Skip to content

Commit 342e18f

Browse files
TimWollaTimWolla
authored
Support the actual #[\SensitiveParameter] attribute in stubs (php#8836)
1 parent f22e0df commit 342e18f

26 files changed

+755
-505
lines changed

Diff for: ‎Zend/zend_attributes.h

-13
Original file line numberDiff line numberDiff line change
@@ -117,19 +117,6 @@ static zend_always_inline zend_attribute *zend_add_class_constant_attribute(zend
117117
return zend_add_attribute(&c->attributes, name, argc, flags, 0, 0);
118118
}
119119

120-
static zend_always_inline zend_attribute *zend_mark_function_parameter_as_sensitive(const HashTable *table, const char *func_name, uint32_t parameter)
121-
{
122-
zend_function *func = zend_hash_str_find_ptr(table, func_name, strlen(func_name));
123-
ZEND_ASSERT(func != NULL);
124-
125-
return zend_add_parameter_attribute(
126-
func,
127-
parameter,
128-
zend_ce_sensitive_parameter->name,
129-
0
130-
);
131-
}
132-
133120
void zend_register_attribute_ce(void);
134121
void zend_attributes_shutdown(void);
135122

Diff for: ‎build/gen_stub.php

+23-19
Original file line numberDiff line numberDiff line change
@@ -815,33 +815,35 @@ class ArgInfo {
815815
public $phpDocType;
816816
/** @var string|null */
817817
public $defaultValue;
818-
/** @var bool */
819-
public $isSensitive;
818+
/** @var AttributeInfo[] */
819+
public $attributes;
820820

821+
/**
822+
* @param AttributeInfo[] $attributes
823+
*/
821824
public function __construct(
822825
string $name,
823826
int $sendBy,
824827
bool $isVariadic,
825828
?Type $type,
826829
?Type $phpDocType,
827830
?string $defaultValue,
828-
bool $isSensitive
831+
array $attributes
829832
) {
830833
$this->name = $name;
831834
$this->sendBy = $sendBy;
832835
$this->isVariadic = $isVariadic;
833836
$this->setTypes($type, $phpDocType);
834837
$this->defaultValue = $defaultValue;
835-
$this->isSensitive = $isSensitive;
838+
$this->attributes = $attributes;
836839
}
837840

838841
public function equals(ArgInfo $other): bool {
839842
return $this->name === $other->name
840843
&& $this->sendBy === $other->sendBy
841844
&& $this->isVariadic === $other->isVariadic
842845
&& Type::equals($this->type, $other->type)
843-
&& $this->defaultValue === $other->defaultValue
844-
&& $this->isSensitive === $other->isSensitive;
846+
&& $this->defaultValue === $other->defaultValue;
845847
}
846848

847849
public function getSendByString(): string {
@@ -2570,7 +2572,7 @@ function (Name $item) {
25702572
}
25712573
}
25722574

2573-
if ($attributeInitializationCode = generateAttributeInitialization($this->funcInfos, $this->cond)) {
2575+
if ($attributeInitializationCode = generateAttributeInitialization($this->funcInfos, $this->cond, $allConstInfos)) {
25742576
if (!$php82MinimumCompatibility) {
25752577
$code .= "#if (PHP_VERSION_ID >= " . PHP_82_VERSION_ID . ")\n";
25762578
}
@@ -3151,7 +3153,7 @@ public function getVariableName(): string {
31513153

31523154
if ($this->name === "param") {
31533155
preg_match('/^\s*[\w\|\\\\\[\]]+\s*\$(\w+).*$/', $value, $matches);
3154-
} elseif ($this->name === "prefer-ref" || $this->name === "sensitive-param") {
3156+
} elseif ($this->name === "prefer-ref") {
31553157
preg_match('/^\s*\$(\w+).*$/', $value, $matches);
31563158
}
31573159

