Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:130653
Content-Type: text/plain;
	charset=utf-8
Precedence: list
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3864.500.181\))
Subject: Re: [PHP-DEV] [RFC] Display Function Arguments in Errors
In-Reply-To: <836c1a50be44588a459f40c6b83c5804@bastelstu.be>
Date: Wed, 15 Apr 2026 18:57:05 -0300
Cc: Andrey Andreev <narf@devilix.net>,
 PHP internals <internals@lists.php.net>
Content-Transfer-Encoding: quoted-printable
Message-ID: <ACF8A1E7-F521-4B56-B968-B770ABA579CC@cmpct.info>
References: <939CFA28-A6FF-433F-85A0-B83345CEF4A6@cmpct.info>
 <0598E8E2-F795-45E4-9177-0CA1B1808008@cmpct.info>
 <A458F4A9-1CD7-4ADE-A206-E50D8F6DC3D0@cmpct.info>
 <9F4960AC-3B1B-4174-B37F-19268C846BB0@cmpct.info>
 <CAPhkiZztUd8wKDn5vDCSAKdLxOs-3js7zMZGP1iNwCjDPhx+Pw@mail.gmail.com>
 <836c1a50be44588a459f40c6b83c5804@bastelstu.be>
To: =?utf-8?Q?Tim_D=C3=BCsterhus?= <tim@bastelstu.be>
From: calvin@cmpct.info (Calvin Buckley)

On Apr 15, 2026, at 5:35=E2=80=AFPM, Tim D=C3=BCsterhus =
<tim@bastelstu.be> wrote:
>=20
> Hi
>=20
> Am 2026-04-15 22:09, schrieb Andrey Andreev:
>> - It is clearly aiming for default of 1 and unreasonably expects all
>> codebases to be (meticulously) updated with SensitiveParameter =
attribute -
>> that is "opt-in security" and not secure by default
>=20
> There is no stack trace here, which means that the only functions that =
are affected by this RFC are native functions. Userland functions =
calling `trigger_error()` don't show the function name. All the native =
functions in php-src that handle sensitive inputs have been adapted =
right with the introduction of the #[\SensitiveParameter] attribute in =
PHP 8.2 - and if some are missing, I would consider that a pre-existing =
bug that needs fixing.
>=20
> And even if this wasn't the case, the ecosystem has widely adopted the =
attribute in the 4 years since its introduction, which was easily =
possible since attributes are fully backwards and forwards compatible =
with all PHP versions (including PHP versions that do not yet support =
attributes).
>=20
> Best regards
> Tim D=C3=BCsterhus

I think I'll edit the RFC to clarify this.=