Skip to content

Commit ab8e416

Browse files
TimWollaTimWolla
committed
Implement the "Redacting parameters in back traces" RFC
https://wiki.php.net/rfc/redact_parameters_in_back_traces
1 parent ace00fa commit ab8e416

16 files changed

+801
-17
lines changed

‎Zend/tests/function_arguments/sensitive_parameter.phpt

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
--TEST--
2+
The SensitiveParameter attribute suppresses the single sensitive argument.
3+
--FILE--
4+
<?php
5+
6+
function test(#[SensitiveParameter] $sensitive)
7+
{
8+
debug_print_backtrace();
9+
var_dump(debug_backtrace());
10+
var_dump((new Exception)->getTrace());
11+
}
12+
13+
test('sensitive');
14+
15+
--EXPECTF--
16+
#0 %ssensitive_parameter.php(10): test(Object(SensitiveParameterValue))
17+
array(1) {
18+
[0]=>
19+
array(4) {
20+
["file"]=>
21+
string(%d) "%ssensitive_parameter.php"
22+
["line"]=>
23+
int(10)
24+
["function"]=>
25+
string(4) "test"
26+
["args"]=>
27+
array(1) {
28+
[0]=>
29+
object(SensitiveParameterValue)#%d (0) {
30+
}
31+
}
32+
}
33+
}
34+
array(1) {
35+
[0]=>
36+
array(4) {
37+
["file"]=>
38+
string(%d) "%ssensitive_parameter.php"
39+
["line"]=>
40+
int(10)
41+
["function"]=>
42+
string(4) "test"
43+
["args"]=>
44+
array(1) {
45+
[0]=>
46+
object(SensitiveParameterValue)#%d (0) {
47+
}
48+
}
49+
}
50+
}

‎Zend/tests/function_arguments/sensitive_parameter_arrow_function.phpt

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
--TEST--
2+
The SensitiveParameter attribute suppresses the single sensitive argument for arrow functions.
3+
--FILE--
4+
<?php
5+
6+
$test = fn (#[SensitiveParameter] $sensitive) => (new Exception)->getTrace();
7+
8+
var_dump($test('sensitive'));
9+
10+
--EXPECTF--
11+
array(1) {
12+
[0]=>
13+
array(4) {
14+
["file"]=>
15+
string(%d) "%ssensitive_parameter_arrow_function.php"
16+
["line"]=>
17+
int(5)
18+
["function"]=>
19+
string(9) "{closure}"
20+
["args"]=>
21+
array(1) {
22+
[0]=>
23+
object(SensitiveParameterValue)#%d (0) {
24+
}
25+
}
26+
}
27+
}

‎Zend/tests/function_arguments/sensitive_parameter_closure.phpt

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
--TEST--
2+
The SensitiveParameter attribute suppresses the single sensitive argument for closures.
3+
--FILE--
4+
<?php
5+
6+
$test = function (#[SensitiveParameter] $sensitive)
7+
{
8+
debug_print_backtrace();
9+
var_dump(debug_backtrace());
10+
var_dump((new Exception)->getTrace());
11+
};
12+
13+
$test('sensitive');
14+
15+
--EXPECTF--
16+
#0 %ssensitive_parameter_closure.php(10): {closure}(Object(SensitiveParameterValue))
17+
array(1) {
18+
[0]=>
19+
array(4) {
20+
["file"]=>
21+
string(%d) "%ssensitive_parameter_closure.php"
22+
["line"]=>
23+
int(10)
24+
["function"]=>
25+
string(9) "{closure}"
26+
["args"]=>
27+
array(1) {
28+
[0]=>
29+
object(SensitiveParameterValue)#%d (0) {
30+
}
31+
}
32+
}
33+
}
34+
array(1) {
35+
[0]=>
36+
array(4) {
37+
["file"]=>
38+
string(%d) "%ssensitive_parameter_closure.php"
39+
["line"]=>
40+
int(10)
41+
["function"]=>
42+
string(9) "{closure}"
43+
["args"]=>
44+
array(1) {
45+
[0]=>
46+
object(SensitiveParameterValue)#%d (0) {
47+
}
48+
}
49+
}
50+
}

‎Zend/tests/function_arguments/sensitive_parameter_correctly_captures_original.phpt

