Skip to content

Commit 93e1509

Browse files
TimWollaTimWolla
committed
Implement the "Redacting parameters in back traces" RFC
https://wiki.php.net/rfc/redact_parameters_in_back_traces
1 parent 2aceb0b commit 93e1509

21 files changed

+1025
-17
lines changed

‎Zend/tests/function_arguments/sensitive_parameter.phpt

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
--TEST--
2+
The SensitiveParameter attribute suppresses the single sensitive argument.
3+
--FILE--
4+
<?php
5+
6+
function test(#[SensitiveParameter] $sensitive)
7+
{
8+
debug_print_backtrace();
9+
var_dump(debug_backtrace());
10+
var_dump((new Exception)->getTrace());
11+
}
12+
13+
test('sensitive');
14+
15+
?>
16+
--EXPECTF--
17+
#0 %ssensitive_parameter.php(10): test(Object(SensitiveParameterValue))
18+
array(1) {
19+
[0]=>
20+
array(4) {
21+
["file"]=>
22+
string(%d) "%ssensitive_parameter.php"
23+
["line"]=>
24+
int(10)
25+
["function"]=>
26+
string(4) "test"
27+
["args"]=>
28+
array(1) {
29+
[0]=>
30+
object(SensitiveParameterValue)#%d (0) {
31+
}
32+
}
33+
}
34+
}
35+
array(1) {
36+
[0]=>
37+
array(4) {
38+
["file"]=>
39+
string(%d) "%ssensitive_parameter.php"
40+
["line"]=>
41+
int(10)
42+
["function"]=>
43+
string(4) "test"
44+
["args"]=>
45+
array(1) {
46+
[0]=>
47+
object(SensitiveParameterValue)#%d (0) {
48+
}
49+
}
50+
}
51+
}

‎Zend/tests/function_arguments/sensitive_parameter_arrow_function.phpt

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
--TEST--
2+
The SensitiveParameter attribute suppresses the single sensitive argument for arrow functions.
3+
--FILE--
4+
<?php
5+
6+
$test = fn (#[SensitiveParameter] $sensitive) => (new Exception)->getTrace();
7+
8+
var_dump($test('sensitive'));
9+
10+
?>
11+
--EXPECTF--
12+
array(1) {
13+
[0]=>
14+
array(4) {
15+
["file"]=>
16+
string(%d) "%ssensitive_parameter_arrow_function.php"
17+
["line"]=>
18+
int(5)
19+
["function"]=>
20+
string(9) "{closure}"
21+
["args"]=>
22+
array(1) {
23+
[0]=>
24+
object(SensitiveParameterValue)#%d (0) {
25+
}
26+
}
27+
}
28+
}

‎Zend/tests/function_arguments/sensitive_parameter_closure.phpt

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
--TEST--
2+
The SensitiveParameter attribute suppresses the single sensitive argument for closures.
3+
--FILE--
4+
<?php
5+
6+
$test = function (#[SensitiveParameter] $sensitive)
7+
{
8+
debug_print_backtrace();
9+
var_dump(debug_backtrace());
10+
var_dump((new Exception)->getTrace());
11+
};
12+
13+
$test('sensitive');
14+
15+
?>
16+
--EXPECTF--
17+
#0 %ssensitive_parameter_closure.php(10): {closure}(Object(SensitiveParameterValue))
18+
array(1) {
19+
[0]=>
20+
array(4) {
21+
["file"]=>
22+
string(%d) "%ssensitive_parameter_closure.php"
23+
["line"]=>
24+
int(10)
25+
["function"]=>
26+
string(9) "{closure}"
27+
["args"]=>
28+
array(1) {
29+
[0]=>
30+
object(SensitiveParameterValue)#%d (0) {
31+
}
32+
}
33+
}
34+
}
35+
array(1) {
36+
[0]=>
37+
array(4) {
38+
["file"]=>
39+
string(%d) "%ssensitive_parameter_closure.php"
40+
["line"]=>
41+
int(10)
42+
["function"]=>
43+
string(9) "{closure}"
44+
["args"]=>
45+
array(1) {
46+
[0]=>
47+
object(SensitiveParameterValue)#%d (0) {
48+
}
49+
}
50+
}
51+
}

‎Zend/tests/function_arguments/sensitive_parameter_correctly_captures_original.phpt

