Mark parameter in ext/sodium as sensitive

- sodium_crypto_aead_aes256gcm_decrypt: $key
- sodium_crypto_aead_aes256gcm_encrypt: $message, $key
- sodium_crypto_aead_chacha20poly1305_decrypt: $key
- sodium_crypto_aead_chacha20poly1305_encrypt: $message, $key
- sodium_crypto_aead_chacha20poly1305_ietf_decrypt: $key
- sodium_crypto_aead_chacha20poly1305_ietf_encrypt: $message, $key
- sodium_crypto_aead_xchacha20poly1305_ietf_decrypt: $key
- sodium_crypto_aead_xchacha20poly1305_ietf_encrypt: $message, $key
- sodium_crypto_auth: $key
- sodium_crypto_auth_verify: $key
- sodium_crypto_box: $message, $key_pair
- sodium_crypto_box_keypair_from_secretkey_and_publickey: $secret_key
- sodium_crypto_box_open: $key_pair
- sodium_crypto_box_publickey: $key_pair
- sodium_crypto_box_publickey_from_secretkey: $secret_key
- sodium_crypto_box_seal: $message
- sodium_crypto_box_seal_open: $key_pair
- sodium_crypto_box_secretkey: $key_pair
- sodium_crypto_kx_publickey: $key_pair
- sodium_crypto_kx_secretkey: $key_pair
- sodium_crypto_kx_seed_keypair: $seed
- sodium_crypto_kx_client_session_keys: $client_key_pair
- sodium_crypto_kx_server_session_keys: $server_key_pair
- sodium_crypto_generichash: $key
- sodium_crypto_generichash_init: $key
- sodium_crypto_kdf_derive_from_key: $key
- sodium_crypto_pwhash: $password
- sodium_crypto_pwhash_str: $password
- sodium_crypto_pwhash_str_verify: $password
- sodium_crypto_pwhash_scryptsalsa208sha256: $password
- sodium_crypto_pwhash_scryptsalsa208sha256_str: $password
- sodium_crypto_pwhash_scryptsalsa208sha256_str_verify: $password
- sodium_crypto_secretbox: $message, $key
- sodium_crypto_secretbox_open: $key
- sodium_crypto_secretstream_xchacha20poly1305_init_push: $key
- sodium_crypto_secretstream_xchacha20poly1305_push: $message
- sodium_crypto_secretstream_xchacha20poly1305_init_pull: $key
- sodium_crypto_shorthash: $key
- sodium_crypto_sign: $secret_key
- sodium_crypto_sign_detached: $secret_key
- sodium_crypto_sign_ed25519_sk_to_curve25519: $secret_key
- sodium_crypto_sign_keypair_from_secretkey_and_publickey: $secret_key
- sodium_crypto_sign_publickey: $key_pair
- sodium_crypto_sign_secretkey: $key_pair
- sodium_crypto_sign_publickey_from_secretkey: $secret_key
- sodium_crypto_sign_seed_keypair: $seed
- sodium_crypto_stream: $key
- sodium_crypto_stream_xor: $message, $key
- sodium_crypto_stream_xchacha20: $key
- sodium_crypto_stream_xchacha20_xor: $message, $key
- sodium_crypto_stream_xchacha20_xor_ic: $message, $key
- sodium_compare: $string1, $string2
- sodium_memcmp: $string1, $string2
- sodium_memzero: $string
- sodium_pad: $string
- sodium_unpad: $string
- sodium_bin2hex: $string
- sodium_hex2bin: $string
- sodium_bin2base64: $string
- sodium_base642bin: $string
- sodium_crypto_scalarmult_base: $secret_key

Author: TimWolla

ext/sodium/libsodium.c

@@ -22,6 +22,7 @@
 #include "php_ini.h"
 #include "ext/standard/info.h"
 #include "php_libsodium.h"
+#include "zend_attributes.h"
 #include "zend_exceptions.h"
 
