{"record":{"id":"5c2003a641abe1bc","repo":"rectorphp/rector","slug":"s-rule-is-deprecated-as-matching-sensitive-par","errorCode":null,"errorMessage":"\"%s\" rule is deprecated, as matching sensitive parameters by name is vague and risky. Add the #[\\SensitiveParameter] attribute per case instead","messagePattern":"\"(.+?)\" rule is deprecated, as matching sensitive parameters by name is vague and risky\\. Add the #\\[\\\\SensitiveParameter\\] attribute per case instead","errorType":"exception","errorClass":"ShouldNotHappenException","httpStatus":null,"severity":"error","filePath":"rules/Php82/Rector/Param/AddSensitiveParameterAttributeRector.php","lineNumber":41,"sourceCode":"     * @var string\n     */\n    public const SENSITIVE_PARAMETERS = 'sensitive_parameters';\n    /**\n     * @param array<string, mixed> $configuration\n     */\n    public function configure(array $configuration): void\n    {\n    }\n    public function getNodeTypes(): array\n    {\n        return [Param::class];\n    }\n    /**\n     * @param Node\\Param $node\n     */\n    public function refactor(Node $node): ?Param\n    {\n        throw new ShouldNotHappenException(sprintf('\"%s\" rule is deprecated, as matching sensitive parameters by name is vague and risky. Add the #[\\SensitiveParameter] attribute per case instead', self::class));\n    }\n    public function getRuleDefinition(): RuleDefinition\n    {\n        return new RuleDefinition('Add SensitiveParameter attribute to method and function configured parameters', [new ConfiguredCodeSample(<<<'CODE_SAMPLE'\nclass SomeClass\n{\n    public function run(string $password)\n    {\n    }\n}\nCODE_SAMPLE\n, <<<'CODE_SAMPLE'\nclass SomeClass\n{\n    public function run(#[\\SensitiveParameter] string $password)\n    {\n    }\n}","sourceCodeStart":23,"sourceCodeEnd":59,"githubUrl":"https://github.com/rectorphp/rector/blob/408fcb0ff1833e3d26cbc9b04c23a77565814a16/rules/Php82/Rector/Param/AddSensitiveParameterAttributeRector.php#L23-L59","documentation":"Rector\\Php82\\Rector\\Param\\AddSensitiveParameterAttributeRector is deprecated: refactor() unconditionally throws Rector\\Exception\\ShouldNotHappenException on the first Param node it visits. The rule used to add the #[\\SensitiveParameter] attribute to parameters matched by configured names (e.g. 'password'), but matching secrets by name alone is vague and risky - it can flag unrelated parameters that happen to share a name. Its configure() body is now an empty no-op, so any old configuration passed via withConfiguredRule() is silently discarded before the exception is thrown.","triggerScenarios":"The rule is still referenced in rector.php (withRules() or withConfiguredRule() with the old parameter-name list) and rector processes any function/method parameter; refactor() throws on the first Param node regardless of configuration.","commonSituations":"Upgrading rector after this PHP 8.2 rule was gutted; security-check CI configs copied from older blog posts that still list the rule; assuming the old 'password'/'secret' name configuration still works because no config error is reported at load time.","solutions":["Remove AddSensitiveParameterAttributeRector from rector.php - it no longer adds anything.","Add #[\\SensitiveParameter] by hand to each parameter that genuinely carries a secret (token, password, private key), reviewing each call site.","If you have many occurrences, write a small custom rule scoped to the exact services/parameters that handle secrets.","Temporary stopgap only: pin the last rector version shipping the working rule, and schedule config cleanup."],"exampleFix":"// before (rector.php)\n->withConfiguredRule(AddSensitiveParameterAttributeRector::class, [\n    'password', 'secret',\n])\n\n// after (rector.php) - entry deleted\n\n// before (src/Auth.php)                 // after (src/Auth.php)\npublic function login(string $password)   public function login(#[\\SensitiveParameter] string $password)","handlingStrategy":"validation","validationCode":"use Rector\\Php82\\Rector\\Param\\AddSensitiveParameterAttributeRector;\n\n$rules = [/* your list */ AddSensitiveParameterAttributeRector::class];\nif (in_array(AddSensitiveParameterAttributeRector::class, $rules, true)) {\n    throw new InvalidArgumentException('AddSensitiveParameterAttributeRector is deprecated; add #[\\SensitiveParameter] manually instead');\n}","typeGuard":null,"tryCatchPattern":"try {\n    exit($rectorApplication->run());\n} catch (\\Rector\\Exception\\ShouldNotHappenException $e) {\n    if (str_contains($e->getMessage(), 'AddSensitiveParameterAttributeRector')) {\n        fwrite(STDERR, 'Remove the deprecated rule from rector.php and mark secrets manually.' . PHP_EOL);\n        exit(1);\n    }\n    throw $e;\n}","preventionTips":["Do not pass old parameter-name configuration to this rule - configure() is a no-op and the values are ignored.","Handle secrets explicitly: add #[\\SensitiveParameter] during code review of auth/crypto code.","Audit rector.php after each upgrade for rules whose configure() became empty no-ops.","Keep security-related migrations manual so each call site is consciously reviewed."],"tags":["rector","php","security","sensitive-parameter","deprecated-rule","php82"],"backgroundTag":"deprecated-api-invoked","analyzedSha":"408fcb0ff1833e3d26cbc9b04c23a77565814a16","analyzedAt":"2026-08-21T05:11:02.643Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}