Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:127243
Message-ID: <809590c3-fd64-4861-8804-1c9eea62a4a8@bastelstu.be>
Date: Tue, 29 Apr 2025 20:55:04 +0200
Precedence: bulk
MIME-Version: 1.0
Subject: Re: [PHP-DEV] [RFC] [Discussion] Add WHATWG compliant URL parsing API
To: ignace nyamagana butera <nyamsprod@gmail.com>,
 =?UTF-8?B?TcOhdMOpIEtvY3Npcw==?= <kocsismate90@gmail.com>,
 PHP Internals List <internals@lists.php.net>
References: <CAH5C8xUb1O20ZDrOQNC=ckFxHUUWSK7sw_njQQzFBd0qgQqoww@mail.gmail.com>
 <bc5472e39bc607e2c7accc9d2bd6f239@bastelstu.be>
 <CAH5C8xW_auVf+ig7odhTK8dVWwmXTg4ZVZN-0Fhh4SUBzrWxVw@mail.gmail.com>
 <8df04e01-deac-404b-beb7-cd982423db63@bastelstu.be>
 <CAH5C8xU0JcnmC2Hdd=Hj0CQUaL0-LN=1X8+5-eUbFH3ZMxCvBA@mail.gmail.com>
 <33427cd03035ef084245c44290b56a55@bastelstu.be>
 <CAH5C8xXwDO6Ui8pLmqoxEguURh97fAaL4CfLK-oitqC85N7+8w@mail.gmail.com>
 <0aa1eefc3941bdea0092e935074daa58@bastelstu.be>
 <CAH5C8xU+rnp4e5=CzqhEncRww6nhZ7x1s68NjWtu+HQMpoNZ8g@mail.gmail.com>
 <76d96ea8a78c6025128c0a4b01c94c0a@bastelstu.be>
 <CAH5C8xXLPoRLJ6_dtotMtOv2NWs4LFzu+Kpr5A56Xk8wmuPDEg@mail.gmail.com>
 <07a8a580-4f0c-4b2f-8a67-b91dacfe99bf@bastelstu.be>
 <CAOV5rgZZgSjGWFdhWm7qwiRxeRMvf7ScgoPZZEXgnvK8Qyw38w@mail.gmail.com>
 <CAH5C8xWSaSXDoXJ-18WptA-dN6Tt6N-DUwLk6PxR1ERP_pwSLA@mail.gmail.com>
 <CAOV5rgYx-EeAN=TFa02pCG-7=KJTmLEf=WtXDTBUmUwnJPRcow@mail.gmail.com>
 <CAOV5rgbcCd1pp05xmtEu9SgCjDqu1FXfJPwPfczqH1L_q=pS7w@mail.gmail.com>
Content-Language: en-US
In-Reply-To: <CAOV5rgbcCd1pp05xmtEu9SgCjDqu1FXfJPwPfczqH1L_q=pS7w@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
From: tim@bastelstu.be (=?UTF-8?Q?Tim_D=C3=BCsterhus?=)

Hi

On 4/29/25 10:54, ignace nyamagana butera wrote:
> I have one last question while reviewing my polyfill implementation. Is it
> worth it adding a SensitiveParameter attribute on the argument of the
> following methods ?
> 
> - Uri\Rfc3986\Uri::withUserInfo
> - Uri\WhatWg\Url::withPassword
> 
> I'm fine with any answer ? Does it warrant a paragraph in the RFC ? That I
> do not know but I feel the question may be raised ?

Good catch. Since they may throw an exception for malformed inputs, they 
should have the attribute. Especially since folks might try to use 
special characters in passwords, which might need encoding.

No paragraph in the RFC needed, but the attribute should be added to the 
“stub”.

Best regards
Tim Düsterhus