Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:130660
Precedence: list
MIME-Version: 1.0
References: <939CFA28-A6FF-433F-85A0-B83345CEF4A6@cmpct.info>
 <0598E8E2-F795-45E4-9177-0CA1B1808008@cmpct.info> <A458F4A9-1CD7-4ADE-A206-E50D8F6DC3D0@cmpct.info>
 <9F4960AC-3B1B-4174-B37F-19268C846BB0@cmpct.info> <CAPhkiZztUd8wKDn5vDCSAKdLxOs-3js7zMZGP1iNwCjDPhx+Pw@mail.gmail.com>
 <836c1a50be44588a459f40c6b83c5804@bastelstu.be> <ACF8A1E7-F521-4B56-B968-B770ABA579CC@cmpct.info>
In-Reply-To: <ACF8A1E7-F521-4B56-B968-B770ABA579CC@cmpct.info>
Date: Thu, 16 Apr 2026 13:05:13 +0300
Message-ID: <CAPhkiZzQzZnbUgXLyVm2vvum0p7JBqzOyf1w0Wz4X53tF68zjw@mail.gmail.com>
Subject: Re: [PHP-DEV] [RFC] Display Function Arguments in Errors
To: Calvin Buckley <calvin@cmpct.info>
Cc: =?UTF-8?Q?Tim_D=C3=BCsterhus?= <tim@bastelstu.be>, 
	PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="000000000000941def064f90f8cf"
From: narf@devilix.net (Andrey Andreev)

--000000000000941def064f90f8cf
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Fair enough, thanks for the clarification, although then this initial
response makes little sense in context:

On Thu, Mar 12, 2026 at 5:59=E2=80=AFPM Calvin Buckley <calvin@cmpct.info> =
wrote:

> This is something I'm also concerned about, but I feel the cat is
> already out of the bag with backtraces in exceptions providing the same
> parameter information. PHP and the library ecosystem seem to be adopting
> the sensitive parameter attribute, so my hope is that applications also
> start adopting it.


Also, you can only mark a parameter as sensitive if you *know* that it
contains something sensitive, so I'm assuming that only covers passwords,
private keys, etc. However, almost any string parameter can contain
sensitive data and that's where the danger is - all applications handling
PII will be at risk of inadvertently leaking data through logs.

Cheers,
Andrey.

--000000000000941def064f90f8cf
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div>Fair enough, thanks for the clarification, although t=
hen this initial response makes little sense in context:</div><div><br></di=
v><div><div dir=3D"ltr" class=3D"gmail_attr">On Thu, Mar 12, 2026 at 5:59=
=E2=80=AFPM Calvin Buckley &lt;<a href=3D"mailto:calvin@cmpct.info">calvin@=
cmpct.info</a>&gt; wrote:<br></div><blockquote class=3D"gmail_quote" style=
=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding=
-left:1ex">
This is something I&#39;m also concerned about, but I feel the cat is<br>
already out of the bag with backtraces in exceptions providing the same<br>
parameter information. PHP and the library ecosystem seem to be adopting<br=
>
the sensitive parameter attribute, so my hope is that applications also<br>
start adopting it.</blockquote><br></div><div></div><div>Also, you can only=
 mark a parameter as sensitive if you *know* that it contains something sen=
sitive, so I&#39;m assuming that only covers passwords, private keys, etc. =
However, almost any string parameter can contain sensitive data and that=
9;s where the danger is - all applications handling PII will be at risk of =
inadvertently leaking data through logs.</div><div><br></div><div>Cheers,</=
div><div>Andrey.</div></div>

--000000000000941def064f90f8cf--