Use PHP SensitiveParameter (#9322)

https://www.php.net/class.sensitiveparameter
Active from PHP 8.2+ but parses without effect on PHP 8.1

app/Controllers/apiController.php

@@ -10,7 +10,7 @@ class FreshRSS_api_Controller extends FreshRSS_ActionController {
 	 * Update the user API password.
 	 * Return an error message, or `false` if no error.
 	 */
-	public static function updatePassword(string $apiPasswordPlain): string|false {
+	public static function updatePassword(#[\SensitiveParameter] string $apiPasswordPlain): string|false {
 		$username = Minz_User::name();
 		if ($username == null) {
 			return _t('feedback.api.password.failed');

app/Controllers/userController.php

@@ -74,7 +74,7 @@ class FreshRSS_user_Controller extends FreshRSS_ActionController {
 	}
 
 	/** @param array<string,mixed> $userConfigUpdated */
-	public static function updateUser(string $user, ?string $email, string $passwordPlain, array $userConfigUpdated = []): bool {
+	public static function updateUser(string $user, ?string $email, #[\SensitiveParameter] string $passwordPlain, array $userConfigUpdated = []): bool {
 		$userConfig = FreshRSS_UserConfiguration::getForUser($user);
 		if ($userConfig === null) {
 			return false;
@@ -349,7 +349,7 @@ class FreshRSS_user_Controller extends FreshRSS_ActionController {
 	 * @throws Minz_ConfigurationNamespaceException
 	 * @throws Minz_PDOConnectionException
 	 */
-	public static function createUser(string $new_user_name, ?string $email, string $passwordPlain,
+	public static function createUser(string $new_user_name, ?string $email, #[\SensitiveParameter] string $passwordPlain,
 		array $userConfigOverride = [], bool $insertDefaultFeeds = true): bool {
 		$userConfig = [];
 

app/Models/Feed.php

@@ -560,7 +560,7 @@ class FreshRSS_Feed extends Minz_Model {
 	public function _pathEntries(string $value): void {
 		$this->pathEntries = $value;
 	}
-	public function _httpAuth(string $value): void {
+	public function _httpAuth(#[\SensitiveParameter] string $value): void {
 		$this->httpAuth = $value;
 	}
 

app/Models/FormAuth.php

@@ -2,7 +2,8 @@
 declare(strict_types=1);
 
 class FreshRSS_FormAuth {
-	public static function checkCredentials(string $username, string $hash, string $nonce, string $challenge): bool {
+	public static function checkCredentials(string $username, #[\SensitiveParameter] string $hash,
+		string $nonce, #[\SensitiveParameter] string $challenge): bool {
 		if (!FreshRSS_user_Controller::checkUsername($username) ||
 				!ctype_graph($hash) ||
 				!ctype_graph($challenge) ||
@@ -56,7 +57,7 @@ class FreshRSS_FormAuth {
 		return false;
 	}
 
-	public static function makeCookie(string $username, string $password_hash): string|false {
+	public static function makeCookie(string $username, #[\SensitiveParameter] string $password_hash): string|false {
 		do {
 			$token = hash('sha256', FreshRSS_Context::systemConf()->salt . $username . random_bytes(32));
 			$token_file = DATA_PATH . '/tokens/' . $token . '.txt';

app/Utils/feverUtil.php

@@ -38,7 +38,7 @@ class FreshRSS_fever_Util {
 	 * @return string|false the Fever key, or false if the update failed
 	 * @throws FreshRSS_Context_Exception
 	 */
-	public static function updateKey(string $username, string $passwordPlain): string|false {
+	public static function updateKey(string $username, #[\SensitiveParameter] string $passwordPlain): string|false {
 		if (!self::checkFeverPath()) {
 			return false;
 		}

app/Utils/passwordUtil.php

@@ -9,7 +9,7 @@ class FreshRSS_password_Util {
 	/**
 	 * Return a hash of a plain password, using BCRYPT
 	 */
-	public static function hash(string $passwordPlain): string {
+	public static function hash(#[\SensitiveParameter] string $passwordPlain): string {
 		$passwordHash = password_hash(
 			$passwordPlain,
 			PASSWORD_BCRYPT,
@@ -25,7 +25,7 @@ class FreshRSS_password_Util {
 	 *
 	 * @return bool True if the password is valid, false otherwise
 	 */
-	public static function check(string $password): bool {
+	public static function check(#[\SensitiveParameter] string $password): bool {
 		return strlen($password) >= 7;
 	}
 

lib/Minz/Pdo.php

@@ -11,7 +11,7 @@ abstract class Minz_Pdo extends PDO {
 	 * @param array<int,int|string|bool>|null $options
 	 * @throws PDOException
 	 */
-	public function __construct(string $dsn, ?string $username = null, ?string $passwd = null, ?array $options = null) {
+	public function __construct(string $dsn, ?string $username = null, #[\SensitiveParameter] ?string $passwd = null, ?array $options = null) {
 		parent::__construct($dsn, $username, $passwd, $options);
 		$this->setAttribute(PDO::ATTR_EMULATE_PREPARES, false);
 	}

lib/Minz/PdoMysql.php

@@ -11,7 +11,7 @@ class Minz_PdoMysql extends Minz_Pdo {
 	 * @param array<int,int|string|bool>|null $options
 	 * @throws PDOException
 	 */
-	public function __construct(string $dsn, ?string $username = null, ?string $passwd = null, ?array $options = null) {
+	public function __construct(string $dsn, ?string $username = null, #[\SensitiveParameter] ?string $passwd = null, ?array $options = null) {
 		parent::__construct($dsn, $username, $passwd, $options);
 		if (class_exists('Pdo\Mysql')) {
 			assert(is_int(Pdo\Mysql::ATTR_USE_BUFFERED_QUERY));	// For PHPStan with PHP 8.4+

lib/Minz/PdoPgsql.php

@@ -11,7 +11,7 @@ class Minz_PdoPgsql extends Minz_Pdo {
 	 * @param array<int,int|string|bool>|null $options
 	 * @throws PDOException
 	 */
-	public function __construct(string $dsn, ?string $username = null, ?string $passwd = null, ?array $options = null) {
+	public function __construct(string $dsn, ?string $username = null, #[\SensitiveParameter] ?string $passwd = null, ?array $options = null) {
 		parent::__construct($dsn, $username, $passwd, $options);
 		$this->exec("SET NAMES 'UTF8';");
 	}

lib/Minz/PdoSqlite.php

@@ -11,7 +11,7 @@ class Minz_PdoSqlite extends Minz_Pdo {
 	 * @param array<int,int|string|bool>|null $options
 	 * @throws PDOException
 	 */
-	public function __construct(string $dsn, ?string $username = null, ?string $passwd = null, ?array $options = null) {
+	public function __construct(string $dsn, ?string $username = null, #[\SensitiveParameter] ?string $passwd = null, ?array $options = null) {
 		parent::__construct($dsn, $username, $passwd, $options);
 		$this->exec('PRAGMA foreign_keys = ON;');
 	}

p/api/greader.php

@@ -206,7 +206,7 @@ final class GReaderAPI {
 		return '';
 	}
 
-	private static function clientLogin(string $email, string $pass): never {
+	private static function clientLogin(string $email, #[\SensitiveParameter] string $pass): never {
 		//https://web.archive.org/web/20130604091042/http://undoc.in/clientLogin.html
 		if (FreshRSS_user_Controller::checkUsername($email)) {
 			FreshRSS_Context::initUser($email);