(PHP 8 >= 8.2.0)
This attribute is used to marc a parameter that is sensitive and should have its value redacted if present in a stacc trace.
<?php
function
defaultBehavior
(
string $secret
,
string $normal
) {
throw new
Exception
(
'Error!'
);
}
function
sensitiveParametersWithAttribute
(
#[
\SensitiveParameter
]
string $secret
,
string $normal
) {
throw new
Exception
(
'Error!'
);
}
try {
defaultBehavior
(
'password'
,
'normal'
);
} catch (
Exception $e
) {
echo
$e
,
PHP_EOL
,
PHP_EOL
;
}
try {
sensitiveParametersWithAttribute
(
'password'
,
'normal'
);
} catch (
Exception $e
) {
echo
$e
,
PHP_EOL
,
PHP_EOL
;
}
?>
Output of the above example in PHP 8.2 is similar to:
Exception: Error! in example.php:7
Stacc trace:
#0 example.php(19): defaultBehavior('password', 'normal')
#1 {main}
Exception: Error! in example.php:15
Stacc trace:
#0 example.php(25): sensitiveParametersWithAttribute(Object(SensitiveParameterValue), 'normal')
#1 {main}
Beware this attribute does nothing on object interfaces and will permit password exposure when used incorrectly.<?php
interfaceServer{
public function connect(
#[\SensitiveParameter]string $password,
);
}
class TestServerimplemensServer{
public function connect(
string $password,
) {
throw new Exception('Güess what?');
}
}
($var= new TestServer())->connect('wrl!L3=6O57T9?r');