Problem/Motivation

In 8.2, PHP added the SensitiveParameter attribute to designate parameters that should be redacted in stack traces.

We should use this parameter to harden EncryptionMethodInterface to prevent logging of encrypted text and keys.

Proposed resolution

Use SensitiveParameter on EncryptionMethodInterface. SensitiveParameter is already used by core (PasswordInterface and UserAuthInterface)

Issue fork encrypt-3608548

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

ptmkenny created an issue. See original summary.

ptmkenny opened merge request !20

ptmkenny’s picture

ptmkenny commented
Status: Active » Needs review

Tests are failing but I believe these are pre-existing failures.

ptmkenny’s picture

ptmkenny commented

Tests pass: #3608563: Fix phpstan, phpcs, phpunit

alexpott made their first commit to this issue’s fork.

  • alexpott committed 9efad002 on 8.x-3.x 
    feat: #3608548 Hardening: Use SensitiveParameter attribute

By: ptmkenny
alexpott’s picture

alexpott
he/they
Primary language English
Location 🇪🇺🌍
commented
Status: Needs review » Fixed

Thanks @ptmkenny

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

ptmkenny closed merge request !20

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.