Re: RFC [Discussion]: Redacting parameters in back traces

Hi Alex On 2/1/22 07:38, Alexandru Pătrănescu wrote:

I think storing the original value within the replacement value should be considered and voted in this RFC as well, even if implemented in a separate PR. I did write some code where I process programmatically the backtraces and while I might not have used it with sensitive parameters, it would be good to have the code generic, if this passes.

That's fair. I guess you are thinking of including this in the primary vote, instead of a secondary vote, right? It doesn't make sense to leave this out if you already have a use case that would break otherwise.

I'm guessing that mostly means accepting the value as a constructor parameter exposing a getValue() method And, of course, making sure var_dump/print_r/string-casting does not print it. I mean, it looks like the implementation is doable.

I believe the following (userland) implementation should do the right thing: final class SensitiveParameterValue {

    public function __construct(private readonly mixed $value) {}

    public function getValue(): mixed { return $value; }

    public function __debugInfo(): array { return []; }

    public function __serialize(): array { return []; }

} It allows you to explicitly retrieve the original value, but makes it hard to accidentally expose it, by hiding it from 'var_dump()' and 'serialize()'.

Thinking about this will bring a small issue into plain sight, the attribute is the same class as the replacing placeholder, \SensitiveParameter. I believe they should be separate classes, \SensitiveParameter marked as an Attribute that can be applied to parameters and something like \SensitiveParameterValue that replaces the original value in stack traces.

You are right. If we also want to store the original value, we should use a separate class. In any case re-using the attribute class will limit future extensions. I've already adjusted the RFC (and the PoC implementation) to update the replacement value to SensitiveParameterValue: https://wiki.php.net/rfc/redact_parameters_in_back_traces. Regarding storing the original value I'll wait for your reply. Best regards Tim Düsterhus Developer WoltLab GmbH -- WoltLab GmbH Nedlitzer Str. 27B 14469 Potsdam Tel.: +49 331 96784338 duesterhus@woltlab.com www.woltlab.com Managing director: Marcel Werk AG Potsdam HRB 26795 P