@@ -3242,7 +3244,6 @@ function parseFunctionLike(
32423244
break;
32433245

32443246
case 'prefer-ref':
3245-
case 'sensitive-param':
32463247
$varName = $tag->getVariableName();
32473248
if (!isset($paramMeta[$varName])) {
32483249
$paramMeta[$varName] = [];
@@ -3260,7 +3261,12 @@ function parseFunctionLike(
32603261
foreach ($func->getParams() as $i => $param) {
32613262
$varName = $param->var->name;
32623263
$preferRef = !empty($paramMeta[$varName]['prefer-ref']);
3263-
$isSensitive = !empty($paramMeta[$varName]['sensitive-param']);
3264+
$attributes = [];
3265+
foreach ($param->attrGroups as $attrGroup) {
3266+
foreach ($attrGroup->attrs as $attr) {
3267+
$attributes[] = new AttributeInfo($attr->name->toString(), $attr->args);
3268+
}
3269+
}
32643270
unset($paramMeta[$varName]);
32653271

32663272
if (isset($varNameSet[$varName])) {
@@ -3308,7 +3314,7 @@ function parseFunctionLike(
33083314
$type,
33093315
isset($docParamTypes[$varName]) ? Type::fromString($docParamTypes[$varName]) : null,
33103316
$param->default ? $prettyPrinter->prettyPrintExpr($param->default) : null,
3311-
$isSensitive
3317+
$attributes
33123318
);
33133319
if (!$param->default && !$param->variadic) {
33143320
$numRequiredArgs = $i + 1;
@@ -3962,7 +3968,7 @@ static function (FuncInfo $funcInfo) use ($fileInfo, &$generatedFunctionDeclarat
39623968
}
39633969

39643970
if ($fileInfo->generateClassEntries) {
3965-
$attributeInitializationCode = generateAttributeInitialization($fileInfo->funcInfos);
3971+
$attributeInitializationCode = generateAttributeInitialization($fileInfo->funcInfos, null, $allConstInfos);
39663972

39673973
if ($attributeInitializationCode !== "" || !empty($fileInfo->constInfos)) {
39683974
$code .= "\nstatic void register_{$stubFilenameWithoutExtension}_symbols(int module_number)\n";
@@ -4029,25 +4035,23 @@ function generateFunctionEntries(?Name $className, array $funcInfos, ?string $co
40294035
/**
40304036
* @param iterable<FuncInfo> $funcInfos
40314037
*/
4032-
function generateAttributeInitialization(iterable $funcInfos, ?string $parentCond = null): string {
4038+
function generateAttributeInitialization(iterable $funcInfos, ?string $parentCond = null, iterable $allConstInfos): string {
40334039
return generateCodeWithConditions(
40344040
$funcInfos,
40354041
"",
4036-
static function (FuncInfo $funcInfo) {
4042+
static function (FuncInfo $funcInfo) use ($allConstInfos) {
40374043
$code = null;
40384044

40394045
foreach ($funcInfo->args as $index => $arg) {
4040-
if (!$arg->isSensitive) {
4041-
continue;
4042-
}
4043-
40444046
if ($funcInfo->name instanceof MethodName) {
40454047
$functionTable = "&class_entry->function_table";
40464048
} else {
40474049
$functionTable = "CG(function_table)";
40484050
}
40494051

4050-
$code .= "\tzend_mark_function_parameter_as_sensitive($functionTable, \"" . $funcInfo->name->getNameForAttributes() . "\", $index);\n";
4052+
foreach ($arg->attributes as $attribute) {
4053+
$code .= $attribute->generateCode("zend_add_parameter_attribute(zend_hash_str_find_ptr($functionTable, \"" . $funcInfo->name->getNameForAttributes() . "\", sizeof(\"" . $funcInfo->name->getNameForAttributes() . "\") - 1), $index", "{$funcInfo->name->getMethodSynopsisFilename()}_arg{$index}", $allConstInfos);
4054+
}
40514055
}
40524056

40534057
return $code;

