1--TEST--
2The SensitiveParameter attribute handles nested function calls correctly.
3--FILE--
4<?php
5
6function test(
7    #[SensitiveParameter] $sensitive1 = null,
8    $non_sensitive = null,
9    #[SensitiveParameter] $sensitive2 = null,
10)
11{
12    debug_print_backtrace();
13    var_dump(debug_backtrace());
14    var_dump((new Exception)->getTrace());
15}
16
17function wrapper(
18    $non_sensitive = null,
19    #[SensitiveParameter] $sensitive1 = null,
20    #[SensitiveParameter] $sensitive2 = null,
21)
22{
23    test($non_sensitive, $sensitive1, $sensitive2);
24}
25
26wrapper('foo', 'bar', 'baz');
27
28?>
29--EXPECTF--
30#0 %ssensitive_parameter_nested_calls.php(20): test(Object(SensitiveParameterValue), 'bar', Object(SensitiveParameterValue))
31#1 %ssensitive_parameter_nested_calls.php(23): wrapper('foo', Object(SensitiveParameterValue), Object(SensitiveParameterValue))
32array(2) {
33  [0]=>
34  array(4) {
35    ["file"]=>
36    string(%d) "%ssensitive_parameter_nested_calls.php"
37    ["line"]=>
38    int(20)
39    ["function"]=>
40    string(4) "test"
41    ["args"]=>
42    array(3) {
43      [0]=>
44      object(SensitiveParameterValue)#%d (0) {
45      }
46      [1]=>
47      string(3) "bar"
48      [2]=>
49      object(SensitiveParameterValue)#%d (0) {
50      }
51    }
52  }
53  [1]=>
54  array(4) {
55    ["file"]=>
56    string(%d) "%ssensitive_parameter_nested_calls.php"
57    ["line"]=>
58    int(23)
59    ["function"]=>
60    string(7) "wrapper"
61    ["args"]=>
62    array(3) {
63      [0]=>
64      string(3) "foo"
65      [1]=>
66      object(SensitiveParameterValue)#%d (0) {
67      }
68      [2]=>
69      object(SensitiveParameterValue)#%d (0) {
70      }
71    }
72  }
73}
74array(2) {
75  [0]=>
76  array(4) {
77    ["file"]=>
78    string(%d) "%ssensitive_parameter_nested_calls.php"
79    ["line"]=>
80    int(20)
81    ["function"]=>
82    string(4) "test"
83    ["args"]=>
84    array(3) {
85      [0]=>
86      object(SensitiveParameterValue)#%d (0) {
87      }
88      [1]=>
89      string(3) "bar"
90      [2]=>
91      object(SensitiveParameterValue)#%d (0) {
92      }
93    }
94  }
95  [1]=>
96  array(4) {
97    ["file"]=>
98    string(%d) "%ssensitive_parameter_nested_calls.php"
99    ["line"]=>
100    int(23)
101    ["function"]=>
102    string(7) "wrapper"
103    ["args"]=>
104    array(3) {
105      [0]=>
106      string(3) "foo"
107      [1]=>
108      object(SensitiveParameterValue)#%d (0) {
109      }
110      [2]=>
111      object(SensitiveParameterValue)#%d (0) {
112      }
113    }
114  }
115}
116