[php-src] Issue #8747: Stack traces of warnings in error_log are unaffected by zend.exception_ignore_args
| From: | SniperSister | Date: | Fri, 10 Jun 2022 14:57:46 +0000 |
| Subject: | [php-src] Issue #8747: Stack traces of warnings in error_log are unaffected by zend.exception_ignore_args | ||
| Groups: | php.bugs | ||
| Request: | Send a blank email to php-bugs+get-241710@lists.php.net to get a copy of this message | ||
Issue: https://github.com/php/php-src/issues/8747
Author: SniperSister
### Description
We discovered an inconsistency between warnings and exception in the stack traces, that are logged
to the defined error_log. The directive
zend.exception_ignore_args, that was introduced
in 7.4 to prevent the leaking of secret data in funciton arguments to the logfile, does only affect
exceptions and is ignored by warnings.
The following code:
```php
<?php
ini_set('zend.exception_ignore_args', 1);
class Foobar
{
public function __construct() {
$this->doAuth("supersecret");
}
public function doAuth($password) {
echo $this->undefined;
}
}
$object = new Foobar();
```
Resulted in this log output **with** arguments:
```
NOTICE: PHP message: PHP Warning: Undefined property: Foobar::$undefined in /application/bla.php on
line 12
NOTICE: PHP message: PHP Stack trace:
NOTICE: PHP message: PHP 1. {main}() /application/bla.php:0
NOTICE: PHP message: PHP 2. Foobar->__construct() /application/bla.php:16
NOTICE: PHP message: PHP 3. Foobar->doAuth($password = 'supersecret')
/application/bla.php:8
```
Whereas
```php
<?php
ini_set('zend.exception_ignore_args', 1);
class Foobar
{
public function __construct() {
$this->doAuth("supersecret");
}
public function doAuth($password) {
throw new Exception("Fail");
}
}
$object = new Foobar();
```
creates the expected output **without** arguments:
```
NOTICE: PHP message: PHP Fatal error: Uncaught Exception: Fail in /application/bla.php:12
Stack trace:
#0 /application/bla.php(8): Foobar->doAuth()
#1 /application/bla.php(16): Foobar->__construct()
#2 {main}
```
I'm well aware that the directive is called **exception**_ignore_args, however as an
administrator I would expect that setting this directive will prevent secrets from stack traces
being hidden in all scenarios. That's apparently also how others understands this feature, see
https://docs.honeybadger.io/lib/php/guides/capturing-function-call-arguments/
### PHP Version
PHP 8.1.6
### Operating System
_No response_