php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix GH-20435: SensitiveParameter doesn't work for named argument passing to variadic parameter

Browse Source 
Closes GH-20436.
This commit is contained in:
Niels Dossche
2025-11-09 15:18:22 +01:00
parent 4ee25395d5
commit 33a2acba44
3 changed files with 36 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
NEWS
View File

@@ -4,6 +4,8 @@ PHP NEWS
- Core:
. Sync all boost.context files with release 1.86.0. (mvorisek)
. Fixed bug GH-20435 (SensitiveParameter doesn't work for named argument
passing to variadic parameter). (ndossche)
- Date:
. Fix crashes when trying to instantiate uninstantiable classes via date

14
Zend/tests/function_arguments/gh20435.phpt Normal file
View File

@@ -0,0 +1,14 @@
--TEST--
GH-20435 (SensitiveParameter doesn't work for named argument passing to variadic parameter)
--FILE--
<?php
function test($a, #[\SensitiveParameter] ...$x) {
debug_print_backtrace();
}
test(b: 1, a: 2, c: 3);
?>
--EXPECTF--
#0 %s(%d): test(2, b: Object(SensitiveParameterValue), c: Object(SensitiveParameterValue))

22
Zend/zend_builtin_functions.c
View File

@@ -1683,11 +1683,29 @@ static void debug_backtrace_get_args(zend_execute_data *call, zval *arg_array) /
if (ZEND_CALL_INFO(call) & ZEND_CALL_HAS_EXTRA_NAMED_PARAMS) {
zend_string *name;
zval *arg;
ZEND_ASSERT(call->func->common.fn_flags & ZEND_ACC_VARIADIC);
zend_attribute *attribute = zend_get_parameter_attribute_str(
call->func->common.attributes,
"sensitiveparameter",
sizeof("sensitiveparameter") - 1,
call->func->common.num_args
);
bool is_sensitive = attribute != NULL;
SEPARATE_ARRAY(arg_array);
ZEND_HASH_MAP_FOREACH_STR_KEY_VAL(call->extra_named_params, name, arg) {
ZVAL_DEREF(arg);
Z_TRY_ADDREF_P(arg);
zend_hash_add_new(Z_ARRVAL_P(arg_array), name, arg);
if (is_sensitive) {
zval redacted_arg;
object_init_ex(&redacted_arg, zend_ce_sensitive_parameter_value);
zend_call_method_with_1_params(Z_OBJ_P(&redacted_arg), zend_ce_sensitive_parameter_value, &zend_ce_sensitive_parameter_value->constructor, "__construct", NULL, arg);
zend_hash_add_new(Z_ARRVAL_P(arg_array), name, &redacted_arg);
} else {
Z_TRY_ADDREF_P(arg);
zend_hash_add_new(Z_ARRVAL_P(arg_array), name, arg);
}
} ZEND_HASH_FOREACH_END();
}
}