Diff for: ‎ext/ftp/ftp.stub.php

+1-2
Original file line numberDiff line numberDiff line change
@@ -75,8 +75,7 @@ function ftp_connect(string $hostname, int $port = 21, int $timeout = 90): FTP\C
7575
function ftp_ssl_connect(string $hostname, int $port = 21, int $timeout = 90): FTP\Connection|false {}
7676
#endif
7777

78-
/** @sensitive-param $password */
79-
function ftp_login(FTP\Connection $ftp, string $username, string $password): bool {}
78+
function ftp_login(FTP\Connection $ftp, string $username, #[\SensitiveParameter] string $password): bool {}
8079
function ftp_pwd(FTP\Connection $ftp): string|false {}
8180
function ftp_cdup(FTP\Connection $ftp): bool {}
8281
function ftp_chdir(FTP\Connection $ftp, string $directory): bool {}

Diff for: ‎ext/ftp/ftp_arginfo.h

+5-2
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

Diff for: ‎ext/hash/hash.stub.php

+6-15
Original file line numberDiff line numberDiff line change
@@ -15,22 +15,19 @@ function hash(string $algo, string $data, bool $binary = false, array $options =
1515
function hash_file(string $algo, string $filename, bool $binary = false, array $options = []): string|false {}
1616

1717
/**
18-
* @sensitive-param $key
1918
* @refcount 1
2019
*/
21-
function hash_hmac(string $algo, string $data, string $key, bool $binary = false): string {}
20+
function hash_hmac(string $algo, string $data, #[\SensitiveParameter] string $key, bool $binary = false): string {}
2221

2322
/**
24-
* @sensitive-param $key
2523
* @refcount 1
2624
*/
27-
function hash_hmac_file(string $algo, string $filename, string $key, bool $binary = false): string|false {}
25+
function hash_hmac_file(string $algo, string $filename, #[\SensitiveParameter] string $key, bool $binary = false): string|false {}
2826

2927
/**
30-
* @sensitive-param $key
3128
* @refcount 1
3229
*/
33-
function hash_init(string $algo, int $flags = 0, string $key = "", array $options = []): HashContext {}
30+
function hash_init(string $algo, int $flags = 0, #[\SensitiveParameter] string $key = "", array $options = []): HashContext {}
3431

3532
function hash_update(HashContext $context, string $data): bool {}
3633

@@ -59,22 +56,16 @@ function hash_algos(): array {}
5956
function hash_hmac_algos(): array {}
6057

6158
/**
62-
* @sensitive-param $password
6359
* @refcount 1
6460
*/
65-
function hash_pbkdf2(string $algo, string $password, string $salt, int $iterations, int $length = 0, bool $binary = false): string {}
61+
function hash_pbkdf2(string $algo, #[\SensitiveParameter] string $password, string $salt, int $iterations, int $length = 0, bool $binary = false): string {}
6662

67-
/**
68-
* @sensitive-param $known_string
69-
* @sensitive-param $user_string
70-
*/
71-
function hash_equals(string $known_string, string $user_string): bool {}
63+
function hash_equals(#[\SensitiveParameter] string $known_string, #[\SensitiveParameter] string $user_string): bool {}
7264

7365
/**
74-
* @sensitive-param $key
7566
* @refcount 1
7667
*/
77-
function hash_hkdf(string $algo, string $key, int $length = 0, string $info = "", string $salt = ""): string {}
68+
function hash_hkdf(string $algo, #[\SensitiveParameter] string $key, int $length = 0, string $info = "", string $salt = ""): string {}
7869

7970
#ifdef PHP_MHASH_BC
8071
/** @deprecated */

Diff for: ‎ext/hash/hash_arginfo.h

+29-8
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

Diff for: ‎ext/imap/php_imap.stub.php

+1-2
Original file line numberDiff line numberDiff line change
@@ -405,8 +405,7 @@
405405
*/
406406
const IMAP_GC_TEXTS = UNKNOWN;
407407

