php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #49074 private class static fields can be modified by using reflection
Submitted: 2009-07-27 13:08 UTC Modified: 2013-03-15 14:35 UTC
Votes:1
Avg. Score:5.0 ± 0.0
Reproduced:0 of 1 (0.0%)
From: 1000235409 at smail dot shnu dot edu dot cn Assigned: nikic (profile)
Status: Closed Package: Reflection related
PHP Version: 5.2, 5.3, HEAD OS: *
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: 1000235409 at smail dot shnu dot edu dot cn
New email:
PHP Version: OS:

 

 [2009-07-27 13:08 UTC] 1000235409 at smail dot shnu dot edu dot cn
Description:
------------
When calling ReflectionClass::getStaticProperties() with a '&' operator, we can easily modify the private static fields outside the class, but only for fields declared in the parent class, not the class itself.
But I don't know if PHP should make it possible to modify the inaccessible class static fields or not, since the PHP manual just contains a prototype in Reflection.

Reproduce code:
---------------
class Test {
	private static $data = 1;
	private static $data4 = 4;

	public static function test1() {
		echo self::$data;
	}
}

class Test2 extends Test {
	private static $data2 = 2;
	public static $data3 = 3;
}

$r = new ReflectionClass('Test2');
$m = & $r->getStaticProperties(); //here, with the '&'

$m['data'] = 100; //$data is in the parent class.
$m['data4'] = 400; //$data4 is in the parent class.
$m['data2'] = 200; //no effect.
$m['data3'] = 300; //no effect.
Test::test1();
echo "\n";
$m = $r->getStaticProperties();
foreach ($m as $key => $val) {
	echo $key . '==>' . $val . "\n";
}

Expected result:
----------------
1
data2==>2
data3==>3
data==>1
data4==>4

/**OR**/

100
data2==>200
data3==>300
data==>100
data4==>400

Actual result:
--------------
100
data2==>2
data3==>3
data==>100
data4==>400

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2009-07-31 23:51 UTC] jani@php.net
Modifying returned array should not affect this. So expected output 
should be of course:

1
data2==>2
data3==>3
data==>1
data4==>4

 [2009-08-01 00:48 UTC] svn@php.net
Automatic comment from SVN on behalf of jani
Revision: http://svn.php.net/viewvc/?view=revision&revision=286605
Log: - Fixed bug #49074 (private class static fields can be modified by using reflection)
 [2009-08-01 00:50 UTC] jani@php.net
This bug has been fixed in SVN.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.


 [2009-08-01 01:01 UTC] svn@php.net
Automatic comment from SVN on behalf of jani
Revision: http://svn.php.net/viewvc/?view=revision&revision=286606
Log: - Added test for bug #49074
 [2009-08-01 21:10 UTC] felipe@php.net
Complementing the fix:

ReflectionClass::getStaticProperties() was changed to do not return the private properties from parent class; behavior already adopted in ReflectionClass::getDefaultProperties() and ReflectionClass::getProperties(). (PHP >= 5.2.11)
 [2009-08-02 02:49 UTC] 1000235409 at smail dot shnu dot edu dot cn
BUT I THINK THAT PHP SHOULD PROVIDE THE PROPERTIES DEFINED IN ITS PARENT CLASSES. And should be modifiable by using Reflection.
IF NOT, this can also be done by creating a reflection related object of its parent class.
FOR I WAS IMMPLEMENTING a serializing, including serializing the static properties for php. If it can not get private static properties, I must re-write my code again.
I JUST WANT TO FIX THE BUG brought by the '&'.
I WISH PHP CAN HAS A FULLY-supported RTTI.
 [2013-03-15 14:35 UTC] nikic@php.net
-Status: Open +Status: Closed -Assigned To: +Assigned To: nikic
 [2013-03-15 14:35 UTC] nikic@php.net
Closing as this seems to have been fixed.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Thu Nov 21 13:01:29 2024 UTC