From 5d1b2047b9433f5b1415e48a27571776f158f7a5 Mon Sep 17 00:00:00 2001 From: Jordi Kroon Date: Sat, 19 Sep 2026 19:51:40 -0400 Subject: [PATCH 1/5] ext/sodium: add SensitiveParameter to missing functions --- ext/sodium/libsodium.stub.php | 6 ++-- ext/sodium/libsodium_arginfo.h | 10 ++++++- ext/sodium/tests/sensitive_parameter.phpt | 34 +++++++++++++++++++++++ 3 files changed, 46 insertions(+), 4 deletions(-) create mode 100644 ext/sodium/tests/sensitive_parameter.phpt diff --git a/ext/sodium/libsodium.stub.php b/ext/sodium/libsodium.stub.php index 80d8de2c0b29..f1fefefe65e9 100644 --- a/ext/sodium/libsodium.stub.php +++ b/ext/sodium/libsodium.stub.php @@ -696,12 +696,12 @@ function sodium_crypto_pwhash_scryptsalsa208sha256_str(#[\SensitiveParameter] st function sodium_crypto_pwhash_scryptsalsa208sha256_str_verify(string $hash, #[\SensitiveParameter] string $password): bool {} #endif -function sodium_crypto_scalarmult(string $n, string $p): string {} +function sodium_crypto_scalarmult(#[\SensitiveParameter] string $n, string $p): string {} #ifdef crypto_core_ristretto255_HASHBYTES -function sodium_crypto_scalarmult_ristretto255(string $n, string $p): string {} +function sodium_crypto_scalarmult_ristretto255(#[\SensitiveParameter] string $n, string $p): string {} -function sodium_crypto_scalarmult_ristretto255_base(string $n): string {} +function sodium_crypto_scalarmult_ristretto255_base(#[\SensitiveParameter] string $n): string {} #endif function sodium_crypto_secretbox(#[\SensitiveParameter] string $message, string $nonce, #[\SensitiveParameter] string $key): string {} diff --git a/ext/sodium/libsodium_arginfo.h b/ext/sodium/libsodium_arginfo.h index fbeb30fdd630..d13759fd75f1 100644 --- a/ext/sodium/libsodium_arginfo.h +++ b/ext/sodium/libsodium_arginfo.h @@ -1,5 +1,5 @@ /* This is a generated file, edit libsodium.stub.php instead. - * Stub hash: 82dc3f80ea85b0c71ed9db9b111097f3eb49d71d */ + * Stub hash: 3660efaec3ee273ff570540c372d284c72468abb */ #include "zend_attributes.h" #include "zend_constants.h" @@ -1265,6 +1265,14 @@ static void register_libsodium_symbols(int module_number) zend_add_parameter_attribute(zend_hash_str_find_ptr(CG(function_table), "sodium_crypto_pwhash_scryptsalsa208sha256_str_verify", sizeof("sodium_crypto_pwhash_scryptsalsa208sha256_str_verify") - 1), 1, ZSTR_KNOWN(ZEND_STR_SENSITIVEPARAMETER), 0); #endif + zend_add_parameter_attribute(zend_hash_str_find_ptr(CG(function_table), "sodium_crypto_scalarmult", sizeof("sodium_crypto_scalarmult") - 1), 0, ZSTR_KNOWN(ZEND_STR_SENSITIVEPARAMETER), 0); +#if defined(crypto_core_ristretto255_HASHBYTES) + + zend_add_parameter_attribute(zend_hash_str_find_ptr(CG(function_table), "sodium_crypto_scalarmult_ristretto255", sizeof("sodium_crypto_scalarmult_ristretto255") - 1), 0, ZSTR_KNOWN(ZEND_STR_SENSITIVEPARAMETER), 0); + + zend_add_parameter_attribute(zend_hash_str_find_ptr(CG(function_table), "sodium_crypto_scalarmult_ristretto255_base", sizeof("sodium_crypto_scalarmult_ristretto255_base") - 1), 0, ZSTR_KNOWN(ZEND_STR_SENSITIVEPARAMETER), 0); +#endif + zend_add_parameter_attribute(zend_hash_str_find_ptr(CG(function_table), "sodium_crypto_secretbox", sizeof("sodium_crypto_secretbox") - 1), 0, ZSTR_KNOWN(ZEND_STR_SENSITIVEPARAMETER), 0); zend_add_parameter_attribute(zend_hash_str_find_ptr(CG(function_table), "sodium_crypto_secretbox", sizeof("sodium_crypto_secretbox") - 1), 2, ZSTR_KNOWN(ZEND_STR_SENSITIVEPARAMETER), 0); diff --git a/ext/sodium/tests/sensitive_parameter.phpt b/ext/sodium/tests/sensitive_parameter.phpt new file mode 100644 index 000000000000..95b1af2c1538 --- /dev/null +++ b/ext/sodium/tests/sensitive_parameter.phpt @@ -0,0 +1,34 @@ +--TEST-- +Test that the secret scalar parameter of sodium_crypto_scalarmult*() is marked sensitive. +--EXTENSIONS-- +sodium +--FILE-- +getParameters()[0]; + echo $function, '($', $parameter->getName(), '): '; + var_dump(array_map(fn (ReflectionAttribute $a) => $a->getName(), $parameter->getAttributes())); +} +?