From 7c3ae1104a465b7712b1d2d5d34a86a615a626ed Mon Sep 17 00:00:00 2001
From: Ilia Alshanetsky <ilia@ilia.ws>
Date: Mon, 2 Nov 2026 12:26:14 -0500
Subject: [PATCH] ext/pdo: Hide DSNs in connection exception traces

A DSN may embed a password (password=... for most drivers, PWD=... for odbc),
so mark the $dsn argument of PDO::__construct() and PDO::connect() sensitive,
as $password already is. The Pdo\* driver subclasses inherit both methods and
get the same redaction.
---
 ext/pdo/pdo_dbh.stub.php               |  4 +--
 ext/pdo/pdo_dbh_arginfo.h              |  6 +++-
 ext/pdo/tests/sensitive_parameter.phpt | 50 +++++++++++++++++++++++---
 3 files changed, 53 insertions(+), 7 deletions(-)

diff --git a/ext/pdo/pdo_dbh.stub.php b/ext/pdo/pdo_dbh.stub.php
index 7fcec0226b0b..520278d95122 100644
--- a/ext/pdo/pdo_dbh.stub.php
+++ b/ext/pdo/pdo_dbh.stub.php
@@ -164,10 +164,10 @@ class PDO
     /** @cvalue LONG_CONST(PDO_CURSOR_SCROLL) */
     public const int CURSOR_SCROLL = UNKNOWN;
 
-    public function __construct(string $dsn, ?string $username = null, #[\SensitiveParameter] ?string $password = null, ?array $options = null) {}
+    public function __construct(#[\SensitiveParameter] string $dsn, ?string $username = null, #[\SensitiveParameter] ?string $password = null, ?array $options = null) {}
 
     public static function connect(
-        string $dsn,
+        #[\SensitiveParameter] string $dsn,
         ?string $username = null,
         #[\SensitiveParameter] ?string $password = null,
         ?array $options = null
diff --git a/ext/pdo/pdo_dbh_arginfo.h b/ext/pdo/pdo_dbh_arginfo.h
index 1e4cc4328b9b..dda15b0c7dca 100644
--- a/ext/pdo/pdo_dbh_arginfo.h
+++ b/ext/pdo/pdo_dbh_arginfo.h
@@ -1,5 +1,5 @@
 /* This is a generated file, edit pdo_dbh.stub.php instead.
- * Stub hash: 006be61b2c519e7d9ca997a7f12135eb3e0f3500 */
+ * Stub hash: 53680de042448efefeb18469824d158f362e861b */
 
 #include "zend_attributes.h"
 
@@ -563,8 +563,12 @@ static zend_class_entry *register_class_PDO(void)
 	zend_string_release_ex(const_CURSOR_SCROLL_name, true);
 
 
+	zend_add_parameter_attribute(zend_hash_str_find_ptr(&class_entry->function_table, "__construct", sizeof("__construct") - 1), 0, ZSTR_KNOWN(ZEND_STR_SENSITIVEPARAMETER), 0);
+
 	zend_add_parameter_attribute(zend_hash_str_find_ptr(&class_entry->function_table, "__construct", sizeof("__construct") - 1), 2, ZSTR_KNOWN(ZEND_STR_SENSITIVEPARAMETER), 0);
 
+	zend_add_parameter_attribute(zend_hash_str_find_ptr(&class_entry->function_table, "connect", sizeof("connect") - 1), 0, ZSTR_KNOWN(ZEND_STR_SENSITIVEPARAMETER), 0);
+
 	zend_add_parameter_attribute(zend_hash_str_find_ptr(&class_entry->function_table, "connect", sizeof("connect") - 1), 2, ZSTR_KNOWN(ZEND_STR_SENSITIVEPARAMETER), 0);
 
 	return class_entry;
diff --git a/ext/pdo/tests/sensitive_parameter.phpt b/ext/pdo/tests/sensitive_parameter.phpt
index b9cf01baedfc..ab2e628ac0bc 100644
--- a/ext/pdo/tests/sensitive_parameter.phpt
+++ b/ext/pdo/tests/sensitive_parameter.phpt
@@ -1,17 +1,59 @@
 --TEST--
-Test that sensitive parameters are marked sensitive.
+PDO connection DSNs and passwords are sensitive
 --EXTENSIONS--
 pdo
+--INI--
+zend.exception_ignore_args=0
 --FILE--
 <?php
+echo "Constructor:\n";
 try {
-    new PDO('dsn', 'username', 'password');
+    new PDO('missing:password=dsn-secret', 'username', 'password');
+} catch (\Throwable $e) {
+    echo $e, PHP_EOL;
+}
+
+echo "Connect with named arguments:\n";
+try {
+    PDO::connect(dsn: 'missing:password=dsn-secret', username: 'username', password: 'password');
+} catch (\Throwable $e) {
+    echo $e, PHP_EOL;
+}
+
+class TestPDO extends PDO {}
+
+echo "Inherited constructor:\n";
+try {
+    new TestPDO('missing:password=dsn-secret', 'username', 'password');
+} catch (\Throwable $e) {
+    echo $e, PHP_EOL;
+}
+
+echo "Inherited connect:\n";
+try {
+    TestPDO::connect('missing:password=dsn-secret', 'username', 'password');
 } catch (\Throwable $e) {
     echo $e, PHP_EOL;
 }
 ?>
 --EXPECTF--
-PDOException: PDO::__construct(): Argument #1 ($dsn) must be a valid data source name in %s:%d
+Constructor:
+PDOException: could not find driver in %s:%d
+Stack trace:
+#0 %s(%d): PDO->__construct(Object(SensitiveParameterValue), 'username', Object(SensitiveParameterValue))
+#1 {main}
+Connect with named arguments:
+PDOException: could not find driver in %s:%d
+Stack trace:
+#0 %s(%d): PDO::connect(Object(SensitiveParameterValue), 'username', Object(SensitiveParameterValue))
+#1 {main}
+Inherited constructor:
+PDOException: could not find driver in %s:%d
+Stack trace:
+#0 %s(%d): PDO->__construct(Object(SensitiveParameterValue), 'username', Object(SensitiveParameterValue))
+#1 {main}
+Inherited connect:
+PDOException: could not find driver in %s:%d
 Stack trace:
-#0 %s(%d): PDO->__construct('dsn', 'username', Object(SensitiveParameterValue))
+#0 %s(%d): PDO::connect(Object(SensitiveParameterValue), 'username', Object(SensitiveParameterValue))
 #1 {main}