Repository navigation
Document SensitiveParameter attribute in callbacks #5734
Description
Affected page
https://www.php.net/manual/en/curl.constants.php
Current issue
E.g. CURLOPT_SSH_HOSTKEYFUNCTION:
The callback must have the following signature:
function callback(
resource $curlHandle,
int $keyType,
string $key,
int $keyLength
): int
Suggested improvement
I think it would be better if it said #[\SensitiveParameter]string $key.
Activity
jordikroon commentedon Aug 5, 2026
Related: #5631
jordikroon commentedon Oct 5, 2026
I've just had another look at this. The callback is a user-defined function. Curl doesn't define it. So the true question is if
$keyis a parameter that should be marked as sensitive. Sensitive enough for the documentation to encourage it. I believe it isn't, because:$keyis the server's public host key. The server sends it to every client that connects, before any authentication happens. Anyone can retrieve it and leaking it in a stack trace discloses nothing an attacker couldn't already get.It matches how php-src itself uses the attribute. It is applied to secrets (passwords, private keys, plaintext), not to public keys.
Sjord commentedon Oct 5, 2026
Ok, thanks for looking into it. My point was indeed for the documentation to encourage use of
#[\SensitiveParameter]. That when people copy/paste the signature from the docs, it already includes the recommended attribute. But it seems I misinterpreted$keyas a private key instead of a public key.