> +--EXPECT-- +sodium_crypto_scalarmult($n): array(1) { + [0]=> + string(18) "SensitiveParameter" +} +sodium_crypto_scalarmult_base($secret_key): array(1) { + [0]=> + string(18) "SensitiveParameter" +} +sodium_crypto_scalarmult_ristretto255($n): array(1) { + [0]=> + string(18) "SensitiveParameter" +} +sodium_crypto_scalarmult_ristretto255_base($n): array(1) { + [0]=> + string(18) "SensitiveParameter" +} From 4f7b4aa5a641feb5d33a1e12ef19503b10e20876 Mon Sep 17 00:00:00 2001 From: Jordi Kroon Date: Sat, 19 Sep 2026 19:52:04 -0400 Subject: [PATCH 2/5] ext/phar: add SensitiveParameter to missing functions --- ext/phar/phar_object.stub.php | 4 +-- ext/phar/phar_object_arginfo.h | 10 ++++++- .../setsignaturealgo_sensitive_parameter.phpt | 28 +++++++++++++++++++ 3 files changed, 39 insertions(+), 3 deletions(-) create mode 100644 ext/phar/tests/setsignaturealgo_sensitive_parameter.phpt diff --git a/ext/phar/phar_object.stub.php b/ext/phar/phar_object.stub.php index ae5bd69c32f4..dde2719fb1be 100644 --- a/ext/phar/phar_object.stub.php +++ b/ext/phar/phar_object.stub.php @@ -196,7 +196,7 @@ public function setDefaultStub(?string $index = null, ?string $webIndex = null): public function setMetadata(mixed $metadata): void {} /** @tentative-return-type */ - public function setSignatureAlgorithm(int $algo, ?string $privateKey = null): void {} + public function setSignatureAlgorithm(int $algo, #[\SensitiveParameter] ?string $privateKey = null): void {} /** * @param resource|string $stub @@ -470,7 +470,7 @@ public function setMetadata(mixed $metadata): void {} * @tentative-return-type * @implementation-alias Phar::setSignatureAlgorithm */ - public function setSignatureAlgorithm(int $algo, ?string $privateKey = null): void {} + public function setSignatureAlgorithm(int $algo, #[\SensitiveParameter] ?string $privateKey = null): void {} /** * @param resource|string $stub diff --git a/ext/phar/phar_object_arginfo.h b/ext/phar/phar_object_arginfo.h index bca9f0112eaa..f2ebf5ba6ea4 100644 --- a/ext/phar/phar_object_arginfo.h +++ b/ext/phar/phar_object_arginfo.h @@ -1,5 +1,7 @@ /* This is a generated file, edit phar_object.stub.php instead. - * Stub hash: 031dc8f07d2d9bac4a5f82f4ac2c5b3da5995405 */ + * Stub hash: 4d1023618fff80be6c8f49864312600adf358ff4 */ + +#include "zend_attributes.h" ZEND_BEGIN_ARG_INFO_EX(arginfo_class_Phar___construct, 0, 0, 1) ZEND_ARG_TYPE_INFO(0, filename, IS_STRING, 0) @@ -718,6 +720,9 @@ static zend_class_entry *register_class_Phar(zend_class_entry *class_entry_Recur zend_declare_typed_class_constant(class_entry, const_SHA512_name, &const_SHA512_value, ZEND_ACC_PUBLIC, NULL, (zend_type) ZEND_TYPE_INIT_MASK(MAY_BE_LONG)); zend_string_release_ex(const_SHA512_name, true); + + zend_add_parameter_attribute(zend_hash_str_find_ptr(&class_entry->function_table, "setsignaturealgorithm", sizeof("setsignaturealgorithm") - 1), 1, ZSTR_KNOWN(ZEND_STR_SENSITIVEPARAMETER), 0); + return class_entry; } @@ -729,6 +734,9 @@ static zend_class_entry *register_class_PharData(zend_class_entry *class_entry_R class_entry = zend_register_internal_class_with_flags(&ce, class_entry_RecursiveDirectoryIterator, 0); zend_class_implements(class_entry, 2, class_entry_Countable, class_entry_ArrayAccess); + + zend_add_parameter_attribute(zend_hash_str_find_ptr(&class_entry->function_table, "setsignaturealgorithm", sizeof("setsignaturealgorithm") - 1), 1, ZSTR_KNOWN(ZEND_STR_SENSITIVEPARAMETER), 0); + return class_entry; } diff --git a/ext/phar/tests/setsignaturealgo_sensitive_parameter.phpt b/ext/phar/tests/setsignaturealgo_sensitive_parameter.phpt new file mode 100644 index 000000000000..71c58c08c793 --- /dev/null +++ b/ext/phar/tests/setsignaturealgo_sensitive_parameter.phpt @@ -0,0 +1,28 @@ +--TEST-- +Test that the private key parameter of Phar::setSignatureAlgorithm() is marked sensitive. +--EXTENSIONS-- +phar +--INI-- +phar.require_hash=0 +phar.readonly=0 +--FILE-- +setSignatureAlgorithm(-1, 'secret-private-key'); +} catch (\Throwable $e) { + echo $e, PHP_EOL; +} +?