Add #[\SensitiveParameter] to User::create() password parameter

[semgrep-code-badoo]

Mark the password parameter in User::create() with #[\SensitiveParameter] to prevent credential exposure in stack traces.

Changes

• Added #[\SensitiveParameter] attribute to the $password parameter in User::create() method

Why

PHP 8.2 introduced the #[\SensitiveParameter] attribute which redacts parameter values from stack traces and error logs. Without this attribute, if an exception is thrown during user creation, the password could be exposed in logs or error reports. Adding this attribute ensures the password is displayed as "Object(SensitiveParameterValue)" instead of the actual value.

Semgrep Finding Details

Function parameter like $password contains sensitive authentication data but is not marked with #[\SensitiveParameter]. If the application crashes or throws an exception, this value may be included in stack traces or error logs, leading to unintended password disclosure. Add the #[\SensitiveParameter] attribute to prevent exposure.

@9071412 requested Semgrep Assistant generate this pull request to fix a finding.

---

⚠️ Review carefully before merging. This PR was generated by AI and may cause breaking changes or introduce new vulnerabilities.

[semgrep-code-badoo]

Semgrep identified an issue in your code:
Function parameter like $password contains sensitive authentication data but is not marked with #[\SensitiveParameter]. If the application crashes or throws an exception, this value may be included in stack traces or error logs, leading to unintended password disclosure. Add the #[\SensitiveParameter] attribute to prevent exposure.

To resolve this comment:

✨ Commit Assistant Fix Suggestion

1. Add the #[\SensitiveParameter] attribute right before the $password parameter in the function signature, so it looks like: #[\SensitiveParameter] string $password.
2. Ensure the function signature is updated to:
   public function create(string $name, #[\SensitiveParameter] string $password, string $email, string $display_name, array $applications = ["jira-software"]) : \stdClass { ... }

This prevents the value of $password from being exposed in stack traces or error logs if an exception occurs.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by php-missing-sensitive-parameter-password.

_{You can view more details about this finding in the Semgrep AppSec Platform.}