408-
/** @sensitive-param $password */
409-
function imap_open(string $mailbox, string $user, string $password, int $flags = 0, int $retries = 0, array $options = []): IMAP\Connection|false {}
408+
function imap_open(string $mailbox, string $user, #[\SensitiveParameter] string $password, int $flags = 0, int $retries = 0, array $options = []): IMAP\Connection|false {}
410409

411410
function imap_reopen(IMAP\Connection $imap, string $mailbox, int $flags = 0, int $retries = 0): bool {}
412411

Diff for: ‎ext/imap/php_imap_arginfo.h

+5-2
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

Diff for: ‎ext/ldap/ldap.stub.php

+5-19
Original file line numberDiff line numberDiff line change
@@ -610,10 +610,7 @@
610610
#endif
611611

612612
#ifdef HAVE_ORALDAP
613-
/**
614-
* @sensitive-param $password
615-
*/
616-
function ldap_connect(?string $uri = null, int $port = 389, string $wallet = UNKNOWN, string $password = UNKNOWN, int $auth_mode = GSLC_SSL_NO_AUTH): LDAP\Connection|false {}
613+
function ldap_connect(?string $uri = null, int $port = 389, string $wallet = UNKNOWN, #[\SensitiveParameter] string $password = UNKNOWN, int $auth_mode = GSLC_SSL_NO_AUTH): LDAP\Connection|false {}
617614
#else
618615
function ldap_connect(?string $uri = null, int $port = 389): LDAP\Connection|false {}
619616
#endif
@@ -623,21 +620,12 @@ function ldap_unbind(LDAP\Connection $ldap): bool {}
623620
/** @alias ldap_unbind */
624621
function ldap_close(LDAP\Connection $ldap): bool {}
625622

626-
/**
627-
* @sensitive-param $password
628-
*/
629-
function ldap_bind(LDAP\Connection $ldap, ?string $dn = null, ?string $password = null): bool {}
623+
function ldap_bind(LDAP\Connection $ldap, ?string $dn = null, #[\SensitiveParameter] ?string $password = null): bool {}
630624

631-
/**
632-
* @sensitive-param $password
633-
*/
634-
function ldap_bind_ext(LDAP\Connection $ldap, ?string $dn = null, ?string $password = null, ?array $controls = null): LDAP\Result|false {}
625+
function ldap_bind_ext(LDAP\Connection $ldap, ?string $dn = null, #[\SensitiveParameter] ?string $password = null, ?array $controls = null): LDAP\Result|false {}
635626

636627
#ifdef HAVE_LDAP_SASL
637-
/**
638-
* @sensitive-param $password
639-
*/
640-
function ldap_sasl_bind(LDAP\Connection $ldap, ?string $dn = null, ?string $password = null, ?string $mech = null, ?string $realm = null, ?string $authc_id = null, ?string $authz_id = null, ?string $props = null): bool {}
628+
function ldap_sasl_bind(LDAP\Connection $ldap, ?string $dn = null, #[\SensitiveParameter] ?string $password = null, ?string $mech = null, ?string $realm = null, ?string $authc_id = null, ?string $authz_id = null, ?string $props = null): bool {}
641629
#endif
642630

643631
/** @param LDAP\Connection|array $ldap */
@@ -791,10 +779,8 @@ function ldap_exop(LDAP\Connection $ldap, string $request_oid, ?string $request_
791779
#ifdef HAVE_LDAP_PASSWD
792780
/**
793781
* @param array $controls
794-
* @sensitive-param $old_password
795-
* @sensitive-param $new_password
796782
*/
797-
function ldap_exop_passwd(LDAP\Connection $ldap, string $user = "", string $old_password = "", string $new_password = "", &$controls = null): string|bool {}
783+
function ldap_exop_passwd(LDAP\Connection $ldap, string $user = "", #[\SensitiveParameter] string $old_password = "", #[\SensitiveParameter] string $new_password = "", &$controls = null): string|bool {}
798784
#endif
799785

800786

0 commit comments

Comments
 (0)