> +--CLEAN-- + +--EXPECTF-- +UnexpectedValueException: Unknown signature algorithm specified in %s:%d +Stack trace: +#0 %s(%d): PharData->setSignatureAlgorithm(-1, Object(SensitiveParameterValue)) +#1 {main} From ea0cf6727246b957e10ead1f0ba3470f505a4618 Mon Sep 17 00:00:00 2001 From: Jordi Kroon Date: Sat, 19 Sep 2026 19:52:15 -0400 Subject: [PATCH 3/5] ext/snmp: add SensitiveParameter to missing functions --- ext/snmp/snmp.stub.php | 48 +++++++++++----------- ext/snmp/snmp_arginfo.h | 53 ++++++++++++++++++++++++- ext/snmp/snmp_decl.h | 8 ++-- ext/snmp/tests/sensitive_parameter.phpt | 35 ++++++++++++++++ 4 files changed, 115 insertions(+), 29 deletions(-) create mode 100644 ext/snmp/tests/sensitive_parameter.phpt diff --git a/ext/snmp/snmp.stub.php b/ext/snmp/snmp.stub.php index f68da7e75f1c..48199f2a6625 100644 --- a/ext/snmp/snmp.stub.php +++ b/ext/snmp/snmp.stub.php @@ -115,18 +115,18 @@ */ const SNMP_COUNTER64 = UNKNOWN; - function snmpget(string $hostname, string $community, array|string $object_id, int $timeout = -1, int $retries = -1): mixed {} + function snmpget(string $hostname, #[\SensitiveParameter] string $community, array|string $object_id, int $timeout = -1, int $retries = -1): mixed {} - function snmpgetnext(string $hostname, string $community, array|string $object_id, int $timeout = -1, int $retries = -1): mixed {} + function snmpgetnext(string $hostname, #[\SensitiveParameter] string $community, array|string $object_id, int $timeout = -1, int $retries = -1): mixed {} - function snmpwalk(string $hostname, string $community, array|string $object_id, int $timeout = -1, int $retries = -1): array|false {} + function snmpwalk(string $hostname, #[\SensitiveParameter] string $community, array|string $object_id, int $timeout = -1, int $retries = -1): array|false {} - function snmprealwalk(string $hostname, string $community, array|string $object_id, int $timeout = -1, int $retries = -1): array|false {} + function snmprealwalk(string $hostname, #[\SensitiveParameter] string $community, array|string $object_id, int $timeout = -1, int $retries = -1): array|false {} /** @alias snmprealwalk */ - function snmpwalkoid(string $hostname, string $community, array|string $object_id, int $timeout = -1, int $retries = -1): array|false {} + function snmpwalkoid(string $hostname, #[\SensitiveParameter] string $community, array|string $object_id, int $timeout = -1, int $retries = -1): array|false {} - function snmpset(string $hostname, string $community, array|string $object_id, array|string $type, array|string $value, int $timeout = -1, int $retries = -1): bool {} + function snmpset(string $hostname, #[\SensitiveParameter] string $community, array|string $object_id, array|string $type, array|string $value, int $timeout = -1, int $retries = -1): bool {} function snmp_get_quick_print(): bool {} @@ -145,44 +145,44 @@ function snmp_set_string_output_format(Snmp\StringOutput $format): void {} /** @alias snmp_set_oid_output_format */ function snmp_set_oid_numeric_print(Snmp\OidOutput|int $format): true {} - function snmp2_get(string $hostname, string $community, array|string $object_id, int $timeout = -1, int $retries = -1): mixed {} + function snmp2_get(string $hostname, #[\SensitiveParameter] string $community, array|string $object_id, int $timeout = -1, int $retries = -1): mixed {} - function snmp2_getnext(string $hostname, string $community, array|string $object_id, int $timeout = -1, int $retries = -1): mixed {} + function snmp2_getnext(string $hostname, #[\SensitiveParameter] string $community, array|string $object_id, int $timeout = -1, int $retries = -1): mixed {} - function snmp2_walk(string $hostname, string $community, array|string $object_id, int $timeout = -1, int $retries = -1): array|false {} + function snmp2_walk(string $hostname, #[\SensitiveParameter] string $community, array|string $object_id, int $timeout = -1, int $retries = -1): array|false {} - function snmp2_real_walk(string $hostname, string $community, array|string $object_id, int $timeout = -1, int $retries = -1): array|false {} + function snmp2_real_walk(string $hostname, #[\SensitiveParameter] string $community, array|string $object_id, int $timeout = -1, int $retries = -1): array|false {} - function snmp2_set(string $hostname, string $community, array|string $object_id, array|string $type, array|string $value, int $timeout = -1, int $retries = -1): bool {} + function snmp2_set(string $hostname, #[\SensitiveParameter] string $community, array|string $object_id, array|string $type, array|string $value, int $timeout = -1, int $retries = -1): bool {} function snmp3_get( string $hostname, string $security_name, string $security_level, - string $auth_protocol, string $auth_passphrase, - string $privacy_protocol, string $privacy_passphrase, + string $auth_protocol, #[\SensitiveParameter] string $auth_passphrase, + string $privacy_protocol, #[\SensitiveParameter] string $privacy_passphrase, array|string $object_id, int $timeout = -1, int $retries = -1): mixed {} function snmp3_getnext( string $hostname, string $security_name, string $security_level, - string $auth_protocol, string $auth_passphrase, - string $privacy_protocol, string $privacy_passphrase, + string $auth_protocol, #[\SensitiveParameter] string $auth_passphrase, + string $privacy_protocol, #[\SensitiveParameter] string $privacy_passphrase, array|string $object_id, int $timeout = -1, int $retries = -1): mixed {} function snmp3_walk( string $hostname, string $security_name, string $security_level, - string $auth_protocol, string $auth_passphrase, - string $privacy_protocol, string $privacy_passphrase, + string $auth_protocol, #[\SensitiveParameter] string $auth_passphrase, + string $privacy_protocol, #[\SensitiveParameter] string $privacy_passphrase, array|string $object_id, int $timeout = -1, int $retries = -1): array|false {} function snmp3_real_walk( string $hostname, string $security_name, string $security_level, - string $auth_protocol, string $auth_passphrase, - string $privacy_protocol, string $privacy_passphrase, + string $auth_protocol, #[\SensitiveParameter] string $auth_passphrase, + string $privacy_protocol, #[\SensitiveParameter] string $privacy_passphrase, array|string $object_id, int $timeout = -1, int $retries = -1): array|false {} function snmp3_set( string $hostname, string $security_name, string $security_level, - string $auth_protocol, string $auth_passphrase, - string $privacy_protocol, string $privacy_passphrase, + string $auth_protocol, #[\SensitiveParameter] string $auth_passphrase, + string $privacy_protocol, #[\SensitiveParameter] string $privacy_passphrase, array|string $object_id, array|string $type, array|string $value, int $timeout = -1, int $retries = -1): bool {} @@ -239,15 +239,15 @@ class SNMP public int $oid_output_format; public int $exceptions_enabled; - public function __construct(int $version, string $hostname, string $community, int $timeout = -1, int $retries = -1) {} + public function __construct(int $version, string $hostname, #[\SensitiveParameter] string $community, int $timeout = -1, int $retries = -1) {} /** @tentative-return-type */ public function close(): bool {} /** @tentative-return-type */ public function setSecurity( - string $securityLevel, string $authProtocol = "", string $authPassphrase = "", - string $privacyProtocol = "", string $privacyPassphrase = "", + string $securityLevel, string $authProtocol = "", #[\SensitiveParameter] string $authPassphrase = "", + string $privacyProtocol = "", #[\SensitiveParameter] string $privacyPassphrase = "", string $contextName = "", string $contextEngineId = ""): bool {} /** @tentative-return-type */ diff --git a/ext/snmp/snmp_arginfo.h b/ext/snmp/snmp_arginfo.h index 1e134c627645..5e8af709928b 100644 --- a/ext/snmp/snmp_arginfo.h +++ b/ext/snmp/snmp_arginfo.h @@ -1,7 +1,8 @@ /* This is a generated file, edit snmp.stub.php instead. - * Stub hash: 9916f5e1d4db267e7f5d6709adf90decc9dc7f0a + * Stub hash: 9a32b308176289c1b1475524372a69257f464bd4 * Has decl header: yes */ +#include "zend_attributes.h" #include "zend_constants.h" #include "zend_enum.h" @@ -301,6 +302,49 @@ static void register_snmp_symbols(int module_number) REGISTER_LONG_CONSTANT("SNMP_UINTEGER", ASN_UINTEGER, CONST_PERSISTENT); REGISTER_LONG_CONSTANT("SNMP_INTEGER", ASN_INTEGER, CONST_PERSISTENT); REGISTER_LONG_CONSTANT("SNMP_COUNTER64", ASN_COUNTER64, CONST_PERSISTENT); + + + zend_add_parameter_attribute(zend_hash_str_find_ptr(CG(function_table), "snmpget", sizeof("snmpget") - 1), 1, ZSTR_KNOWN(ZEND_STR_SENSITIVEPARAMETER), 0); + + zend_add_parameter_attribute(zend_hash_str_find_ptr(CG(function_table), "snmpgetnext", sizeof("snmpgetnext") - 1), 1, ZSTR_KNOWN(ZEND_STR_SENSITIVEPARAMETER), 0); + + zend_add_parameter_attribute(zend_hash_str_find_ptr(CG(function_table), "snmpwalk", sizeof("snmpwalk") - 1), 1, ZSTR_KNOWN(ZEND_STR_SENSITIVEPARAMETER), 0); + + zend_add_parameter_attribute(zend_hash_str_find_ptr(CG(function_table), "snmprealwalk", sizeof("snmprealwalk") - 1), 1, ZSTR_KNOWN(ZEND_STR_SENSITIVEPARAMETER), 0); + + zend_add_parameter_attribute(zend_hash_str_find_ptr(CG(function_table), "snmpwalkoid", sizeof("snmpwalkoid") - 1), 1, ZSTR_KNOWN(ZEND_STR_SENSITIVEPARAMETER), 0); + + zend_add_parameter_attribute(zend_hash_str_find_ptr(CG(function_table), "snmpset", sizeof("snmpset") - 1), 1, ZSTR_KNOWN(ZEND_STR_SENSITIVEPARAMETER), 0); + + zend_add_parameter_attribute(zend_hash_str_find_ptr(CG(function_table), "snmp2_get", sizeof("snmp2_get") - 1), 1, ZSTR_KNOWN(ZEND_STR_SENSITIVEPARAMETER), 0); + + zend_add_parameter_attribute(zend_hash_str_find_ptr(CG(function_table), "snmp2_getnext", sizeof("snmp2_getnext") - 1), 1, ZSTR_KNOWN(ZEND_STR_SENSITIVEPARAMETER), 0); + + zend_add_parameter_attribute(zend_hash_str_find_ptr(CG(function_table), "snmp2_walk", sizeof("snmp2_walk") - 1), 1, ZSTR_KNOWN(ZEND_STR_SENSITIVEPARAMETER), 0); + + zend_add_parameter_attribute(zend_hash_str_find_ptr(CG(function_table), "snmp2_real_walk", sizeof("snmp2_real_walk") - 1), 1, ZSTR_KNOWN(ZEND_STR_SENSITIVEPARAMETER), 0); + + zend_add_parameter_attribute(zend_hash_str_find_ptr(CG(function_table), "snmp2_set", sizeof("snmp2_set") - 1), 1, ZSTR_KNOWN(ZEND_STR_SENSITIVEPARAMETER), 0); + + zend_add_parameter_attribute(zend_hash_str_find_ptr(CG(function_table), "snmp3_get", sizeof("snmp3_get") - 1), 4, ZSTR_KNOWN(ZEND_STR_SENSITIVEPARAMETER), 0); + + zend_add_parameter_attribute(zend_hash_str_find_ptr(CG(function_table), "snmp3_get", sizeof("snmp3_get") - 1), 6, ZSTR_KNOWN(ZEND_STR_SENSITIVEPARAMETER), 0); + + zend_add_parameter_attribute(zend_hash_str_find_ptr(CG(function_table), "snmp3_getnext", sizeof("snmp3_getnext") - 1), 4, ZSTR_KNOWN(ZEND_STR_SENSITIVEPARAMETER), 0); + + zend_add_parameter_attribute(zend_hash_str_find_ptr(CG(function_table), "snmp3_getnext", sizeof("snmp3_getnext") - 1), 6, ZSTR_KNOWN(ZEND_STR_SENSITIVEPARAMETER), 0); + + zend_add_parameter_attribute(zend_hash_str_find_ptr(CG(function_table), "snmp3_walk", sizeof("snmp3_walk") - 