[php-src] PR #25290: ext/pdo: Hide DSNs in connection exception traces
| From: | iliaal | Date: | Sat, 07 Nov 2026 17:12:54 +0000 |
| Subject: | [php-src] PR #25290: ext/pdo: Hide DSNs in connection exception traces | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-40403@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/25290
Author: iliaal
A DSN can carry a password (password= for most drivers, PWD= for odbc), but only the separate
$password argument of PDO::__construct() and PDO::connect() was marked
#[\SensitiveParameter], so with zend.exception_ignore_args=Off a failed
connect put the full DSN into the exception's trace. This marks $dsn sensitive on
both methods, and the Pdo\* driver subclasses inherit the redaction. Follows #23782.