
35+
object(SensitiveParameterValue)#%d (0) {
36+
}
37+
[2]=>
38+
string(3) "baz"
39+
}
40+
}
41+
}
42+
array(1) {
43+
[0]=>
44+
array(4) {
45+
["file"]=>
46+
string(%d) "%ssensitive_parameter_extra_arguments.php"
47+
["line"]=>
48+
int(13)
49+
["function"]=>
50+
string(4) "test"
51+
["args"]=>
52+
array(3) {
53+
[0]=>
54+
string(3) "foo"
55+
[1]=>
56+
object(SensitiveParameterValue)#%d (0) {
57+
}
58+
[2]=>
59+
string(3) "baz"
60+
}
61+
}
62+
}

0 commit comments

Comments
 (0)