KarpelesLab / goro / 24621538787

13%

Build Type

push

github

Committed by MagicalTux

Commit Message

Wire up #[\SensitiveParameter] at parameter compile time

The masking pipeline (FuncArg.Sensitive flag → maskSensitiveArgs →
SensitiveParameterValue wrapper) was already present in phpctx/phpobj,
but compile-func never set the flag, so arguments annotated with
#[\SensitiveParameter] still leaked into stack traces, debug_backtrace,
and Throwable::getTrace.

Set arg.Sensitive = true in compileFunctionArgs when any attribute on
the parameter resolves to SensitiveParameter (same "ClassName ==
\"SensitiveParameter\" || \"\\SensitiveParameter\"" match the engine
uses for AllowDynamicProperties and Deprecated).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Coverage Stats

0 of 4 new or added lines in 1 file covered. (0.0%)

268 existing lines in 1 file now uncovered.

2188 of 111911 relevant lines covered (1.96%)

70.39 hits per line