Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:130652
Precedence: list
MIME-Version: 1.0
Date: Wed, 15 Apr 2026 22:35:30 +0200
To: Andrey Andreev <narf@devilix.net>
Cc: Calvin Buckley <calvin@cmpct.info>, PHP internals
 <internals@lists.php.net>
Subject: Re: [PHP-DEV] [RFC] Display Function Arguments in Errors
In-Reply-To: <CAPhkiZztUd8wKDn5vDCSAKdLxOs-3js7zMZGP1iNwCjDPhx+Pw@mail.gmail.com>
References: <939CFA28-A6FF-433F-85A0-B83345CEF4A6@cmpct.info>
 <0598E8E2-F795-45E4-9177-0CA1B1808008@cmpct.info>
 <A458F4A9-1CD7-4ADE-A206-E50D8F6DC3D0@cmpct.info>
 <9F4960AC-3B1B-4174-B37F-19268C846BB0@cmpct.info>
 <CAPhkiZztUd8wKDn5vDCSAKdLxOs-3js7zMZGP1iNwCjDPhx+Pw@mail.gmail.com>
Message-ID: <836c1a50be44588a459f40c6b83c5804@bastelstu.be>
Content-Type: text/plain; charset=UTF-8;
 format=flowed
Content-Transfer-Encoding: 8bit
From: tim@bastelstu.be (=?UTF-8?Q?Tim_D=C3=BCsterhus?=)

Hi

Am 2026-04-15 22:09, schrieb Andrey Andreev:
> - It is clearly aiming for default of 1 and unreasonably expects all
> codebases to be (meticulously) updated with SensitiveParameter 
> attribute -
> that is "opt-in security" and not secure by default

There is no stack trace here, which means that the only functions that 
are affected by this RFC are native functions. Userland functions 
calling `trigger_error()` don't show the function name. All the native 
functions in php-src that handle sensitive inputs have been adapted 
right with the introduction of the #[\SensitiveParameter] attribute in 
PHP 8.2 - and if some are missing, I would consider that a pre-existing 
bug that needs fixing.

And even if this wasn't the case, the ecosystem has widely adopted the 
attribute in the 4 years since its introduction, which was easily 
possible since attributes are fully backwards and forwards compatible 
with all PHP versions (including PHP versions that do not yet support 
attributes).

Best regards
Tim Düsterhus