Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:116876
To: Lynn <kjarli@gmail.com>
Cc: PHP internals <internals@lists.php.net>
References: <ded42b3e-3149-1192-0f86-07715fcb7a3e@woltlab.com>
 <CANS-=pfqDBtfOtbfFWHzB_8eStBWQN5vTDGFe=ehG8B6j3axyw@mail.gmail.com>
 <70323155-337c-08c1-47c1-1d11fa6e86f8@woltlab.com>
 <CANS-=pe01is8HMm-FZVJdTGPq7X_jZnn6dJ-yEO1=+tOUwy5BQ@mail.gmail.com>
Message-ID: <9a1a0bd7-72e5-d2c2-804f-c153c38d6268@woltlab.com>
Date: Thu, 13 Jan 2022 10:04:26 +0100
MIME-Version: 1.0
In-Reply-To: <CANS-=pe01is8HMm-FZVJdTGPq7X_jZnn6dJ-yEO1=+tOUwy5BQ@mail.gmail.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 8bit
Subject: Re: [PHP-DEV] RFC [Discussion]: Redacting parameters in back traces
From: duesterhus@woltlab.com (=?UTF-8?Q?Tim_D=c3=bcsterhus=2c_WoltLab_GmbH?=)

Hi Lynn

On 1/12/22 9:30 AM, Lynn wrote:
>   I was thinking more of a "keep track of the values replaced, and in the
> end purge all those values from the end-result" kinda thing.
> 

Thank you for the clarification. This still is not in scope, because I 
believe that to be harmful, as the parameter redaction will be 
completely unpredictable.

Consider a sensitive parameter that is of type '?string', i.e. nullable. 
Now with your proposal, whenever 'null' is passed to this parameter, all 
'null's within the stack trace would be hidden, even if they are 
completely unrelated.

Best regards
Tim Düsterhus
Developer WoltLab GmbH

-- 

WoltLab GmbH
Nedlitzer Str. 27B
14469 Potsdam

Tel.: +49 331 96784338

duesterhus@woltlab.com
www.woltlab.com

Managing director:
Marcel Werk

AG Potsdam HRB 26795 P