Skip to content

Commit e692613

Browse files
TimWollaTimWolla
committed
PoC: Add SensitiveParameter attribute
1 parent b27d2ff commit e692613

10 files changed

+460
-18
lines changed

‎Zend/tests/function_arguments/sensitive_parameter.phpt

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
--TEST--
2+
SensitiveParameter attribute suppresses the single sensitive argument.
3+
--FILE--
4+
<?php
5+
6+
function test(#[SensitiveParameter] $sensitive)
7+
{
8+
debug_print_backtrace();
9+
var_dump(debug_backtrace());
10+
var_dump((new Exception)->getTrace());
11+
}
12+
13+
test('sensitive');
14+
?>
15+
--EXPECTF--
16+
#0 %ssensitive_parameter.php(10): test(Object(SensitiveParameter))
17+
array(1) {
18+
[0]=>
19+
array(4) {
20+
["file"]=>
21+
string(%d) "%ssensitive_parameter.php"
22+
["line"]=>
23+
int(10)
24+
["function"]=>
25+
string(4) "test"
26+
["args"]=>
27+
array(1) {
28+
[0]=>
29+
object(SensitiveParameter)#%d (0) {
30+
}
31+
}
32+
}
33+
}
34+
array(1) {
35+
[0]=>
36+
array(4) {
37+
["file"]=>
38+
string(%d) "%ssensitive_parameter.php"
39+
["line"]=>
40+
int(10)
41+
["function"]=>
42+
string(4) "test"
43+
["args"]=>
44+
array(1) {
45+
[0]=>
46+
object(SensitiveParameter)#%d (0) {
47+
}
48+
}
49+
}
50+
}

‎Zend/tests/function_arguments/sensitive_parameter_multiple_arguments.phpt

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
--TEST--
2+
SensitiveParameter attribute suppresses the correct sensitive arguments.
3+
--FILE--
4+
<?php
5+
6+
function test(
7+
#[SensitiveParameter] $sensitive1 = null,
8+
$non_sensitive = null,
9+
#[SensitiveParameter] $sensitive2 = null,
10+
)
11+
{
12+
debug_print_backtrace();
13+
var_dump(debug_backtrace());
14+
var_dump((new Exception)->getTrace());
15+
}
16+
17+
test('sensitive1', 'non_sensitive', 'sensitive2');
18+
?>
19+
--EXPECTF--
20+
#0 %ssensitive_parameter_multiple_arguments.php(14): test(Object(SensitiveParameter), 'non_sensitive', Object(SensitiveParameter))
21+
array(1) {
22+
[0]=>
23+
array(4) {
24+
["file"]=>
25+
string(%d) "%ssensitive_parameter_multiple_arguments.php"
26+
["line"]=>
27+
int(14)
28+
["function"]=>
29+
string(4) "test"
30+
["args"]=>
31+
array(3) {
32+
[0]=>
33+
object(SensitiveParameter)#%d (0) {
34+
}
35+
[1]=>
36+
string(13) "non_sensitive"
37+
[2]=>
38+
object(SensitiveParameter)#%d (0) {
39+
}
40+
}
41+
}
42+
}
43+
array(1) {
44+
[0]=>
45+
array(4) {
46+
["file"]=>
47+
string(%d) "%ssensitive_parameter_multiple_arguments.php"
48+
["line"]=>
49+
int(14)
50+
["function"]=>
51+
string(4) "test"
52+
["args"]=>
53+
array(3) {
54+
[0]=>
55+
object(SensitiveParameter)#%d (0) {
56+
}
57+
[1]=>
58+
string(13) "non_sensitive"
59+
[2]=>
60+
object(SensitiveParameter)#%d (0) {
61+
}
62+
}
63+
}
64+
}

