reuse existing nullable option section.

and add CURLOPT_PASSWORD to the mix. CURLOPT_XOAUTH2_BEARER already
handled.

Author: devnexen

ext/curl/interface.c

@@ -1903,7 +1903,6 @@ static zend_result _php_curl_setopt(php_curl *ch, zend_long option, zval *zvalue
 		case CURLOPT_COOKIELIST:
 		case CURLOPT_FTP_ALTERNATIVE_TO_USER:
 		case CURLOPT_SSH_HOST_PUBLIC_KEY_MD5:
-		case CURLOPT_PASSWORD:
 		case CURLOPT_PROXYPASSWORD:
 		case CURLOPT_PROXYUSERNAME:
 		case CURLOPT_NOPROXY:
@@ -1996,24 +1995,6 @@ static zend_result _php_curl_setopt(php_curl *ch, zend_long option, zval *zvalue
 			return ret;
 		}
 
-		case CURLOPT_USERPWD:
-		case CURLOPT_USERNAME:
-		{
-			if (Z_ISNULL_P(zvalue)) {
-				// Authorization header would be implictly set
-				// with an empty string thus we explictly set the option
-				// to null to avoid this unwarranted side effect
-				error = curl_easy_setopt(ch->cp, option, NULL);
-			} else {
-				zend_string *tmp_str;
-				zend_string *str = zval_get_tmp_string(zvalue, &tmp_str);
-				zend_result ret = php_curl_option_str(ch, option, ZSTR_VAL(str), ZSTR_LEN(str));
-				zend_tmp_string_release(tmp_str);
-				return ret;
-			}
-			break;
-		}
-
 		/* Curl nullable string options */
 		case CURLOPT_CUSTOMREQUEST:
 		case CURLOPT_FTPPORT:
@@ -2037,6 +2018,12 @@ static zend_result _php_curl_setopt(php_curl *ch, zend_long option, zval *zvalue
 		case CURLOPT_HSTS:
 #endif
 		case CURLOPT_KRBLEVEL:
+		// Authorization header would be implictly set
+		// with an empty string thus we explictly set the option
+		// to null to avoid this unwarranted side effect
+		case CURLOPT_USERPWD:
+		case CURLOPT_USERNAME:
+		case CURLOPT_PASSWORD:
 		{
 			if (Z_ISNULL_P(zvalue)) {
 				error = curl_easy_setopt(ch->cp, option, NULL);

ext/curl/tests/gh18458.phpt

@@ -19,6 +19,7 @@ var_dump(str_contains($response, "authorization"));
 
 $ch = curl_init("https://localhost/username");
 curl_setopt($ch, CURLOPT_USERNAME, null);
+curl_setopt($ch, CURLOPT_PASSWORD, null);
 curl_setopt($ch, CURLOPT_VERBOSE, true);
 curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
 curl_setopt($ch, CURLOPT_STDERR, fopen("php://stdout", "w"));