[php-src] Issue #20435: SensitiveParameter doesn't work for named argument passing to variadic parameter

From: Date: Sun, 09 Nov 2025 13:52:07 +0000
Subject: [php-src] Issue #20435: SensitiveParameter doesn't work for named argument passing to variadic parameter
Groups: php.bugs 
Request: Send a blank email to php-bugs+get-251195@lists.php.net to get a copy of this message
Issue: https://github.com/php/php-src/issues/20435 Author: ndossche ### Description I assume this is a bug but I'm not 100% sure. The following code: ```php <?php function foobar(#[\SensitiveParameter] ...$x) { var_dump($x); throw new Error; } foobar(0, a: 1); ``` Resulted in this output: ``` array(2) { [0]=> int(0) ["a"]=> int(1) } Fatal error: Uncaught Error in x.php:5 Stack trace: #0 x.php(8): foobar(Object(SensitiveParameterValue), a: 1) #1 {main} thrown in x.php on line 5 ``` We see that the positional argument gets censored, but the named argument doesn't. I expect both of them to be censored because they both go to the $x variadic argument. Especially because if $x isn't variadic and we pass a named argument x then it _does_ get censored. ### PHP Version ```plain 8.3+ ``` ### Operating System Irrelevant

« previous php.bugs (#251195) next »