Skip to content

Minor refactoring of sensitive parameter handling in backtrace generation #20446

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Nov 11, 2025
+20 −37
Merged

Minor refactoring of sensitive parameter handling in backtrace generation #20446

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5ade154
Zend: Factor out is_sensitive check
ndossche Nov 11, 2025
461bcfb
Zend: Use object_init_with_constructor() for SensitiveParameterValue
ndossche Nov 11, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
57 changes: 20 additions & 37 deletions Zend/zend_builtin_functions.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1715,6 +1715,18 @@ ZEND_FUNCTION(get_defined_constants)
}
/* }}} */

static bool backtrace_is_arg_sensitive(const zend_execute_data *call, uint32_t offset)
{
zend_attribute *attribute = zend_get_parameter_attribute_str(
call->func->common.attributes,
"sensitiveparameter",
sizeof("sensitiveparameter") - 1,
offset
);

return attribute != NULL;
}

static void debug_backtrace_get_args(zend_execute_data *call, zval *arg_array) /* {{{ */
{
uint32_t num_args = ZEND_CALL_NUM_ARGS(call);
Expand All @@ -1738,14 +1750,7 @@ static void debug_backtrace_get_args(zend_execute_data *call, zval *arg_array) /
zend_string *arg_name = call->func->op_array.vars[i];
zval original_arg;
zval *arg = zend_hash_find_ex_ind(call->symbol_table, arg_name, 1);
zend_attribute *attribute = zend_get_parameter_attribute_str(
call->func->common.attributes,
"sensitiveparameter",
sizeof("sensitiveparameter") - 1,
i
);

bool is_sensitive = attribute != NULL;
bool is_sensitive = backtrace_is_arg_sensitive(call, i);

if (arg) {
ZVAL_DEREF(arg);
Expand All @@ -1756,8 +1761,7 @@ static void debug_backtrace_get_args(zend_execute_data *call, zval *arg_array) /

if (is_sensitive) {
zval redacted_arg;
object_init_ex(&redacted_arg, zend_ce_sensitive_parameter_value);
zend_call_known_function(Z_OBJCE_P(&redacted_arg)->constructor, Z_OBJ_P(&redacted_arg), Z_OBJCE_P(&redacted_arg), NULL, 1, &original_arg, NULL);
object_init_with_constructor(&redacted_arg, zend_ce_sensitive_parameter_value, 1, &original_arg, NULL);
ZEND_HASH_FILL_SET(&redacted_arg);
} else {
Z_TRY_ADDREF_P(&original_arg);
Expand All @@ -1770,13 +1774,7 @@ static void debug_backtrace_get_args(zend_execute_data *call, zval *arg_array) /
} else {
while (i < first_extra_arg) {
zval original_arg;
zend_attribute *attribute = zend_get_parameter_attribute_str(
call->func->common.attributes,
"sensitiveparameter",
sizeof("sensitiveparameter") - 1,
i
);
bool is_sensitive = attribute != NULL;
bool is_sensitive = backtrace_is_arg_sensitive(call, i);

if (EXPECTED(Z_TYPE_INFO_P(p) != IS_UNDEF)) {
zval *arg = p;
Expand All @@ -1788,8 +1786,7 @@ static void debug_backtrace_get_args(zend_execute_data *call, zval *arg_array) /

if (is_sensitive) {
zval redacted_arg;
object_init_ex(&redacted_arg, zend_ce_sensitive_parameter_value);
zend_call_known_function(Z_OBJCE_P(&redacted_arg)->constructor, Z_OBJ_P(&redacted_arg), Z_OBJCE_P(&redacted_arg), NULL, 1, &original_arg, NULL);
object_init_with_constructor(&redacted_arg, zend_ce_sensitive_parameter_value, 1, &original_arg, NULL);
ZEND_HASH_FILL_SET(&redacted_arg);
} else {
Z_TRY_ADDREF_P(&original_arg);
Expand All @@ -1809,13 +1806,7 @@ static void debug_backtrace_get_args(zend_execute_data *call, zval *arg_array) /
bool is_sensitive = 0;

if (i < call->func->common.num_args || call->func->common.fn_flags & ZEND_ACC_VARIADIC) {
zend_attribute *attribute = zend_get_parameter_attribute_str(
call->func->common.attributes,
"sensitiveparameter",
sizeof("sensitiveparameter") - 1,
MIN(i, call->func->common.num_args)
);
is_sensitive = attribute != NULL;
is_sensitive = backtrace_is_arg_sensitive(call, MIN(i, call->func->common.num_args));
}

if (EXPECTED(Z_TYPE_INFO_P(p) != IS_UNDEF)) {
Expand All @@ -1828,8 +1819,7 @@ static void debug_backtrace_get_args(zend_execute_data *call, zval *arg_array) /

if (is_sensitive) {
zval redacted_arg;
object_init_ex(&redacted_arg, zend_ce_sensitive_parameter_value);
zend_call_known_function(Z_OBJCE_P(&redacted_arg)->constructor, Z_OBJ_P(&redacted_arg), Z_OBJCE_P(&redacted_arg), NULL, 1, &original_arg, NULL);
object_init_with_constructor(&redacted_arg, zend_ce_sensitive_parameter_value, 1, &original_arg, NULL);
ZEND_HASH_FILL_SET(&redacted_arg);
} else {
Z_TRY_ADDREF_P(&original_arg);
Expand All @@ -1852,21 +1842,14 @@ static void debug_backtrace_get_args(zend_execute_data *call, zval *arg_array) /

ZEND_ASSERT(call->func->common.fn_flags & ZEND_ACC_VARIADIC);

zend_attribute *attribute = zend_get_parameter_attribute_str(
call->func->common.attributes,
"sensitiveparameter",
sizeof("sensitiveparameter") - 1,
call->func->common.num_args
);
bool is_sensitive = attribute != NULL;
bool is_sensitive = backtrace_is_arg_sensitive(call, call->func->common.num_args);

SEPARATE_ARRAY(arg_array);
ZEND_HASH_MAP_FOREACH_STR_KEY_VAL(call->extra_named_params, name, arg) {
ZVAL_DEREF(arg);
if (is_sensitive) {
zval redacted_arg;
object_init_ex(&redacted_arg, zend_ce_sensitive_parameter_value);
zend_call_method_with_1_params(Z_OBJ_P(&redacted_arg), zend_ce_sensitive_parameter_value, &zend_ce_sensitive_parameter_value->constructor, "__construct", NULL, arg);
object_init_with_constructor(&redacted_arg, zend_ce_sensitive_parameter_value, 1, arg, NULL);
zend_hash_add_new(Z_ARRVAL_P(arg_array), name, &redacted_arg);
} else {
Z_TRY_ADDREF_P(arg);
Expand Down