 #include <sodium.h>
@@ -386,6 +387,93 @@ PHP_MINIT_FUNCTION(sodium)
 	}
 #endif
 
+#ifdef HAVE_AESGCM
+	zend_mark_function_parameter_as_sensitive(CG(function_table), "sodium_crypto_aead_aes256gcm_decrypt", 3 /* $key */);
+	zend_mark_function_parameter_as_sensitive(CG(function_table), "sodium_crypto_aead_aes256gcm_encrypt", 0 /* $message */);
+	zend_mark_function_parameter_as_sensitive(CG(function_table), "sodium_crypto_aead_aes256gcm_encrypt", 3 /* $key */);
+#endif
+	zend_mark_function_parameter_as_sensitive(CG(function_table), "sodium_crypto_aead_chacha20poly1305_decrypt", 3 /* $key */);
+	zend_mark_function_parameter_as_sensitive(CG(function_table), "sodium_crypto_aead_chacha20poly1305_encrypt", 0 /* $message */);
+	zend_mark_function_parameter_as_sensitive(CG(function_table), "sodium_crypto_aead_chacha20poly1305_encrypt", 3 /* $key */);
+	zend_mark_function_parameter_as_sensitive(CG(function_table), "sodium_crypto_aead_chacha20poly1305_ietf_decrypt", 3 /* $key */);
+	zend_mark_function_parameter_as_sensitive(CG(function_table), "sodium_crypto_aead_chacha20poly1305_ietf_encrypt", 0 /* $message */);
+	zend_mark_function_parameter_as_sensitive(CG(function_table), "sodium_crypto_aead_chacha20poly1305_ietf_encrypt", 3 /* $key */);
+#ifdef crypto_aead_xchacha20poly1305_IETF_NPUBBYTES
+	zend_mark_function_parameter_as_sensitive(CG(function_table), "sodium_crypto_aead_xchacha20poly1305_ietf_decrypt", 3 /* $key */);
+	zend_mark_function_parameter_as_sensitive(CG(function_table), "sodium_crypto_aead_xchacha20poly1305_ietf_encrypt", 0 /* $message */);
+	zend_mark_function_parameter_as_sensitive(CG(function_table), "sodium_crypto_aead_xchacha20poly1305_ietf_encrypt", 3 /* $key */);
+#endif
+	zend_mark_function_parameter_as_sensitive(CG(function_table), "sodium_crypto_auth", 1 /* $key */);
+	zend_mark_function_parameter_as_sensitive(CG(function_table), "sodium_crypto_auth_verify", 2 /* $key */);
+	zend_mark_function_parameter_as_sensitive(CG(function_table), "sodium_crypto_box", 0 /* $message */);
+	zend_mark_function_parameter_as_sensitive(CG(function_table), "sodium_crypto_box", 2 /* $key_pair */);
+	zend_mark_function_parameter_as_sensitive(CG(function_table), "sodium_crypto_box_keypair_from_secretkey_and_publickey", 0 /* $secret_key */);
+	zend_mark_function_parameter_as_sensitive(CG(function_table), "sodium_crypto_box_open", 2 /* $key_pair */);
+	zend_mark_function_parameter_as_sensitive(CG(function_table), "sodium_crypto_box_publickey", 0 /* $key_pair */);
+	zend_mark_function_parameter_as_sensitive(CG(function_table), "sodium_crypto_box_publickey_from_secretkey", 0 /* $secret_key */);
+	zend_mark_function_parameter_as_sensitive(CG(function_table), "sodium_crypto_box_seal", 0 /* $message */);
+	zend_mark_function_parameter_as_sensitive(CG(function_table), "sodium_crypto_box_seal_open", 1 /* $key_pair */);
+	zend_mark_function_parameter_as_sensitive(CG(function_table), "sodium_crypto_box_secretkey", 0 /* $key_pair */);
+	zend_mark_function_parameter_as_sensitive(CG(function_table), "sodium_crypto_kx_publickey", 0 /* $key_pair */);
+	zend_mark_function_parameter_as_sensitive(CG(function_table), "sodium_crypto_kx_secretkey", 0 /* $key_pair */);
+	zend_mark_function_parameter_as_sensitive(CG(function_table), "sodium_crypto_kx_seed_keypair", 0 /* $seed */);
+	zend_mark_function_parameter_as_sensitive(CG(function_table), "sodium_crypto_kx_client_session_keys", 0 /* $client_key_pair */);
+	zend_mark_function_parameter_as_sensitive(CG(function_table), "sodium_crypto_kx_server_session_keys", 0 /* $server_key_pair */);
+	zend_mark_function_parameter_as_sensitive(CG(function_table), "sodium_crypto_generichash", 1 /* $key */);
+	zend_mark_function_parameter_as_sensitive(CG(function_table), "sodium_crypto_generichash_init", 0 /* $key */);
+	zend_mark_function_parameter_as_sensitive(CG(function_table), "sodium_crypto_kdf_derive_from_key", 3 /* $key */);
+#ifdef crypto_pwhash_SALTBYTES
+	zend_mark_function_parameter_as_sensitive(CG(function_table), "sodium_crypto_pwhash", 1 /* $password */);
+	zend_mark_function_parameter_as_sensitive(CG(function_table), "sodium_crypto_pwhash_str", 0 /* $password */);
+	zend_mark_function_parameter_as_sensitive(CG(function_table), "sodium_crypto_pwhash_str_verify", 1 /* $password */);
+#endif
+#ifdef crypto_pwhash_scryptsalsa208sha256_SALTBYTES
+	zend_mark_function_parameter_as_sensitive(CG(function_table), "sodium_crypto_pwhash_scryptsalsa208sha256", 1 /* $password */);
