Repository navigation
SensitiveParameter doesn't work for named argument passing to variadic parameter #20435
Description
Description
I assume this is a bug but I'm not 100% sure. I could fix it probably but would need to get confirmation first.
The following code:
<?php
function foobar(#[\SensitiveParameter] ...$x) {
var_dump($x);
throw new Error;
}
foobar(0, a: 1);Resulted in this output:
array(2) {
[0]=>
int(0)
["a"]=>
int(1)
}
Fatal error: Uncaught Error in x.php:5
Stack trace:
#0 x.php(8): foobar(Object(SensitiveParameterValue), a: 1)
#1 {main}
thrown in x.php on line 5
We see that the positional argument gets censored, but the named argument doesn't. I expect both of them to be censored because they both go to the $x variadic argument. Especially because if $x isn't variadic and we pass a named argument x then it does get censored.
PHP Version
8.3+
Operating System
Irrelevant
Activity
ndossche commentedon Nov 9, 2025
cc @TimWolla as author of https://wiki.php.net/rfc/redact_parameters_in_back_traces to confirm
I believe what's missing here is handling of ZEND_CALL_HAS_EXTRA_NAMED_PARAMS, that would be simple to fix and I could do that.
TimWolla commentedon Nov 9, 2025
Yeah, that doesn't make sense. Everything that actually goes into the variadic should be considered sensitive.
Fix phpGH-20435: SensitiveParameter doesn't work for named argument p…
Merge branch 'PHP-8.3' into PHP-8.4
Merge branch 'PHP-8.4' into PHP-8.5
Merge branch 'PHP-8.5'
Fix GH-20435: SensitiveParameter doesn't work for named argument pass…