From cc9f16bb484a95ebdd8cb7e2b3956257f307fdf6 Mon Sep 17 00:00:00 2001
From: Sjoerd Langkemper <sjoerd-github@linuxonly.nl>
Date: Fri, 31 Jul 2026 07:45:34 +0000
Subject: [PATCH] ext/curl: accept SensitiveParameterValue in curl_setopt

This makes it possible to pass things to curl_setopt without them
leaking in backtraces.
---
 ext/curl/interface.c | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/ext/curl/interface.c b/ext/curl/interface.c
index 07e53dfe0f9f..a5829339201c 100644
--- a/ext/curl/interface.c
+++ b/ext/curl/interface.c
@@ -1625,6 +1625,23 @@ static zend_result _php_curl_setopt(php_curl *ch, zend_long option, zval *zvalue
 	CURLcode error = CURLE_OK;
 	zend_long lval;
 
+	if (Z_TYPE_P(zvalue) == IS_OBJECT
+		&& instanceof_function(Z_OBJCE_P(zvalue), zend_ce_sensitive_parameter_value))
+	{
+		zval rv;
+		zval *inner_value;
+
+		inner_value = zend_read_property_ex(
+			zend_ce_sensitive_parameter_value,
+			Z_OBJ_P(zvalue),
+			ZSTR_KNOWN(ZEND_STR_VALUE),
+			0,
+			&rv
+		);
+
+		zvalue = inner_value;
+	}
+
 	switch (option) {
 		/* Callable options */
 		HANDLE_CURL_OPTION_CALLABLE_PHP_CURL_USER(ch, CURLOPT_WRITE, write, PHP_CURL_STDOUT);