[5.7] Masking the content of .env on Whoops page

src/Illuminate/Foundation/Exceptions/WhoopsHandler.php

@@ -2,12 +2,23 @@
 
 namespace Illuminate\Foundation\Exceptions;
 
+use Dotenv\Dotenv;
 use Illuminate\Support\Arr;
 use Illuminate\Filesystem\Filesystem;
 use Whoops\Handler\PrettyPageHandler;
 
 class WhoopsHandler
 {
+    /**
+     * The superglobals to blacklist env keys in.
+     *
+     * @var array
+     */
+    const BLACKLISTED_SUPERGLOBALS = [
+        '_ENV',
+        '_SERVER',
+    ];
+
     /**
      * Create a new Whoops handler for debug mode.
      *
@@ -19,6 +30,7 @@ public function forDebug()
             $handler->handleUnconditionally(true);
 
             $this->registerApplicationPaths($handler)
+                 ->registerEnvBlacklist($handler)
                  ->registerBlacklist($handler)
                  ->registerEditor($handler);
         });
@@ -53,7 +65,7 @@ protected function directoriesExceptVendor()
     }
 
     /**
-     * Register the blacklist with the handler.
+     * Register the app blacklist with the handler.
      *
      * @param  \Whoops\Handler\PrettyPageHandler $handler
      * @return $this
@@ -69,6 +81,34 @@ protected function registerBlacklist($handler)
         return $this;
     }
 
+    /**
+     * Register the env file blacklist with the handler.
+     *
+     * @param  \Whoops\Handler\PrettyPageHandler $handler
+     * @return $this
+     */
+    protected function registerEnvBlacklist($handler)
+    {
+        if (! (config('app.debug_env_blacklist'))) {
+            return $this;
+        }
+
+        $dotenv = new Dotenv(base_path());
+        $dotenv->safeLoad();
+
+        foreach ($dotenv->getEnvironmentVariableNames() as $key) {
+            if (in_array($key, config('app.debug_whitelist'))) {
+                continue;
+            }
+
+            foreach (self::BLACKLISTED_SUPERGLOBALS as $superglobal) {
+                $handler->blacklist($superglobal, $key);
+            }
+        }
+
+        return $this;
+    }
+
     /**
      * Register the editor with the handler.
      *