1--TEST-- 2Test that sensitive parameters are marked sensitive. 3--FILE-- 4<?php 5try { 6 var_dump(hash_equals('foo', null)); 7} catch (\Throwable $e) { 8 echo $e, PHP_EOL; 9} 10try { 11 var_dump(hash_hmac('foo', 'bar', 'baz')); 12} catch (\Throwable $e) { 13 echo $e, PHP_EOL; 14} 15?> 16--EXPECTF-- 17TypeError: hash_equals(): Argument #2 ($user_string) must be of type string, null given in %s:%d 18Stack trace: 19#0 %s(%d): hash_equals(Object(SensitiveParameterValue), Object(SensitiveParameterValue)) 20#1 {main} 21ValueError: hash_hmac(): Argument #1 ($algo) must be a valid cryptographic hashing algorithm in %s:%d 22Stack trace: 23#0 %s(%d): hash_hmac('foo', 'bar', Object(SensitiveParameterValue)) 24#1 {main} 25