fix(logger): Make the handling of SensitiveParameters consistentbugfix/noid/consistent-handling-of-SensitiveParameter

Signed-off-by: Joas Schilling <coding@schilljs.com>

2 files changed, 22 insertions, 1 deletions

diff --git a/lib/private/Log/ExceptionSerializer.php b/lib/private/Log/ExceptionSerializer.php
index 8b895bcb6be..da4c7224aa4 100644
--- a/lib/private/Log/ExceptionSerializer.php
+++ b/lib/private/Log/ExceptionSerializer.php
@@ -220,7 +220,9 @@ class ExceptionSerializer {
 	private function removeValuesFromArgs($args, $values): array {
 		$workArgs = [];
 		foreach ($args as $arg) {
-			if (in_array($arg, $values, true)) {
+			if (isset($arg['__class__']) && $arg['__class__'] === \SensitiveParameterValue::class) {
+				$arg = self::SENSITIVE_VALUE_PLACEHOLDER;
+			} elseif (in_array($arg, $values, true)) {
 				$arg = self::SENSITIVE_VALUE_PLACEHOLDER;
 			} elseif (is_array($arg)) {
 				$arg = $this->removeValuesFromArgs($arg, $values);
diff --git a/tests/lib/Log/ExceptionSerializerTest.php b/tests/lib/Log/ExceptionSerializerTest.php
index 209214a6832..6637c401ab1 100644
--- a/tests/lib/Log/ExceptionSerializerTest.php
+++ b/tests/lib/Log/ExceptionSerializerTest.php
@@ -52,6 +52,14 @@ class ExceptionSerializerTest extends TestCase {
 		throw new \Exception('expected custom auth exception');
 	}
 
+	private function usingSensitiveParameterAttribute(
+		string $login,
+		#[\SensitiveParameter]
+		string $parole,
+	): void {
+		throw new \Exception('SensitiveParameter attribute');
+	}
+
 	/**
 	 * this test ensures that the serializer does not overwrite referenced
 	 * variables. It is crafted after a scenario we experienced: the DAV server
@@ -81,4 +89,15 @@ class ExceptionSerializerTest extends TestCase {
 			$this->assertFalse(isset($serializedData['Trace'][0]['args'][1]));
 		}
 	}
+
+	public function testSensitiveParameterAttribute(): void {
+		try {
+			$this->usingSensitiveParameterAttribute('u57474', 'Secret');
+		} catch (\Exception $e) {
+			$serializedData = $this->serializer->serializeException($e);
+			$this->assertSame('usingSensitiveParameterAttribute', $serializedData['Trace'][0]['function']);
+			$this->assertSame('u57474', $serializedData['Trace'][0]['args'][0]);
+			$this->assertSame('*** sensitive parameters replaced ***', $serializedData['Trace'][0]['args'][1]);
+		}
+	}
 }