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
--TEST--
2+
The SensitiveParameterValue replacement value correctly captures the original value.
3+
--FILE--
4+
<?php
5+
6+
function test(
7+
$foo,
8+
#[SensitiveParameter] $bar,
9+
$baz
10+
) {
11+
throw new Exception('Error');
12+
}
13+
14+
try {
15+
test('foo', 'bar', 'baz');
16+
echo 'Not reached';
17+
} catch (Exception $e) {
18+
echo $e->getMessage(), PHP_EOL;
19+
$testFrame = $e->getTrace()[0];
20+
var_dump($testFrame['function']);
21+
var_dump(count($testFrame['args']));
22+
var_dump($testFrame['args'][0]);
23+
assert($testFrame['args'][1] instanceof SensitiveParameterValue);
24+
var_dump($testFrame['args'][1]->getValue());
25+
var_dump($testFrame['args'][2]);
26+
echo "Success", PHP_EOL;
27+
}
28+
29+
function test2(
30+
$foo,
31+
#[SensitiveParameter] ...$variadic,
32+
) {
33+
throw new Exception('Error 2');
34+
}
35+
36+
try {
37+
test2('foo', 'variadic1', 'variadic2', 'variadic3');
38+
echo 'Not reached';
39+
} catch (Exception $e) {
40+
echo $e->getMessage(), PHP_EOL;
41+
$testFrame = $e->getTrace()[0];
42+
var_dump($testFrame['function']);
43+
var_dump(count($testFrame['args']));
44+
var_dump($testFrame['args'][0]);
45+
assert($testFrame['args'][1] instanceof SensitiveParameterValue);
46+
var_dump($testFrame['args'][1]->getValue());
47+
assert($testFrame['args'][2] instanceof SensitiveParameterValue);
48+
var_dump($testFrame['args'][2]->getValue());
49+
assert($testFrame['args'][3] instanceof SensitiveParameterValue);
50+
var_dump($testFrame['args'][3]->getValue());
51+
echo "Success", PHP_EOL;
52+
}
53+
54+
?>
55+
--EXPECTF--
56+
Error
57+
string(4) "test"
58+
int(3)
59+
string(3) "foo"
60+
string(3) "bar"
61+
string(3) "baz"
62+
Success
63+
Error 2
64+
string(5) "test2"
65+
int(4)
66+
string(3) "foo"
67+
string(9) "variadic1"
68+
string(9) "variadic2"
69+
string(9) "variadic3"
70+
Success

‎Zend/tests/function_arguments/sensitive_parameter_extra_arguments.phpt

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
--TEST--
2+
The SensitiveParameter attribute does not suppress superfluous arguments if the last parameter is sensitive.
3+
--FILE--
4+
<?php
5+
6+
function test(
7+
$non_sensitive,
8+
#[SensitiveParameter] $sensitive,
9+
)
10+
{
11+
debug_print_backtrace();
12+
var_dump(debug_backtrace());
13+
var_dump((new Exception)->getTrace());
14+
}
15+
16+
test('foo', 'bar', 'baz');
17+
18+
?>
19+
--EXPECTF--
20+
#0 %ssensitive_parameter_extra_arguments.php(13): test('foo', Object(SensitiveParameterValue), 'baz')
21+
array(1) {
22+
[0]=>
23+
array(4) {
24+
["file"]=>
25+
string(%d) "%ssensitive_parameter_extra_arguments.php"
26+
["line"]=>
27+
int(13)
28+
["function"]=>
29+
string(4) "test"
30+
["args"]=>
31+
array(3) {
32+
[0]=>
33+
string(3) "foo"
34+
[1]=>
35+
object(SensitiveParameterValue)#%d (0) {
36+
}
37+
[2]=>
38+
string(3) "baz"
39+
}
40+
}
41+
}
42+
array(1) {
43+
[0]=>
44+
array(4) {
45+
["file"]=>
46+
string(%d) "%ssensitive_parameter_extra_arguments.php"
47+
["line"]=>
48+
int(13)
49+
["function"]=>
50+
string(4) "test"
51+
["args"]=>
52+
array(3) {
53+
[0]=>
54+
string(3) "foo"
55+
[1]=>
56+
object(SensitiveParameterValue)#%d (0) {
57+
}
58+
[2]=>
59+
string(3) "baz"
60+
}
61+
}
62+
}

