search

antonioribeiro / google2fa

A One Time Password Authentication package, compatible with Google Authenticator.
MIT License
1.84k stars 200 forks source link

Add `\SensitiveParameter` attribute to params with any secret or key material #187

Closed spaze closed 1 year ago

spaze commented 1 year ago

Hi, this attribute is used to mark a parameter that is sensitive and should have its value redacted if present in a stack trace. (verbatim copy from the PHP manual)

The redaction will be performed only on PHP 8.2 and newer but the attribute itself and the syntax is backwards compatible so using the class with let's say PHP 7.4 will still work as it did before.

I have added the attribute to all params that hold the secret, or the 2FA code, or strings that will contain parts of either of them.

Compare the call stacks, before: before and after the attribute has been added: after

Thanks.

antonioribeiro commented 1 year ago

Hey @spaze, thanks for this PR. We just need you to sign your commits in order to approve it:

https://docs.github.com/articles/about-gpg/ https://dev.to/zahrakhadijha/git-fixing-unsigned-gpg-commits-phn

spaze commented 1 year ago

Hey, sorry missed the check. All commits now signed, thanks!

spaze commented 1 year ago

Hey @antonioribeiro, would you please consider releasing a new version so the attribute is available? Thanks!

spaze commented 7 months ago

Hi @antonioribeiro , could you please tag a new release so this can be used with versioned releases? I'd suggest merging #196 first to fix #192 though. Thank you!

spaze commented 6 months ago

Hi @antonioribeiro, do you need help maintaining the lib? I'd volunteer to help you with the lib if you'd like to :-)