[PHP-DEV] How to handle sensitive parameters to curl_setopt?
[email protected] ("Sjoerd Langkemper") Sat, 01 Aug 2026 21:07:34 +0200
| Newsgroups | php.internals |
|---|---|
| Message-ID | <[email protected]> |
--ca420fbd178f458d0062925ce9077a47843adb66 Content-Type: text/plain Content-Transfer-Encoding: 7bit Hello list, I would like to reduce the chance that sensitive information passed to curl_setopt is leaked. There's the SensitiveParameter attribute to prevent parameters being exposed in stack traces. For example, openssl_encrypt has its passphrase parameter marked as SensitiveParameter, so it won't be shown in a stack trace. This mechanism doesn't work so well for curl_setopt, which has the ability to set many options, both sensitive and not. The value for CURLOPT_PASSWORD is likely sensitive, the value for CURLOPT_RETURNTRANSFER is not, and CURLOPT_URL may be sensitive sometimes. I have thought of the following solutions: 1. Mark the parameter as SensitiveParameter. This improves security, but also obscures non-sensitive information. I am not sure how big of a disadvantage that actually is? The curl error messages could already use improvement, but when the value is hidden (because it's sensitive) it becomes even more important to provide better errors. 2. Let curl_setopt determine whether to mark the parameter as sensitive, depending on which option is being set. This is nice functionally, but needs changes in the engine to store sensitivity of each parameter in the stack, which comes with performance costs. https://github.com/php/php-src/pull/22938 3. Be able to pass a SensitiveParameterValue to curl_setopt. This puts the burden on the user to correctly wrap their sensitive values. https://github.com/php/php-src/pull/22960 What do you think? Regards, Sjoerd --ca420fbd178f458d0062925ce9077a47843adb66 Content-Type: text/html Content-Transfer-Encoding: quoted-printable <!DOCTYPE html><html><head><title></title></head><body><div>Hello list,<= /div><div><br></div><div>I would like to reduce the chance that sensitiv= e information passed to curl_setopt is leaked. There's the SensitivePara= meter attribute to prevent parameters being exposed in stack traces. For= example, openssl_encrypt has its passphrase parameter marked as Se= nsitiveParameter, so it won't be shown in a stack trace. This mechanism = doesn't work so well for curl_setopt, which has the ability to set many = options, both sensitive and not. The value for CURLOPT_PASSWORD is likel= y sensitive, the value for CURLOPT_RETURNTRANSFER is not, and CURLOPT_UR= L may be sensitive sometimes.</div><div><br></div><div>I have thought of= the following solutions:<br></div><ol><li>Mark the parameter as Se= nsitiveParameter. This improves security, but also obscures non-sensitiv= e information. I am not sure how big of a disadvantage that actually is?= The curl error messages could already use improvement, but when the val= ue is hidden (because it's sensitive) it becomes even more important to = provide better errors.</li><li>Let curl_setopt determine whether to mark= the parameter as sensitive, depending on which option is being set. Thi= s is nice functionally, but needs changes in the engine to store sensiti= vity of each parameter in the stack, which comes with performance costs.= <a href=3D"https://github.com/php/php-src/pull/22938">https://gith= ub.com/php/php-src/pull/22938</a><br></li><li>Be able to pass a Sen= sitiveParameterValue to curl_setopt. This puts the burden on the user to= correctly wrap their sensitive values. <a href=3D"https://github.c= om/php/php-src/pull/22960">https://github.com/php/php-src/pull/22960</a>= <br></li></ol><div>What do you think?</div><div><br></div><div>Regards,<= /div><div><br></div><div>Sjoerd</div></body></html> --ca420fbd178f458d0062925ce9077a47843adb66--