Language: #[\SensitiveParameter] on function — compile-time fatal missing (Zend/zend_attributes.c) #11638

Category

language · php-src-strict · attribute target validation at compile time

Problem

#[\SensitiveParameter] is legal only on parameters (and parameter-like targets). Applying it to a function must fail at compile time:

Attribute "SensitiveParameter" cannot target function (allowed targets: parameter)

Zend/php-src rejects this during compilation; this compiler accepts the attribute and runs the function.

Verified 2026-06-25 — Docker Zend PHP 8.2 vs php bin/vm.php.

php-src reference

• php/php-src Zend/zend_attributes.c — attribute target validation
• php/php-src ext/standard/basic_functions.stub.php — built-in #[\SensitiveParameter] on parameters only

Repro

test/repro/maintainer_gap_sensitive_parameter_function.php

./script/docker-exec.sh -- bash -lc 'php test/repro/maintainer_gap_sensitive_parameter_function.php; php bin/vm.php test/repro/maintainer_gap_sensitive_parameter_function.php'

Implementation hints (PHP-in-PHP)

• Validate attribute targets in compiler (lib/ AST pass) using the same allowed-targets table as php-src
• Parameter-level #[\SensitiveParameter] remains valid; reflection parity tracked in Stdlib: ReflectionParameter::getAttributes() — built-in #[\SensitiveParameter] must return ReflectionAttribute (ext/reflection) #5152

Done when

• Repro fails compile on VM with Zend-shaped fatal (not runtime LogicException)
• Parameter-targeted attribute still compiles
• Targeted compile/compliance guard

Related

• Stdlib: ReflectionParameter::getAttributes() — built-in #[\SensitiveParameter] must return ReflectionAttribute (ext/reflection) #5152 · Stdlib: ReflectionParameter — attributes + type + default value parity (ext/reflection/php_reflection.c) #4385 · Epic: Self-host critical path — compiler compiles itself (M3→M5) #1492