Skip to content

Add #[\SensitiveParameter] to more functions taking secrets #23782

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Girgias merged 5 commits into from
Sep 21, 2026
Merged

Add #[\SensitiveParameter] to more functions taking secrets #23782

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
5d1b204
ext/sodium: add SensitiveParameter to missing functions
jordikroon Sep 19, 2026
4f7b4aa
ext/phar: add SensitiveParameter to missing functions
jordikroon Sep 19, 2026
ea0cf67
ext/snmp: add SensitiveParameter to missing functions
jordikroon Sep 19, 2026
02d7c65
ext/sqlite3: add SensitiveParameter to missing functions
jordikroon Sep 19, 2026
ee89463
ext/hash: add SensitiveParameter to missing functions
jordikroon Sep 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions ext/hash/hash.stub.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -83,7 +83,7 @@ function mhash_get_hash_name(int $algo): string|false {}
* @refcount 1
*/
#[\Deprecated(since: '8.1')]
function mhash_keygen_s2k(int $algo, string $password, string $salt, int $length): string|false {}
function mhash_keygen_s2k(int $algo, #[\SensitiveParameter] string $password, string $salt, int $length): string|false {}

#[\Deprecated(since: '8.1')]
function mhash_count(): int {}
Expand All @@ -92,7 +92,7 @@ function mhash_count(): int {}
* @refcount 1
*/
#[\Deprecated(since: '8.1')]
function mhash(int $algo, string $data, ?string $key = null): string|false {}
function mhash(int $algo, string $data, #[\SensitiveParameter] ?string $key = null): string|false {}
#endif

final class HashContext
Expand Down
6 changes: 5 additions & 1 deletion ext/hash/hash_arginfo.h
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

31 changes: 31 additions & 0 deletions ext/hash/tests/mhash_sensitive_parameter.phpt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,31 @@
--TEST--
Test that the key/password parameters of mhash() and mhash_keygen_s2k() are marked sensitive.
--SKIPIF--
<?php if (!function_exists('mhash')) { die('skip mhash compatibility layer not available'); } ?>
--FILE--
<?php
declare(strict_types=1);

try {
var_dump(mhash(0, null, 'secret-key'));
} catch (\Throwable $e) {
echo $e, PHP_EOL;
}
try {
var_dump(mhash_keygen_s2k(0, 'secret-password', 'salt', 0));
} catch (\Throwable $e) {
echo $e, PHP_EOL;
}
?>
--EXPECTF--
Deprecated: Function mhash() is deprecated since 8.1 in %s on line %d
TypeError: mhash(): Argument #2 ($data) must be of type string, null given in %s:%d
Stack trace:
#0 %s(%d): mhash(0, NULL, Object(SensitiveParameterValue))
#1 {main}

Deprecated: Function mhash_keygen_s2k() is deprecated since 8.1 in %s on line %d
ValueError: mhash_keygen_s2k(): Argument #4 ($length) must be a greater than 0 in %s:%d
Stack trace:
#0 %s(%d): mhash_keygen_s2k(0, Object(SensitiveParameterValue), 'salt', 0)
#1 {main}
4 changes: 2 additions & 2 deletions ext/phar/phar_object.stub.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -196,7 +196,7 @@ public function setDefaultStub(?string $index = null, ?string $webIndex = null):
public function setMetadata(mixed $metadata): void {}

/** @tentative-return-type */
public function setSignatureAlgorithm(int $algo, ?string $privateKey = null): void {}
public function setSignatureAlgorithm(int $algo, #[\SensitiveParameter] ?string $privateKey = null): void {}

/**
* @param resource|string $stub
Expand Down Expand Up @@ -470,7 +470,7 @@ public function setMetadata(mixed $metadata): void {}
* @tentative-return-type
* @implementation-alias Phar::setSignatureAlgorithm
*/
public function setSignatureAlgorithm(int $algo, ?string $privateKey = null): void {}
public function setSignatureAlgorithm(int $algo, #[\SensitiveParameter] ?string $privateKey = null): void {}

/**
* @param resource|string $stub
Expand Down
10 changes: 9 additions & 1 deletion ext/phar/phar_object_arginfo.h
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