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
--TEST--
2+
The SensitiveParameterValue replacement value correctly captures the original value.
3+
--FILE--
4+
<?php
5+
6+
function test(
7+
$foo,
8+
#[\SensitiveParameter] $bar,
9+
$baz
10+
) {
11+
throw new \Exception('Error');
12+
}
13+
14+
try {
15+
test('foo', 'bar', 'baz');
16+
echo 'Not reached';
17+
} catch (\Exception $e) {
18+
echo $e->getMessage(), PHP_EOL;
19+
$testFrame = $e->getTrace()[0];
20+
\var_dump($testFrame['function']);
21+
\var_dump(\count($testFrame['args']));
22+
\var_dump($testFrame['args'][0]);
23+
\assert($testFrame['args'][1] instanceof \SensitiveParameterValue);
24+
\var_dump($testFrame['args'][1]->getValue());
25+
\var_dump($testFrame['args'][2]);
26+
echo "Success", PHP_EOL;
27+
}
28+
29+
function test2(
30+
$foo,
31+
#[\SensitiveParameter] ...$variadic,
32+
) {
33+
throw new \Exception('Error 2');
34+
}
35+
36+
try {
37+
test2('foo', 'variadic1', 'variadic2', 'variadic3');
38+
echo 'Not reached';
39+
} catch (\Exception $e) {
40+
echo $e->getMessage(), PHP_EOL;
41+
$testFrame = $e->getTrace()[0];
42+
\var_dump($testFrame['function']);
43+
\var_dump(\count($testFrame['args']));
44+
\var_dump($testFrame['args'][0]);
45+
\assert($testFrame['args'][1] instanceof \SensitiveParameterValue);
46+
\var_dump($testFrame['args'][1]->getValue());
47+
\assert($testFrame['args'][2] instanceof \SensitiveParameterValue);
48+
\var_dump($testFrame['args'][2]->getValue());
49+
\assert($testFrame['args'][3] instanceof \SensitiveParameterValue);
50+
\var_dump($testFrame['args'][3]->getValue());
51+
echo "Success", PHP_EOL;
52+
}
53+
54+
--EXPECTF--
55+
Error
56+
string(4) "test"
57+
int(3)
58+
string(3) "foo"
59+
string(3) "bar"
60+
string(3) "baz"
61+
Success
62+
Error 2
63+
string(5) "test2"
64+
int(4)
65+
string(3) "foo"
66+
string(9) "variadic1"
67+
string(9) "variadic2"
68+
string(9) "variadic3"
69+
Success

‎Zend/tests/function_arguments/sensitive_parameter_multiple_arguments.phpt

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
--TEST--
2+
The SensitiveParameter attribute suppresses the correct sensitive arguments.
3+
--FILE--
4+
<?php
5+
6+
function test(
7+
#[SensitiveParameter] $sensitive1 = null,
8+
$non_sensitive = null,
9+
#[SensitiveParameter] $sensitive2 = null,
10+
)
11+
{
12+
debug_print_backtrace();
13+
var_dump(debug_backtrace());
14+
var_dump((new Exception)->getTrace());
15+
}
16+
17+
test('sensitive1', 'non_sensitive', 'sensitive2');
18+
19+
--EXPECTF--
20+
#0 %ssensitive_parameter_multiple_arguments.php(14): test(Object(SensitiveParameterValue), 'non_sensitive', Object(SensitiveParameterValue))
21+
array(1) {
22+
[0]=>
23+
array(4) {
24+
["file"]=>
25+
string(%d) "%ssensitive_parameter_multiple_arguments.php"
26+
["line"]=>
27+
int(14)
28+
["function"]=>
29+
string(4) "test"
30+
["args"]=>
31+
array(3) {
32+
[0]=>
33+
object(SensitiveParameterValue)#%d (0) {
34+
}
35+
[1]=>
36+
string(13) "non_sensitive"
37+
[2]=>
38+
object(SensitiveParameterValue)#%d (0) {
39+
}
40+
}
41+
}
42+
}
43+
array(1) {
44+
[0]=>
45+
array(4) {
46+
["file"]=>
47+
string(%d) "%ssensitive_parameter_multiple_arguments.php"
48+
["line"]=>
49+
int(14)
50+
["function"]=>
51+
string(4) "test"
52+
["args"]=>
53+
array(3) {
54+
[0]=>
55+
object(SensitiveParameterValue)#%d (0) {
56+
}
57+
[1]=>
58+
string(13) "non_sensitive"
59+
[2]=>
60+
object(SensitiveParameterValue)#%d (0) {
61+
}
62+
}
63+
}
64+
}

‎Zend/tests/function_arguments/sensitive_parameter_named_arguments.phpt

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
--TEST--
2+
The SensitiveParameter attribute handles named arguments.
3+
--FILE--
4+
<?php
5+
6+
function test(
7+
#[SensitiveParameter] $sensitive1 = null,
8+
$non_sensitive = null,
9+
#[SensitiveParameter] $sensitive2 = null,
10+
)
11+
{
12+
debug_print_backtrace();
13+
var_dump(debug_backtrace());
14+
var_dump((new Exception)->getTrace());
15+
}
16+
17+
test(non_sensitive: 'non_sensitive', sensitive2: 'sensitive2');
18+
19+
--EXPECTF--
20+
#0 %ssensitive_parameter_named_arguments.php(14): test(Object(SensitiveParameterValue), 'non_sensitive', Object(SensitiveParameterValue))
21+
array(1) {
22+
[0]=>
23+
array(4) {
24+
["file"]=>
25+
string(%d) "%ssensitive_parameter_named_arguments.php"
26+
["line"]=>
27+
int(14)
28+
["function"]=>
29+
string(4) "test"
30+
["args"]=>
31+
array(3) {
32+
[0]=>
33+
object(SensitiveParameterValue)#%d (0) {
34+
}
35+
[1]=>
36+
string(13) "non_sensitive"
37+
[2]=>
38+
object(SensitiveParameterValue)#%d (0) {
39+
}
40+
}
41+
}
42+
}
43+
array(1) {
44+
[0]=>
45+
array(4) {
46+
["file"]=>
47+
string(%d) "%ssensitive_parameter_named_arguments.php"
48+
["line"]=>
49+
int(14)
50+
["function"]=>
51+
string(4) "test"
52+
["args"]=>
53+
array(3) {
54+
[0]=>
55+
object(SensitiveParameterValue)#%d (0) {
56+
}
57+
[1]=>
58+
string(13) "non_sensitive"
59+
[2]=>
60+
object(SensitiveParameterValue)#%d (0) {
61+
}
62+
}
63+
}
64+
}

0 commit comments

Comments
 (0)