Skip to content

Mark password as a SensitiveParameter #2295

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
MasterOdin merged 1 commit into from
Jul 17, 2024
Merged

Mark password as a SensitiveParameter #2295

MasterOdin merged 1 commit into from
Jul 17, 2024

Conversation

@edudobay
Copy link
Contributor

@edudobay edudobay commented Jul 17, 2024 •
edited
Loading

Mark the $password parameter as sensitive, so its value is redacted if present in a stack trace. This already happens for PDO but not for this method:

#0 /src/vendor/robmorgan/phinx/src/Phinx/Db/Adapter/PdoAdapter.php(96):
  PDO->__construct('pgsql:dbname=aa...', 'my-username', Object(SensitiveParameterValue), Array)
#1 /src/vendor/robmorgan/phinx/src/Phinx/Db/Adapter/PostgresAdapter.php(115):
  Phinx\Db\Adapter\PdoAdapter->createPdoConnection('pgsql:dbname=aa...', 'my-username', 'my password leaked...', Array)

@edudobay edudobay force-pushed the sensitive-parameter branch from e4a8264 to 950de6c Compare July 17, 2024 20:33
@MasterOdin
Copy link
Member

MasterOdin commented Jul 17, 2024 •
edited
Loading

SensitiveParameter was added in PHP 8.2, is there any issue with using this in PHP 8.1 which we still support? I'm not super well versed in attributes, and from test suite I guess it works and the attribute is ignored if it doesn't exist?

e: playing around with a simple snippet, does seem like older versions of PHP will just ignore the attribute and continue to work the same, so this won't break anything, but is also only applicable to people running PHP 8.2+.

@MasterOdin MasterOdin merged commit 5779080 into cakephp:0.x Jul 17, 2024
@edudobay
Copy link
Contributor Author

edudobay commented Jul 17, 2024

Yes, that's exactly what I expected, it only benefits people running PHP 8.2+, but should not impact older versions in any way.

@edudobay edudobay deleted the sensitive-parameter branch July 17, 2024 21:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@MasterOdin MasterOdin MasterOdin approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@edudobay @MasterOdin