Add #[\SensitiveParameter] to secret parameter in setAuth()

[semgrep-code-badoo]

Mark the $secret parameter in Client::setAuth() with the #[\SensitiveParameter] attribute to prevent credential exposure in stack traces.

Changes

• Added #[\SensitiveParameter] attribute to the $secret parameter in src/REST/Client.php

Why

The #[\SensitiveParameter] attribute (introduced in PHP 8.2) instructs PHP to redact the parameter value from stack traces and exception messages. Without this attribute, if an exception is thrown during authentication, the secret (password or API token) could be logged or displayed in error output, potentially exposing credentials to unauthorized parties.

Semgrep Finding Details

Function parameter like $secret, $secretKey, or $secret_key contains sensitive data but is not marked with #[\SensitiveParameter]. If the application crashes or throws an exception, this value may be included in stack traces or error logs, leading to unintended secret disclosure. Add the #[\SensitiveParameter] attribute to prevent exposure.

@9071412 requested Semgrep Assistant generate this pull request to fix a finding.

---

⚠️ Review carefully before merging. This PR was generated by AI and may cause breaking changes or introduce new vulnerabilities.

[semgrep-code-badoo]

Semgrep identified an issue in your code:
Function parameter like $secret, $secretKey, or $secret_key contains sensitive data but is not marked with #[\SensitiveParameter]. If the application crashes or throws an exception, this value may be included in stack traces or error logs, leading to unintended secret disclosure. Add the #[\SensitiveParameter] attribute to prevent exposure.

To resolve this comment:

✨ Commit Assistant Fix Suggestion

1. Add the #[\SensitiveParameter] attribute before the $secret function parameter in the setAuth method. The function should look like:
   public function setAuth(string $login, #[\SensitiveParameter] string $secret) : Client.
2. Ensure there are no other function parameters in your codebase named $secret, $secretKey, or $secret_key without the #[\SensitiveParameter] attribute and apply the same fix if you find any.

Adding the #[\SensitiveParameter] attribute will help prevent accidental disclosure of secret values in stack traces and logs.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by php-missing-sensitive-parameter-secret.

_{You can view more details about this finding in the Semgrep AppSec Platform.}