Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:116864
MIME-Version: 1.0
References: <ded42b3e-3149-1192-0f86-07715fcb7a3e@woltlab.com> <CAEUnE0cS1dE-9aGbqYrP03CAFFa4aHNeKy9idW8rQXWFhXxYmg@mail.gmail.com>
In-Reply-To: <CAEUnE0cS1dE-9aGbqYrP03CAFFa4aHNeKy9idW8rQXWFhXxYmg@mail.gmail.com>
Date: Mon, 10 Jan 2022 23:21:44 -0800
Message-ID: <CAMrTa2HDQKF_bji36feHp=160Cy-mhajv4mLfwhKk7=Mpay+BA@mail.gmail.com>
To: Michael Morris <tendoaki@gmail.com>
Cc: PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="000000000000d3bb9405d5494eee"
Subject: Re: [PHP-DEV] RFC [Discussion]: Redacting parameters in back traces
From: jordan.ledoux@gmail.com (Jordan LeDoux)

--000000000000d3bb9405d5494eee
Content-Type: text/plain; charset="UTF-8"

On Mon, Jan 10, 2022 at 9:37 PM Michael Morris <tendoaki@gmail.com> wrote:

>
> If someone can inject a debug_backtrace into your code and get it executed
> you have bigger problems than a parameter being exposed. And if you
> configure your prod servers to be all chatty Kathy to the world on error,
> you need to learn how to do better. A change to the language is not in
> order here.
>

These things can also be logged as well. This isn't a security concern only
in the sense of the backtrace being displayed on a webpage output or
something. There are legal requirements in many jurisdictions about how
data can be retained and where. It is entirely possible that something
could be accidentally logged that would inadvertently violate a local
regulation for handling of customer data.

Jordan

--000000000000d3bb9405d5494eee--