28 changes: 28 additions & 0 deletions ext/phar/tests/setsignaturealgo_sensitive_parameter.phpt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,28 @@
--TEST--
Test that the private key parameter of Phar::setSignatureAlgorithm() is marked sensitive.
--EXTENSIONS--
phar
--INI--
phar.require_hash=0
phar.readonly=0
--FILE--
<?php
$fname = __DIR__ . '/' . basename(__FILE__, '.php') . '.tar';
$p = new PharData($fname);
$p['file1.txt'] = 'hi';

try {
$p->setSignatureAlgorithm(-1, 'secret-private-key');
} catch (\Throwable $e) {
echo $e, PHP_EOL;
}
?>
--CLEAN--
<?php
unlink(__DIR__ . '/' . basename(__FILE__, '.clean.php') . '.tar');
?>
--EXPECTF--
UnexpectedValueException: Unknown signature algorithm specified in %s:%d
Stack trace:
#0 %s(%d): PharData->setSignatureAlgorithm(-1, Object(SensitiveParameterValue))
#1 {main}
48 changes: 24 additions & 24 deletions ext/snmp/snmp.stub.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -115,18 +115,18 @@
*/
const SNMP_COUNTER64 = UNKNOWN;

function snmpget(string $hostname, string $community, array|string $object_id, int $timeout = -1, int $retries = -1): mixed {}
function snmpget(string $hostname, #[\SensitiveParameter] string $community, array|string $object_id, int $timeout = -1, int $retries = -1): mixed {}

function snmpgetnext(string $hostname, string $community, array|string $object_id, int $timeout = -1, int $retries = -1): mixed {}
function snmpgetnext(string $hostname, #[\SensitiveParameter] string $community, array|string $object_id, int $timeout = -1, int $retries = -1): mixed {}

function snmpwalk(string $hostname, string $community, array|string $object_id, int $timeout = -1, int $retries = -1): array|false {}
function snmpwalk(string $hostname, #[\SensitiveParameter] string $community, array|string $object_id, int $timeout = -1, int $retries = -1): array|false {}

function snmprealwalk(string $hostname, string $community, array|string $object_id, int $timeout = -1, int $retries = -1): array|false {}
function snmprealwalk(string $hostname, #[\SensitiveParameter] string $community, array|string $object_id, int $timeout = -1, int $retries = -1): array|false {}

/** @alias snmprealwalk */
function snmpwalkoid(string $hostname, string $community, array|string $object_id, int $timeout = -1, int $retries = -1): array|false {}
function snmpwalkoid(string $hostname, #[\SensitiveParameter] string $community, array|string $object_id, int $timeout = -1, int $retries = -1): array|false {}

function snmpset(string $hostname, string $community, array|string $object_id, array|string $type, array|string $value, int $timeout = -1, int $retries = -1): bool {}
function snmpset(string $hostname, #[\SensitiveParameter] string $community, array|string $object_id, array|string $type, array|string $value, int $timeout = -1, int $retries = -1): bool {}

function snmp_get_quick_print(): bool {}

Expand All @@ -145,44 +145,44 @@ function snmp_set_string_output_format(Snmp\StringOutput $format): void {}
/** @alias snmp_set_oid_output_format */
function snmp_set_oid_numeric_print(Snmp\OidOutput|int $format): true {}

function snmp2_get(string $hostname, string $community, array|string $object_id, int $timeout = -1, int $retries = -1): mixed {}
function snmp2_get(string $hostname, #[\SensitiveParameter] string $community, array|string $object_id, int $timeout = -1, int $retries = -1): mixed {}

@Girgias Girgias Sep 20, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What is sensitive about the $community variable?

