Verified Commit 36f5c460 authored by godotislate's avatar godotislate
Browse files

fix: #3582514 Add SensitiveParameter attribute to Crypt::hmacBase64() 

By: prudloff
By: sourav_paul
(cherry picked from commit 6ade36ae)
parent 9b1b16e6

core/lib/Drupal/Component/Utility/Crypt.php

+1 −1
Original line number Diff line number Diff line
@@ -21,7 +21,7 @@ class Crypt { 
   *   A base-64 encoded sha-256 hmac, with + replaced with -, / with _ and

   *   any = padding characters removed.

   */

  public static function hmacBase64($data, $key) {

  public static function hmacBase64($data, #[\SensitiveParameter] $key) {

    // $data and $key being strings here is necessary to avoid empty string

    // results of the hash function if they are not scalar values. As this

    // function is used in security-critical contexts like token validation it