[php-src] Issue #8747: Stack traces of warnings in error_log are unaffected by zend.exception_ignore_args

From: Date: Fri, 10 Jun 2022 14:57:46 +0000
Subject: [php-src] Issue #8747: Stack traces of warnings in error_log are unaffected by zend.exception_ignore_args
Groups: php.bugs 
Request: Send a blank email to php-bugs+get-241710@lists.php.net to get a copy of this message
Issue: https://github.com/php/php-src/issues/8747 Author: SniperSister ### Description We discovered an inconsistency between warnings and exception in the stack traces, that are logged to the defined error_log. The directive zend.exception_ignore_args, that was introduced in 7.4 to prevent the leaking of secret data in funciton arguments to the logfile, does only affect exceptions and is ignored by warnings. The following code: ```php <?php ini_set('zend.exception_ignore_args', 1); class Foobar { public function __construct() { $this->doAuth("supersecret"); } public function doAuth($password) { echo $this->undefined; } } $object = new Foobar(); ``` Resulted in this log output **with** arguments: ``` NOTICE: PHP message: PHP Warning: Undefined property: Foobar::$undefined in /application/bla.php on line 12 NOTICE: PHP message: PHP Stack trace: NOTICE: PHP message: PHP 1. {main}() /application/bla.php:0 NOTICE: PHP message: PHP 2. Foobar->__construct() /application/bla.php:16 NOTICE: PHP message: PHP 3. Foobar->doAuth($password = 'supersecret') /application/bla.php:8 ``` Whereas ```php <?php ini_set('zend.exception_ignore_args', 1); class Foobar { public function __construct() { $this->doAuth("supersecret"); } public function doAuth($password) { throw new Exception("Fail"); } } $object = new Foobar(); ``` creates the expected output **without** arguments: ``` NOTICE: PHP message: PHP Fatal error: Uncaught Exception: Fail in /application/bla.php:12 Stack trace: #0 /application/bla.php(8): Foobar->doAuth() #1 /application/bla.php(16): Foobar->__construct() #2 {main} ``` I'm well aware that the directive is called **exception**_ignore_args, however as an administrator I would expect that setting this directive will prevent secrets from stack traces being hidden in all scenarios. That's apparently also how others understands this feature, see https://docs.honeybadger.io/lib/php/guides/capturing-function-call-arguments/ ### PHP Version PHP 8.1.6 ### Operating System _No response_

« previous php.bugs (#241710) next »