php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #62694 Obtaining the value of inexistent dynamic properties should not be allowed
Submitted: 2012-07-30 11:35 UTC Modified: 2018-10-31 17:33 UTC
From: cataphract@php.net Assigned: cmb (profile)
Status: Closed Package: Reflection related
PHP Version: * OS: Irrelevant
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: cataphract@php.net
New email:
PHP Version: OS:

 

 [2012-07-30 11:35 UTC] cataphract@php.net
Description:
------------
The reflection extension does not allow obtaining ReflectionProperty objects for non existent properties, much less fetch their non existent value. However, this can be bypassed by creating a dynamic ReflectionProperty in another object.

Test script:
---------------
<?php
class A {}

$a = new A;
$a->foo = "dynamic property";
$ro = new ReflectionObject($a);
$prop = $ro->getProperty('foo');
try {
	var_dump($prop->getValue($a));
	var_dump($prop->getValue(new A));
} catch (ReflectionException $ex) {
	echo "Caught!\n";
	try {
		var_dump($prop->getValue(new A));
	} catch (ReflectionException $ex) {
		var_dump($ex->getMessage());
	}
}

Expected result:
----------------
string(16) "dynamic property"
Caught!
string(49) "Dynamic property does not exist in given instance"

Actual result:
--------------
string(16) "dynamic property"
NULL

Patches

undef-dynamic-throw (last revision 2018-09-05 14:21 UTC by cmb@php.net)

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2012-07-30 11:50 UTC] cataphract@php.net
-Assigned To: +Assigned To: cataphract
 [2014-07-15 11:31 UTC] yohgaki@php.net
-PHP Version: master-Git-2012-07-30 (Git) +PHP Version: *
 [2014-07-15 11:31 UTC] yohgaki@php.net
Not fixed in all versions.
http://3v4l.org/PHAvK
 [2017-10-24 08:13 UTC] kalle@php.net
-Status: Assigned +Status: Open -Assigned To: cataphract +Assigned To:
 [2018-09-05 14:21 UTC] cmb@php.net
The following patch has been added/updated:

Patch Name: undef-dynamic-throw
Revision:   1536157293
URL:        https://bugs.php.net/patch-display.php?bug=62694&patch=undef-dynamic-throw&revision=1536157293
 [2018-09-05 14:22 UTC] cmb@php.net
-Status: Open +Status: Verified
 [2018-09-05 14:22 UTC] cmb@php.net
> Not fixed in all versions.

This issue does not appear to have been fixed at all.  @cataphract
claims an exception should be thrown in this case (and I agree),
but only an E_NOTICE is issued.

It seems we would have to check whether the property is actually
defined before trying to get its value (something like
undef-dynamic-throw).
 [2018-09-06 00:28 UTC] nikic@php.net
I disagree that an exception should be thrown. getValue() should behave the same as accessing the property. Accessing an undefined property generates a notice, so that's what should happen.
 [2018-10-31 17:33 UTC] cmb@php.net
-Status: Verified +Status: Closed -Assigned To: +Assigned To: cmb
 [2018-10-31 17:33 UTC] cmb@php.net
> getValue() should behave the same as accessing the property.

Okay.  As this happens for all actively supported PHP versions,
this ticket can be closed.
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved.
Last updated: Tue Jul 01 00:01:36 2025 UTC