ext/curl: hide sensitive parameters to curl_setopt

[Sjord]

This makes it possible to mark parameters as sensitive at runtime.

curl_setopt takes many types of parameters, of which only some are secret. This tries to hide the sensitive values in stack traces, while still showing benign values.

I am not sure this is a good idea, please let me know what you think.

Ping @TimWolla, as the author of https://wiki.php.net/rfc/redact_parameters_in_back_traces.

[TimWolla]

I think this is something that would implicitly be solved by a better API (e.g. using tagged unions if / when they land) instead of trying to cram everything into a one-size-fits-all function.

With regard to the actual changes, I'm not sure if it is a good idea to make zend_execute_data larger. The benchmark seems to indicate it is not: https://github.com/php/php-src/actions/runs/30546744228?pr=22938

[Sjord]

Perhaps an intermediate solution would be the ability to pass SensitiveParameterValue to curl_setopt:

curl_setopt($ch, CURLOPT_URL, "some normal data");
curl_setopt($ch, CURLOPT_PASSWD, new SensitiveParameterValue("some secret data"));

Then it's the responsibility of the caller to correctly wrap secret values, which is not ideal, but I suppose it at least makes it possible to handle secrets securely if someone wants to.

[Sjord]

ext/curl: accept SensitiveParameterValue in curl_setopt by Sjord · Pull Request #22960 · php/php-src