‎Zend/tests/function_arguments/sensitive_parameter_multiple_arguments.phpt

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
--TEST--
2+
The SensitiveParameter attribute suppresses the correct sensitive arguments.
3+
--FILE--
4+
<?php
5+
6+
function test(
7+
#[SensitiveParameter] $sensitive1 = null,
8+
$non_sensitive = null,
9+
#[SensitiveParameter] $sensitive2 = null,
10+
)
11+
{
12+
debug_print_backtrace();
13+
var_dump(debug_backtrace());
14+
var_dump((new Exception)->getTrace());
15+
}
16+
17+
test('sensitive1', 'non_sensitive', 'sensitive2');
18+
19+
?>
20+
--EXPECTF--
21+
#0 %ssensitive_parameter_multiple_arguments.php(14): test(Object(SensitiveParameterValue), 'non_sensitive', Object(SensitiveParameterValue))
22+
array(1) {
23+
[0]=>
24+
array(4) {
25+
["file"]=>
26+
string(%d) "%ssensitive_parameter_multiple_arguments.php"
27+
["line"]=>
28+
int(14)
29+
["function"]=>
30+
string(4) "test"
31+
["args"]=>
32+
array(3) {
33+
[0]=>
34+
object(SensitiveParameterValue)#%d (0) {
35+
}
36+
[1]=>
37+
string(13) "non_sensitive"
38+
[2]=>
39+
object(SensitiveParameterValue)#%d (0) {
40+
}
41+
}
42+
}
43+
}
44+
array(1) {
45+
[0]=>
46+
array(4) {
47+
["file"]=>
48+
string(%d) "%ssensitive_parameter_multiple_arguments.php"
49+
["line"]=>
50+
int(14)
51+
["function"]=>
52+
string(4) "test"
53+
["args"]=>
54+
array(3) {
55+
[0]=>
56+
object(SensitiveParameterValue)#%d (0) {
57+
}
58+
[1]=>
59+
string(13) "non_sensitive"
60+
[2]=>
61+
object(SensitiveParameterValue)#%d (0) {
62+
}
63+
}
64+
}
65+
}

‎Zend/tests/function_arguments/sensitive_parameter_named_arguments.phpt

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
--TEST--
2+
The SensitiveParameter attribute handles named arguments.
3+
--FILE--
4+
<?php
5+
6+
function test(
7+
#[SensitiveParameter] $sensitive1 = null,
8+
$non_sensitive = null,
9+
#[SensitiveParameter] $sensitive2 = null,
10+
)
11+
{
12+
debug_print_backtrace();
13+
var_dump(debug_backtrace());
14+
var_dump((new Exception)->getTrace());
15+
}
16+
17+
test(non_sensitive: 'non_sensitive', sensitive2: 'sensitive2');
18+
19+
?>
20+
--EXPECTF--
21+
#0 %ssensitive_parameter_named_arguments.php(14): test(Object(SensitiveParameterValue), 'non_sensitive', Object(SensitiveParameterValue))
22+
array(1) {
23+
[0]=>
24+
array(4) {
25+
["file"]=>
26+
string(%d) "%ssensitive_parameter_named_arguments.php"
27+
["line"]=>
28+
int(14)
29+
["function"]=>
30+
string(4) "test"
31+
["args"]=>
32+
array(3) {
33+
[0]=>
34+
object(SensitiveParameterValue)#%d (0) {
35+
}
36+
[1]=>
37+
string(13) "non_sensitive"
38+
[2]=>
39+
object(SensitiveParameterValue)#%d (0) {
40+
}
41+
}
42+
}
43+
}
44+
array(1) {
45+
[0]=>
46+
array(4) {
47+
["file"]=>
48+
string(%d) "%ssensitive_parameter_named_arguments.php"
49+
["line"]=>
50+
int(14)
51+
["function"]=>
52+
string(4) "test"
53+
["args"]=>
54+
array(3) {
55+
[0]=>
56+
object(SensitiveParameterValue)#%d (0) {
57+
}
58+
[1]=>
59+
string(13) "non_sensitive"
60+
[2]=>
61+
object(SensitiveParameterValue)#%d (0) {
62+
}
63+
}
64+
}
65+
}

0 commit comments

Comments
 (0)