‎Zend/tests/function_arguments/sensitive_parameter_named_arguments.phpt

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
--TEST--
2+
SensitiveParameter attribute handles named arguments.
3+
--FILE--
4+
<?php
5+
6+
function test(
7+
#[SensitiveParameter] $sensitive1 = null,
8+
$non_sensitive = null,
9+
#[SensitiveParameter] $sensitive2 = null,
10+
)
11+
{
12+
debug_print_backtrace();
13+
var_dump(debug_backtrace());
14+
var_dump((new Exception)->getTrace());
15+
}
16+
17+
test(non_sensitive: 'non_sensitive', sensitive2: 'sensitive2');
18+
?>
19+
--EXPECTF--
20+
#0 %ssensitive_parameter_named_arguments.php(14): test(Object(SensitiveParameter), 'non_sensitive', Object(SensitiveParameter))
21+
array(1) {
22+
[0]=>
23+
array(4) {
24+
["file"]=>
25+
string(%d) "%ssensitive_parameter_named_arguments.php"
26+
["line"]=>
27+
int(14)
28+
["function"]=>
29+
string(4) "test"
30+
["args"]=>
31+
array(3) {
32+
[0]=>
33+
object(SensitiveParameter)#%d (0) {
34+
}
35+
[1]=>
36+
string(13) "non_sensitive"
37+
[2]=>
38+
object(SensitiveParameter)#%d (0) {
39+
}
40+
}
41+
}
42+
}
43+
array(1) {
44+
[0]=>
45+
array(4) {
46+
["file"]=>
47+
string(%d) "%ssensitive_parameter_named_arguments.php"
48+
["line"]=>
49+
int(14)
50+
["function"]=>
51+
string(4) "test"
52+
["args"]=>
53+
array(3) {
54+
[0]=>
55+
object(SensitiveParameter)#%d (0) {
56+
}
57+
[1]=>
58+
string(13) "non_sensitive"
59+
[2]=>
60+
object(SensitiveParameter)#%d (0) {
61+
}
62+
}
63+
}
64+
}

‎Zend/tests/function_arguments/sensitive_parameter_nested_calls.phpt

Lines changed: 114 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,114 @@
1+
--TEST--
2+
SensitiveParameter attribute handles nested function calls.
3+
--FILE--
4+
<?php
5+
6+
function test(
7+
#[SensitiveParameter] $sensitive1 = null,
8+
$non_sensitive = null,
9+
#[SensitiveParameter] $sensitive2 = null,
10+
)
11+
{
12+
debug_print_backtrace();
13+
var_dump(debug_backtrace());
14+
var_dump((new Exception)->getTrace());
15+
}
16+
17+
function wrapper(
18+
$non_sensitive = null,
19+
#[SensitiveParameter] $sensitive1 = null,
20+
#[SensitiveParameter] $sensitive2 = null,
21+
)
22+
{
23+
test($non_sensitive, $sensitive1, $sensitive2);
24+
}
25+
26+
wrapper('foo', 'bar', 'baz');
27+
?>
28+
--EXPECTF--
29+
#0 %ssensitive_parameter_nested_calls.php(20): test(Object(SensitiveParameter), 'bar', Object(SensitiveParameter))
30+
#1 %ssensitive_parameter_nested_calls.php(23): wrapper('foo', Object(SensitiveParameter), Object(SensitiveParameter))
31+
array(2) {
32+
[0]=>
33+
array(4) {
34+
["file"]=>
35+
string(%d) "%ssensitive_parameter_nested_calls.php"
36+
["line"]=>
37+
int(20)
38+
["function"]=>
39+
string(4) "test"
40+
["args"]=>
41+
array(3) {
42+
[0]=>
43+
object(SensitiveParameter)#%d (0) {
44+
}
45+
[1]=>
46+
string(3) "bar"
47+
[2]=>
48+
object(SensitiveParameter)#%d (0) {
49+
}
50+
}
51+
}
52+
[1]=>
53+
array(4) {
54+
["file"]=>
55+
string(%d) "%ssensitive_parameter_nested_calls.php"
56+
["line"]=>
57+
int(23)
58+
["function"]=>
59+
string(7) "wrapper"
60+
["args"]=>
61+
array(3) {
62+
[0]=>
63+
string(3) "foo"
64+
[1]=>
65+
object(SensitiveParameter)#%d (0) {
66+
}
67+
[2]=>
68+
object(SensitiveParameter)#%d (0) {
69+
}
70+
}
71+
}
72+
}
73+
array(2) {
74+
[0]=>
75+
array(4) {
76+
["file"]=>
77+
string(%d) "%ssensitive_parameter_nested_calls.php"
78+
["line"]=>
79+
int(20)
80+
["function"]=>
81+
string(4) "test"
82+
["args"]=>
83+
array(3) {
84+
[0]=>
85+
object(SensitiveParameter)#%d (0) {
86+
}
87+
[1]=>
88+
string(3) "bar"
89+
[2]=>
90+
object(SensitiveParameter)#%d (0) {
91+
}
92+
}
93+
}
94+
[1]=>
95+
array(4) {
96+
["file"]=>
97+
string(%d) "%ssensitive_parameter_nested_calls.php"
98+
["line"]=>
99+
int(23)
100+
["function"]=>
101+
string(7) "wrapper"
102+
["args"]=>
103+
array(3) {
104+
[0]=>
105+
string(3) "foo"
106+
[1]=>
107+
object(SensitiveParameter)#%d (0) {
108+
}
109+
[2]=>
110+
object(SensitiveParameter)#%d (0) {
111+
}
112+
}
113+
}
114+
}

