From fb5cc5f9eeeee9f89cdd6eebeaf844ee9dde31a9 Mon Sep 17 00:00:00 2001
From: upstream <upstream@localhost>
Date: Fri, 4 Sep 2026 08:38:50 +0200
Subject: [PATCH] Upstream Seldaek/monolog state of the touched files before
 466b18ff51

---
 src/Monolog/Formatter/RedactingFormatter.php  | 27 ++-----------------
 .../Formatter/RedactingFormatterTest.php      | 16 -----------
 2 files changed, 2 insertions(+), 41 deletions(-)

diff --git a/src/Monolog/Formatter/RedactingFormatter.php b/src/Monolog/Formatter/RedactingFormatter.php
index d97a66a..ed766d2 100644
--- a/src/Monolog/Formatter/RedactingFormatter.php
+++ b/src/Monolog/Formatter/RedactingFormatter.php
@@ -203,9 +203,8 @@ final class RedactingFormatter implements WrappingFormatterInterface
         if (\is_array($data)) {
             foreach ($data as $key => $value) {
                 if (\is_string($key) && \in_array(strtolower($key), $this->sensitiveKeys, true)) {
-                    // the value is masked in the record, but a nested array's leaves can still
-                    // leak elsewhere (e.g. json-encoded by PsrLogMessageProcessor)
-                    $this->collectSensitiveValue($value, $secrets, $depth + 1);
+                    // no need to recurse, the whole value is masked in the record anyway
+                    $this->addSecret($value, $secrets);
 
                     continue;
                 }
@@ -240,28 +239,6 @@ final class RedactingFormatter implements WrappingFormatterInterface
         }
     }
 
-    /**
-     * Collects every string leaf nested inside a value under a sensitive key.
-     *
-     * @param list<string> $secrets
-     */
-    private function collectSensitiveValue(mixed $value, array &$secrets, int $depth): void
-    {
-        if ($depth > self::MAX_DEPTH) {
-            return;
-        }
-
-        if (\is_array($value)) {
-            foreach ($value as $item) {
-                $this->collectSensitiveValue($item, $secrets, $depth + 1);
-            }
-
-            return;
-        }
-
-        $this->addSecret($value, $secrets);
-    }
-
     /**
      * Reflects the properties of an object matching a #[SensitiveParameter] constructor parameter
      *
diff --git a/tests/Monolog/Formatter/RedactingFormatterTest.php b/tests/Monolog/Formatter/RedactingFormatterTest.php
index f8c365a..ef4349c 100644
--- a/tests/Monolog/Formatter/RedactingFormatterTest.php
+++ b/tests/Monolog/Formatter/RedactingFormatterTest.php
@@ -243,22 +243,6 @@ class RedactingFormatterTest extends MonologTestCase
         $this->assertStringContainsString('calling api with [REDACTED]', $output);
     }
 
-    public function testRedactsSecretNestedInAnArrayValueAlreadyInterpolatedIntoTheMessage()
-    {
-        // PsrLogMessageProcessor json-encodes array context into the message, so a
-        // secret nested under a sensitive key leaks before this formatter runs.
-        $formatter = new RedactingFormatter(new LineFormatter('%message% %context%', 'Y-m-d'));
-        $processor = new PsrLogMessageProcessor();
-
-        $output = $formatter->format($processor($this->getRecord(
-            message: 'password reset payload: {password}',
-            context: ['password' => ['new' => 'tok-supersecret-value']],
-        )));
-
-        $this->assertStringNotContainsString('tok-supersecret-value', $output);
-        $this->assertStringContainsString('[REDACTED]', $output);
-    }
-
     public function testRedactsSecretEmbeddedInAnExceptionMessage()
     {
         $formatter = new RedactingFormatter(new JsonFormatter());