SensitiveParameter doesn't work for named argument passing to variadic parameter

[ndossche]

Description

I assume this is a bug but I'm not 100% sure. I could fix it probably but would need to get confirmation first.

The following code:

<?php

function foobar(#[\SensitiveParameter] ...$x) {
	var_dump($x);
	throw new Error;
}

foobar(0, a: 1);

Resulted in this output:

array(2) {
  [0]=>
  int(0)
  ["a"]=>
  int(1)
}

Fatal error: Uncaught Error in x.php:5
Stack trace:
#0 x.php(8): foobar(Object(SensitiveParameterValue), a: 1)
#1 {main}
  thrown in x.php on line 5

We see that the positional argument gets censored, but the named argument doesn't. I expect both of them to be censored because they both go to the $x variadic argument. Especially because if $x isn't variadic and we pass a named argument x then it does get censored.

PHP Version

8.3+

Operating System

Irrelevant

[ndossche]

cc @TimWolla as author of https://wiki.php.net/rfc/redact_parameters_in_back_traces to confirm
I believe what's missing here is handling of ZEND_CALL_HAS_EXTRA_NAMED_PARAMS, that would be simple to fix and I could do that.

[TimWolla]

Yeah, that doesn't make sense. Everything that actually goes into the variadic should be considered sensitive.