‎Zend/tests/function_arguments/sensitive_parameter_variadic_arguments.phpt

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
--TEST--
2+
SensitiveParameter attribute handles variadic arguments.
3+
--FILE--
4+
<?php
5+
6+
function test(
7+
#[SensitiveParameter] ...$args
8+
)
9+
{
10+
debug_print_backtrace();
11+
var_dump(debug_backtrace());
12+
var_dump((new Exception)->getTrace());
13+
}
14+
15+
test('foo', 'bar', 'baz');
16+
?>
17+
--EXPECTF--
18+
#0 %ssensitive_parameter_variadic_arguments.php(12): test(Object(SensitiveParameter), Object(SensitiveParameter), Object(SensitiveParameter))
19+
array(1) {
20+
[0]=>
21+
array(4) {
22+
["file"]=>
23+
string(%d) "%ssensitive_parameter_variadic_arguments.php"
24+
["line"]=>
25+
int(12)
26+
["function"]=>
27+
string(4) "test"
28+
["args"]=>
29+
array(3) {
30+
[0]=>
31+
object(SensitiveParameter)#%d (0) {
32+
}
33+
[1]=>
34+
object(SensitiveParameter)#%d (0) {
35+
}
36+
[2]=>
37+
object(SensitiveParameter)#%d (0) {
38+
}
39+
}
40+
}
41+
}
42+
array(1) {
43+
[0]=>
44+
array(4) {
45+
["file"]=>
46+
string(%d) "%ssensitive_parameter_variadic_arguments.php"
47+
["line"]=>
48+
int(12)
49+
["function"]=>
50+
string(4) "test"
51+
["args"]=>
52+
array(3) {
53+
[0]=>
54+
object(SensitiveParameter)#%d (0) {
55+
}
56+
[1]=>
57+
object(SensitiveParameter)#%d (0) {
58+
}
59+
[2]=>
60+
object(SensitiveParameter)#%d (0) {
61+
}
62+
}
63+
}
64+
}

‎Zend/zend_attributes.c

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@
2626
ZEND_API zend_class_entry *zend_ce_attribute;
2727
ZEND_API zend_class_entry *zend_ce_return_type_will_change_attribute;
2828
ZEND_API zend_class_entry *zend_ce_allow_dynamic_properties;
29+
ZEND_API zend_class_entry *zend_ce_sensitive_parameter;
2930

3031
static HashTable internal_attributes;
3132

@@ -91,6 +92,11 @@ ZEND_METHOD(AllowDynamicProperties, __construct)
9192
ZEND_PARSE_PARAMETERS_NONE();
9293
}
9394

95+
ZEND_METHOD(SensitiveParameter, __construct)
96+
{
97+
ZEND_PARSE_PARAMETERS_NONE();
98+
}
99+
94100
static zend_attribute *get_attribute(HashTable *attributes, zend_string *lcname, uint32_t offset)
95101
{
96102
if (attributes) {
@@ -310,6 +316,9 @@ void zend_register_attribute_ce(void)
310316
zend_ce_allow_dynamic_properties = register_class_AllowDynamicProperties();
311317
attr = zend_internal_attribute_register(zend_ce_allow_dynamic_properties, ZEND_ATTRIBUTE_TARGET_CLASS);
312318
attr->validator = validate_allow_dynamic_properties;
319+
320+
zend_ce_sensitive_parameter = register_class_SensitiveParameter();
321+
attr = zend_internal_attribute_register(zend_ce_allow_dynamic_properties, ZEND_ATTRIBUTE_TARGET_PARAMETER);
313322
}
314323

315324
void zend_attributes_shutdown(void)

‎Zend/zend_attributes.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,7 @@ BEGIN_EXTERN_C()
4141

4242
extern ZEND_API zend_class_entry *zend_ce_attribute;
4343
extern ZEND_API zend_class_entry *zend_ce_allow_dynamic_properties;
44+
extern ZEND_API zend_class_entry *zend_ce_sensitive_parameter;
4445

4546
typedef struct {
4647
zend_string *name;

0 commit comments

Comments
 (0)