1), 4, ZSTR_KNOWN(ZEND_STR_SENSITIVEPARAMETER), 0); + + zend_add_parameter_attribute(zend_hash_str_find_ptr(CG(function_table), "snmp3_walk", sizeof("snmp3_walk") - 1), 6, ZSTR_KNOWN(ZEND_STR_SENSITIVEPARAMETER), 0); + + zend_add_parameter_attribute(zend_hash_str_find_ptr(CG(function_table), "snmp3_real_walk", sizeof("snmp3_real_walk") - 1), 4, ZSTR_KNOWN(ZEND_STR_SENSITIVEPARAMETER), 0); + + zend_add_parameter_attribute(zend_hash_str_find_ptr(CG(function_table), "snmp3_real_walk", sizeof("snmp3_real_walk") - 1), 6, ZSTR_KNOWN(ZEND_STR_SENSITIVEPARAMETER), 0); + + zend_add_parameter_attribute(zend_hash_str_find_ptr(CG(function_table), "snmp3_set", sizeof("snmp3_set") - 1), 4, ZSTR_KNOWN(ZEND_STR_SENSITIVEPARAMETER), 0); + + zend_add_parameter_attribute(zend_hash_str_find_ptr(CG(function_table), "snmp3_set", sizeof("snmp3_set") - 1), 6, ZSTR_KNOWN(ZEND_STR_SENSITIVEPARAMETER), 0); } static zend_class_entry *register_class_SNMP(void) @@ -466,6 +510,13 @@ static zend_class_entry *register_class_SNMP(void) zend_declare_typed_property(class_entry, property_exceptions_enabled_name, &property_exceptions_enabled_default_value, ZEND_ACC_PUBLIC, NULL, (zend_type) ZEND_TYPE_INIT_MASK(MAY_BE_LONG)); zend_string_release_ex(property_exceptions_enabled_name, true); + + zend_add_parameter_attribute(zend_hash_str_find_ptr(&class_entry->function_table, "__construct", sizeof("__construct") - 1), 2, ZSTR_KNOWN(ZEND_STR_SENSITIVEPARAMETER), 0); + + zend_add_parameter_attribute(zend_hash_str_find_ptr(&class_entry->function_table, "setsecurity", sizeof("setsecurity") - 1), 2, ZSTR_KNOWN(ZEND_STR_SENSITIVEPARAMETER), 0); + + zend_add_parameter_attribute(zend_hash_str_find_ptr(&class_entry->function_table, "setsecurity", sizeof("setsecurity") - 1), 4, ZSTR_KNOWN(ZEND_STR_SENSITIVEPARAMETER), 0); + return class_entry; } diff --git a/ext/snmp/snmp_decl.h b/ext/snmp/snmp_decl.h index 78fad4608a29..f0b7f49d5a37 100644 --- a/ext/snmp/snmp_decl.h +++ b/ext/snmp/snmp_decl.h @@ -1,8 +1,8 @@ /* This is a generated file, edit snmp.stub.php instead. - * Stub hash: 9916f5e1d4db267e7f5d6709adf90decc9dc7f0a */ + * Stub hash: 9a32b308176289c1b1475524372a69257f464bd4 */ -#ifndef ZEND_SNMP_DECL_9916f5e1d4db267e7f5d6709adf90decc9dc7f0a_H -#define ZEND_SNMP_DECL_9916f5e1d4db267e7f5d6709adf90decc9dc7f0a_H +#ifndef ZEND_SNMP_DECL_9a32b308176289c1b1475524372a69257f464bd4_H +#define ZEND_SNMP_DECL_9a32b308176289c1b1475524372a69257f464bd4_H typedef enum zend_enum_Snmp_Mib { ZEND_ENUM_Snmp_Mib_AllowUnderscores = 1, @@ -36,4 +36,4 @@ typedef enum zend_enum_Snmp_StringOutput { ZEND_ENUM_Snmp_StringOutput_Hex = 3, } zend_enum_Snmp_StringOutput; -#endif /* ZEND_SNMP_DECL_9916f5e1d4db267e7f5d6709adf90decc9dc7f0a_H */ +#endif /* ZEND_SNMP_DECL_9a32b308176289c1b1475524372a69257f464bd4_H */ diff --git a/ext/snmp/tests/sensitive_parameter.phpt b/ext/snmp/tests/sensitive_parameter.phpt new file mode 100644 index 000000000000..a17457743d06 --- /dev/null +++ b/ext/snmp/tests/sensitive_parameter.phpt @@ -0,0 +1,35 @@ +--TEST-- +Test that community strings and SNMPv3 passphrases are marked sensitive. +--EXTENSIONS-- +snmp +--FILE-- + +--EXPECTF-- +TypeError: snmpget(): Argument #3 ($object_id) must be of type array|string, stdClass given in %s:%d +Stack trace: +#0 %s(%d): snmpget('127.0.0.1', Object(SensitiveParameterValue), Object(stdClass)) +#1 {main} +TypeError: snmp3_get(): Argument #8 ($object_id) must be of type array|string, stdClass given in %s:%d +Stack trace: +#0 %s(%d): snmp3_get('127.0.0.1', 'user', 'authPriv', 'MD5', Object(SensitiveParameterValue), 'DES', Object(SensitiveParameterValue), Object(stdClass)) +#1 {main} +TypeError: SNMP::__construct(): Argument #4 ($timeout) must be of type int, string given in %s:%d +Stack trace: +#0 %s(%d): SNMP->__construct(0, '127.0.0.1', Object(SensitiveParameterValue), 'not-an-int') +#1 {main} From 02d7c651bd7e676908710778a4ad5dd63b42d889 Mon Sep 17 00:00:00 2001 From: Jordi Kroon Date: Sat, 19 Sep 2026 19:53:16 -0400 Subject: [PATCH 4/5] ext/sqlite3: add SensitiveParameter to missing functions --- ext/sqlite3/sqlite3.stub.php | 4 ++-- ext/sqlite3/sqlite3_arginfo.h | 8 ++++++- ext/sqlite3/tests/sensitive_parameter.phpt | 27 ++++++++++++++++++++++ 3 files changed, 36 insertions(+), 3 deletions(-) create mode 100644 ext/sqlite3/tests/sensitive_parameter.phpt diff --git a/ext/sqlite3/sqlite3.stub.php b/ext/sqlite3/sqlite3.stub.php index 1a51f9dc3d85..c30b6e08c0d0 100644 --- a/ext/sqlite3/sqlite3.stub.php +++ b/ext/sqlite3/sqlite3.stub.php @@ -162,13 +162,13 @@ class SQLite3 #endif /** @implementation-alias SQLite3::open */ - public function __construct(string $filename, int $flags = SQLITE3_OPEN_READWRITE | SQLITE3_OPEN_CREATE, string $encryptionKey = "") {} + public function __construct(string $filename, int $flags = SQLITE3_OPEN_READWRITE | SQLITE3_OPEN_CREATE, #[\SensitiveParameter] string $encryptionKey = "") {} /** * @tentative-return-type * @todo SQLite3::open should really be static */ - public function open(string $filename, int $flags = SQLITE3_OPEN_READWRITE | SQLITE3_OPEN_CREATE, string $encryptionKey = ""): void {} + public function open(string $filename, int $flags = SQLITE3_OPEN_READWRITE | SQLITE3_OPEN_CREATE, #[\SensitiveParameter] string $encryptionKey = ""): void {} /** @tentative-return-type */ public function close(): bool {} diff --git a/ext/sqlite3/sqlite3_arginfo.h b/ext/sqlite3/sqlite3_arginfo.h index 3917ef63e280..f3f8160e5e20 100644 --- a/ext/sqlite3/sqlite3_arginfo.h +++ b/ext/sqlite3/sqlite3_arginfo.h @@ -1,6 +1,7 @@ /* This is a generated file, edit sqlite3.stub.php instead. - * Stub hash: 247f02e9b12b901b36bb863cf2a8e73b3d97a191 */ + * Stub hash: 0c37fc2e489ac04aa5d663644396cdd914a4e3a4 */ +#include "zend_attributes.h" #include "zend_constants.h" ZEND_BEGIN_ARG_INFO_EX(arginfo_class_SQLite3___construct, 0, 0, 1) @@ -550,6 +551,11 @@ static zend_class_entry *register_class_SQLite3(void) zend_string_release_ex(const_RECURSIVE_name, true); #endif + + zend_add_parameter_attribute(zend_hash_str_find_ptr(&class_entry->function_table, "__construct", sizeof("__construct") - 1), 2, ZSTR_KNOWN(ZEND_STR_SENSITIVEPARAMETER), 0); + + zend_add_parameter_attribute(zend_hash_str_find_ptr(&class_entry->function_table, "open", sizeof("open") - 1), 2, ZSTR_KNOWN(ZEND_STR_SENSITIVEPARAMETER), 0); + return class_entry; } diff --git a/ext/sqlite3/tests/sensitive_parameter.phpt b/ext/sqlite3/tests/sensitive_parameter.phpt new file mode 100644 index 000000000000..24807013f637 --- /dev/null +++ b/ext/sqlite3/tests/sensitive_parameter.phpt @@ -0,0 +1,27 @@ +--TEST-- +Test that the encryption key parameter of SQLite3::__construct() and SQLite3::open() is marked sensitive. +--EXTENSIONS-- +sqlite3 +--FILE-- +newInstanceWithoutConstructor(); + $db->open(':memory:', 'not-an-int', 'secret-key'); +} catch (\Throwable $e) { + echo $e, PHP_EOL; +} +?> +--EXPECTF-- +TypeError: SQLite3::__construct(): Argument #2 ($flags) must be of type int, string given in %s:%d +Stack trace: +#0 %s(%d): SQLite3->__construct(':memory:', 'not-an-int', Object(SensitiveParameterValue)) +#1 {main} +TypeError: SQLite3::open(): Argument #2 ($flags) must be of type int, string given in %s:%d +Stack trace: +#0 %s(%d): SQLite3->open(':memory:', 'not-an-int', Object(SensitiveParameterValue)) +#1 {main} From ee894631ea4785a3b255c28a9ec55c4dd6fd9730 Mon Sep 17 00:00:00 2001 From: Jordi Kroon Date: Sat, 19 Sep 2026 20:23:40 -0400 Subject: [PATCH 5/5] ext/hash: add SensitiveParameter to missing functions --- ext/hash/hash.stub.php | 4 +-- ext/hash/hash_arginfo.h | 6 +++- ext/hash/tests/mhash_sensitive_parameter.phpt | 31 +++++++++++++++++++ 3 files changed, 38 insertions(+), 3 deletions(-) create mode 100644 ext/hash/tests/mhash_sensitive_parameter.phpt diff --git a/ext/hash/hash.stub.php b/ext/hash/hash.stub.php index d86fa8d2c7e0..b89f290b5660 100644 --- a/ext/hash/hash.stub.php +++ b/ext/hash/hash.stub.php @@ -83,7 +83,7 @@ function mhash_get_hash_name(int $algo): string|false {} * @refcount 1 */ #[\Deprecated(since: '8.1')] -function mhash_keygen_s2k(int $algo, string $password, string $salt, int $length): string|false {} +function mhash_keygen_s2k(int $algo, #[\SensitiveParameter] string $password, string $salt, int $length): string|false {} #[\Deprecated(since: '8.1')] function mhash_count(): int {} @@ -92,7 +92,7 @@ function mhash_count(): int {} * @refcount 1 */ #[\Deprecated(since: '8.1')] -function mhash(int $algo, string $data, ?string $key = null): string|false {} +function mhash(int $algo, string $data, #[\SensitiveParameter] ?string $key = null): string|false {} #endif final class HashContext diff --git a/ext/hash/hash_arginfo.h b/ext/hash/hash_arginfo.h index bc213d02bfbb..98cd952cd121 100644 --- a/ext/hash/hash_arginfo.h +++ b/ext/hash/hash_arginfo.h @@ -1,5 +1,5 @@ /* This is a generated file, edit hash.stub.php instead. - * Stub hash: b0fe91da9b0469b44a9647b774b9b00498592e30 */ + * Stub hash: 6a12624fb384f6b656dbe9265c4f0ea11da7bfea */ #include "zend_attributes.h" #include "zend_constants.h" @@ -223,6 +223,8 @@ static void register_hash_symbols(int module_number) ZVAL_STR(&attribute_Deprecated_func_mhash_keygen_s2k_0->args[0].value, ZSTR_KNOWN(ZEND_STR_8_DOT_1)); attribute_Deprecated_func_mhash_keygen_s2k_0->args[0].name = ZSTR_KNOWN(ZEND_STR_SINCE); + zend_add_parameter_attribute(zend_hash_str_find_ptr(CG(function_table), "mhash_keygen_s2k", sizeof("mhash_keygen_s2k") - 1), 1, ZSTR_KNOWN(ZEND_STR_SENSITIVEPARAMETER), 0); + zend_attribute *attribute_Deprecated_func_mhash_count_0 = zend_add_function_attribute(zend_hash_str_find_ptr(CG(function_table), "mhash_count", sizeof("mhash_count") - 1), ZSTR_KNOWN(ZEND_STR_DEPRECATED_CAPITALIZED), 1); ZVAL_STR(&attribute_Deprecated_func_mhash_count_0->args[0].value, ZSTR_KNOWN(ZEND_STR_8_DOT_1)); attribute_Deprecated_func_mhash_count_0->args[0].name = ZSTR_KNOWN(ZEND_STR_SINCE); @@ -230,6 +232,8 @@ static void register_hash_symbols(int module_number) zend_attribute *attribute_Deprecated_func_mhash_0 = zend_add_function_attribute(zend_hash_str_find_ptr(CG(function_table), "mhash", sizeof("mhash") - 1), ZSTR_KNOWN(ZEND_STR_DEPRECATED_CAPITALIZED), 1); ZVAL_STR(&attribute_Deprecated_func_mhash_0->args[0].value, ZSTR_KNOWN(ZEND_STR_8_DOT_1)); attribute_Deprecated_func_mhash_0->args[0].name = ZSTR_KNOWN(ZEND_STR_SINCE); + + zend_add_parameter_attribute(zend_hash_str_find_ptr(CG(function_table), "mhash", sizeof("mhash") - 1), 2, ZSTR_KNOWN(ZEND_STR_SENSITIVEPARAMETER), 0); #endif } diff --git a/ext/hash/tests/mhash_sensitive_parameter.phpt b/ext/hash/tests/mhash_sensitive_parameter.phpt new file mode 100644 index 000000000000..c35a82718fee --- /dev/null +++ b/ext/hash/tests/mhash_sensitive_parameter.phpt @@ -0,0 +1,31 @@ +--TEST-- +Test that the key/password parameters of mhash() and mhash_keygen_s2k() are marked sensitive. +--SKIPIF-- + +--FILE-- + +--EXPECTF-- +Deprecated: Function mhash() is deprecated since 8.1 in %s on line %d +TypeError: mhash(): Argument #2 ($data) must be of type string, null given in %s:%d +Stack trace: +#0 %s(%d): mhash(0, NULL, Object(SensitiveParameterValue)) +#1 {main} + +Deprecated: Function mhash_keygen_s2k() is deprecated since 8.1 in %s on line %d +ValueError: mhash_keygen_s2k(): Argument #4 ($length) must be a greater than 0 in %s:%d +Stack trace: +#0 %s(%d): mhash_keygen_s2k(0, Object(SensitiveParameterValue), 'salt', 0) +#1 {main}