-
Notifications
You must be signed in to change notification settings - Fork 266
Open
Milestone
Description
Description
PHP 8.2 added #[SensitiveParameter] to parameter attributes. This tells PHP to not record the value of the parameter in a stack trace. During a stack trace dump, sensetive variables can be exposed, such as those containing passwords.
As attributes begin with a hash tag, earlier PHP versions will ignore this as either a unknown attribute (8.1) or treat it as a comment (8.0 <=). This is safe to add.
Marking this for the future, but we should try to do this for 2.1 in a patch release if possible. There is not many places we pass sensitive parameters.
LexArma, tyrsson and LiroyvHsbulen