Skip to content

Prevent leaking sensitive request data from array callables

Compare
Choose a tag to compare
@linaori linaori released this 11 Apr 13:24
· 20 commits to master since this release
Don't expose request stacktrace in call_user_func

When call_user_func runs a callable that throws an exception, the
exception stacktrace will contain the request object. When a logger
parses the array of functions, it might cause this processor/formatter
to call the `__toString()` function on the Request object, which will
then contain all request information, which includes passwords when
sent as post body.

See: Seldaek/monolog#1138