@jordikroon jordikroon Sep 20, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The community string is basically a plain text password. On SNMPv1/v2c it's the only auth there is, and with snmpset it gives write access.


function snmp2_getnext(string $hostname, string $community, array|string $object_id, int $timeout = -1, int $retries = -1): mixed {}
function snmp2_getnext(string $hostname, #[\SensitiveParameter] string $community, array|string $object_id, int $timeout = -1, int $retries = -1): mixed {}

function snmp2_walk(string $hostname, string $community, array|string $object_id, int $timeout = -1, int $retries = -1): array|false {}
function snmp2_walk(string $hostname, #[\SensitiveParameter] string $community, array|string $object_id, int $timeout = -1, int $retries = -1): array|false {}

function snmp2_real_walk(string $hostname, string $community, array|string $object_id, int $timeout = -1, int $retries = -1): array|false {}
function snmp2_real_walk(string $hostname, #[\SensitiveParameter] string $community, array|string $object_id, int $timeout = -1, int $retries = -1): array|false {}

function snmp2_set(string $hostname, string $community, array|string $object_id, array|string $type, array|string $value, int $timeout = -1, int $retries = -1): bool {}
function snmp2_set(string $hostname, #[\SensitiveParameter] string $community, array|string $object_id, array|string $type, array|string $value, int $timeout = -1, int $retries = -1): bool {}

function snmp3_get(
string $hostname, string $security_name, string $security_level,
string $auth_protocol, string $auth_passphrase,
string $privacy_protocol, string $privacy_passphrase,
string $auth_protocol, #[\SensitiveParameter] string $auth_passphrase,
string $privacy_protocol, #[\SensitiveParameter] string $privacy_passphrase,
array|string $object_id, int $timeout = -1, int $retries = -1): mixed {}

function snmp3_getnext(
string $hostname, string $security_name, string $security_level,
string $auth_protocol, string $auth_passphrase,
string $privacy_protocol, string $privacy_passphrase,
string $auth_protocol, #[\SensitiveParameter] string $auth_passphrase,
string $privacy_protocol, #[\SensitiveParameter] string $privacy_passphrase,
array|string $object_id, int $timeout = -1, int $retries = -1): mixed {}

function snmp3_walk(
string $hostname, string $security_name, string $security_level,
string $auth_protocol, string $auth_passphrase,
string $privacy_protocol, string $privacy_passphrase,
string $auth_protocol, #[\SensitiveParameter] string $auth_passphrase,
string $privacy_protocol, #[\SensitiveParameter] string $privacy_passphrase,
array|string $object_id, int $timeout = -1, int $retries = -1): array|false {}

function snmp3_real_walk(
string $hostname, string $security_name, string $security_level,
string $auth_protocol, string $auth_passphrase,
string $privacy_protocol, string $privacy_passphrase,
string $auth_protocol, #[\SensitiveParameter] string $auth_passphrase,
string $privacy_protocol, #[\SensitiveParameter] string $privacy_passphrase,
array|string $object_id, int $timeout = -1, int $retries = -1): array|false {}

function snmp3_set(
string $hostname, string $security_name, string $security_level,
string $auth_protocol, string $auth_passphrase,
string $privacy_protocol, string $privacy_passphrase,
string $auth_protocol, #[\SensitiveParameter] string $auth_passphrase,
string $privacy_protocol, #[\SensitiveParameter] string $privacy_passphrase,
array|string $object_id, array|string $type, array|string $value,
int $timeout = -1, int $retries = -1): bool {}

Expand Down Expand Up @@ -239,15 +239,15 @@ class SNMP
public int $oid_output_format;
public int $exceptions_enabled;

public function __construct(int $version, string $hostname, string $community, int $timeout = -1, int $retries = -1) {}
public function __construct(int $version, string $hostname, #[\SensitiveParameter] string $community, int $timeout = -1, int $retries = -1) {}

/** @tentative-return-type */
public function close(): bool {}

/** @tentative-return-type */
public function setSecurity(
string $securityLevel, string $authProtocol = "", string $authPassphrase = "",
string $privacyProtocol = "", string $privacyPassphrase = "",
string $securityLevel, string $authProtocol = "", #[\SensitiveParameter] string $authPassphrase = "",
string $privacyProtocol = "", #[\SensitiveParameter] string $privacyPassphrase = "",
string $contextName = "", string $contextEngineId = ""): bool {}

/** @tentative-return-type */
Expand Down
53 changes: 52 additions & 1 deletion ext/snmp/snmp_arginfo.h
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

8 changes: 4 additions & 4 deletions ext/snmp/snmp_decl.h
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading
Loading