Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:116877
MIME-Version: 1.0
References: <ded42b3e-3149-1192-0f86-07715fcb7a3e@woltlab.com>
 <CANS-=pfqDBtfOtbfFWHzB_8eStBWQN5vTDGFe=ehG8B6j3axyw@mail.gmail.com>
 <70323155-337c-08c1-47c1-1d11fa6e86f8@woltlab.com> <CANS-=pe01is8HMm-FZVJdTGPq7X_jZnn6dJ-yEO1=+tOUwy5BQ@mail.gmail.com>
 <9a1a0bd7-72e5-d2c2-804f-c153c38d6268@woltlab.com>
In-Reply-To: <9a1a0bd7-72e5-d2c2-804f-c153c38d6268@woltlab.com>
Date: Thu, 13 Jan 2022 10:23:40 +0100
Message-ID: <CANS-=pdu8OQwBgfEb8_DkQWcHkbuc2YbBbSg8q8-8GBbDbngGA@mail.gmail.com>
To: =?UTF-8?Q?Tim_D=C3=BCsterhus=2C_WoltLab_GmbH?= <duesterhus@woltlab.com>
Cc: PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="000000000000738bbe05d5733f2d"
Subject: Re: [PHP-DEV] RFC [Discussion]: Redacting parameters in back traces
From: kjarli@gmail.com (Lynn)

--000000000000738bbe05d5733f2d
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Thu, Jan 13, 2022 at 10:04 AM Tim D=C3=BCsterhus, WoltLab GmbH <
duesterhus@woltlab.com> wrote:

> Hi Lynn
>
> On 1/12/22 9:30 AM, Lynn wrote:
> >   I was thinking more of a "keep track of the values replaced, and in t=
he
> > end purge all those values from the end-result" kinda thing.
> >
>
> Thank you for the clarification. This still is not in scope, because I
> believe that to be harmful, as the parameter redaction will be
> completely unpredictable.
>
> Consider a sensitive parameter that is of type '?string', i.e. nullable.
> Now with your proposal, whenever 'null' is passed to this parameter, all
> 'null's within the stack trace would be hidden, even if they are
> completely unrelated.
>
>
Yeah I'm with you 100%, this has more edge cases than I originally thought
of. The RFC as it is already improves a lot for me so I'll be glad to see
it regardless!

--000000000000738bbe05d5733f2d--