[php-src] Issue #20435: SensitiveParameter doesn't work for named argument passing to variadic parameter
| From: | ndossche | Date: | Sun, 09 Nov 2025 13:52:07 +0000 |
| Subject: | [php-src] Issue #20435: SensitiveParameter doesn't work for named argument passing to variadic parameter | ||
| Groups: | php.bugs | ||
| Request: | Send a blank email to php-bugs+get-251195@lists.php.net to get a copy of this message | ||
Issue: https://github.com/php/php-src/issues/20435
Author: ndossche
### Description
I assume this is a bug but I'm not 100% sure.
The following code:
```php
<?php
function foobar(#[\SensitiveParameter] ...$x) {
var_dump($x);
throw new Error;
}
foobar(0, a: 1);
```
Resulted in this output:
```
array(2) {
[0]=>
int(0)
["a"]=>
int(1)
}
Fatal error: Uncaught Error in x.php:5
Stack trace:
#0 x.php(8): foobar(Object(SensitiveParameterValue), a: 1)
#1 {main}
thrown in x.php on line 5
```
We see that the positional argument gets censored, but the named argument doesn't. I expect
both of them to be censored because they both go to the
$x variadic argument.
Especially because if $x isn't variadic and we pass a named argument
x then it _does_ get censored.
### PHP Version
```plain
8.3+
```
### Operating System
Irrelevant