+	zend_mark_function_parameter_as_sensitive(CG(function_table), "sodium_crypto_pwhash_scryptsalsa208sha256_str", 0 /* $password */);
+	zend_mark_function_parameter_as_sensitive(CG(function_table), "sodium_crypto_pwhash_scryptsalsa208sha256_str_verify", 1 /* $password */);
+#endif
+	zend_mark_function_parameter_as_sensitive(CG(function_table), "sodium_crypto_secretbox", 0 /* $message */);
+	zend_mark_function_parameter_as_sensitive(CG(function_table), "sodium_crypto_secretbox", 2 /* $key */);
+	zend_mark_function_parameter_as_sensitive(CG(function_table), "sodium_crypto_secretbox_open", 2 /* $key */);
+#ifdef crypto_secretstream_xchacha20poly1305_ABYTES
+	zend_mark_function_parameter_as_sensitive(CG(function_table), "sodium_crypto_secretstream_xchacha20poly1305_init_push", 0 /* $key */);
+	zend_mark_function_parameter_as_sensitive(CG(function_table), "sodium_crypto_secretstream_xchacha20poly1305_push", 1 /* $message */);
+	zend_mark_function_parameter_as_sensitive(CG(function_table), "sodium_crypto_secretstream_xchacha20poly1305_init_pull", 1 /* $key */);
+#endif
+	zend_mark_function_parameter_as_sensitive(CG(function_table), "sodium_crypto_shorthash", 1 /* $key */);
+	zend_mark_function_parameter_as_sensitive(CG(function_table), "sodium_crypto_sign", 1 /* $secret_key */);
+	zend_mark_function_parameter_as_sensitive(CG(function_table), "sodium_crypto_sign_detached", 1 /* $secret_key */);
+	zend_mark_function_parameter_as_sensitive(CG(function_table), "sodium_crypto_sign_ed25519_sk_to_curve25519", 0 /* $secret_key */);
+	zend_mark_function_parameter_as_sensitive(CG(function_table), "sodium_crypto_sign_keypair_from_secretkey_and_publickey", 0 /* $secret_key */);
+	zend_mark_function_parameter_as_sensitive(CG(function_table), "sodium_crypto_sign_publickey", 0 /* $key_pair */);
+	zend_mark_function_parameter_as_sensitive(CG(function_table), "sodium_crypto_sign_secretkey", 0 /* $key_pair */);
+	zend_mark_function_parameter_as_sensitive(CG(function_table), "sodium_crypto_sign_publickey_from_secretkey", 0 /* $secret_key */);
+	zend_mark_function_parameter_as_sensitive(CG(function_table), "sodium_crypto_sign_seed_keypair", 0 /* $seed */);
+	zend_mark_function_parameter_as_sensitive(CG(function_table), "sodium_crypto_stream", 2 /* $key */);
+	zend_mark_function_parameter_as_sensitive(CG(function_table), "sodium_crypto_stream_xor", 0 /* $message */);
+	zend_mark_function_parameter_as_sensitive(CG(function_table), "sodium_crypto_stream_xor", 2 /* $key */);
+#if defined(crypto_stream_xchacha20_KEYBYTES)
+	zend_mark_function_parameter_as_sensitive(CG(function_table), "sodium_crypto_stream_xchacha20", 2 /* $key */);
+	zend_mark_function_parameter_as_sensitive(CG(function_table), "sodium_crypto_stream_xchacha20_xor", 0 /* $message */);
+	zend_mark_function_parameter_as_sensitive(CG(function_table), "sodium_crypto_stream_xchacha20_xor", 2 /* $key */);
+	zend_mark_function_parameter_as_sensitive(CG(function_table), "sodium_crypto_stream_xchacha20_xor_ic", 0 /* $message */);
+	zend_mark_function_parameter_as_sensitive(CG(function_table), "sodium_crypto_stream_xchacha20_xor_ic", 3 /* $key */);
+#endif
+	zend_mark_function_parameter_as_sensitive(CG(function_table), "sodium_compare", 0 /* $string1 */);
+	zend_mark_function_parameter_as_sensitive(CG(function_table), "sodium_compare", 1 /* $string2 */);
+	zend_mark_function_parameter_as_sensitive(CG(function_table), "sodium_memcmp", 0 /* $string1 */);
+	zend_mark_function_parameter_as_sensitive(CG(function_table), "sodium_memcmp", 1 /* $string2 */);
+	zend_mark_function_parameter_as_sensitive(CG(function_table), "sodium_memzero", 0 /* $string */);
+	zend_mark_function_parameter_as_sensitive(CG(function_table), "sodium_pad", 0 /* $string */);
+	zend_mark_function_parameter_as_sensitive(CG(function_table), "sodium_unpad", 0 /* $string */);
+	zend_mark_function_parameter_as_sensitive(CG(function_table), "sodium_bin2hex", 0 /* $string */);
+	zend_mark_function_parameter_as_sensitive(CG(function_table), "sodium_hex2bin", 0 /* $string */);
+#ifdef sodium_base64_VARIANT_ORIGINAL
+	zend_mark_function_parameter_as_sensitive(CG(function_table), "sodium_bin2base64", 0 /* $string */);
+	zend_mark_function_parameter_as_sensitive(CG(function_table), "sodium_base642bin", 0 /* $string */);
+#endif
+	zend_mark_function_parameter_as_sensitive(CG(function_table), "sodium_crypto_scalarmult_base", 0 /* $secret_key */);
+
 	return SUCCESS;
 }