php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #49074 private class static fields can be modified by using reflection
Submitted: 2009-07-27 13:08 UTC Modified: 2013-03-15 14:35 UTC
Votes:1
Avg. Score:5.0 ± 0.0
Reproduced:0 of 1 (0.0%)
From: 1000235409 at smail dot shnu dot edu dot cn Assigned: nikic
Status: Closed Package: Reflection related
PHP Version: 5.2, 5.3, HEAD OS: *
Private report: No CVE-ID:
 [2009-07-27 13:08 UTC] 1000235409 at smail dot shnu dot edu dot cn
Description:
------------
When calling ReflectionClass::getStaticProperties() with a '&' operator, we can easily modify the private static fields outside the class, but only for fields declared in the parent class, not the class itself.
But I don't know if PHP should make it possible to modify the inaccessible class static fields or not, since the PHP manual just contains a prototype in Reflection.

Reproduce code:
---------------
class Test {
	private static $data = 1;
	private static $data4 = 4;

	public static function test1() {
		echo self::$data;
	}
}

class Test2 extends Test {
	private static $data2 = 2;
	public static $data3 = 3;
}

$r = new ReflectionClass('Test2');
$m = & $r->getStaticProperties(); //here, with the '&'

$m['data'] = 100; //$data is in the parent class.
$m['data4'] = 400; //$data4 is in the parent class.
$m['data2'] = 200; //no effect.
$m['data3'] = 300; //no effect.
Test::test1();
echo "\n";
$m = $r->getStaticProperties();
foreach ($m as $key => $val) {
	echo $key . '==>' . $val . "\n";
}

Expected result:
----------------
1
data2==>2
data3==>3
data==>1
data4==>4

/**OR**/

100
data2==>200
data3==>300
data==>100
data4==>400

Actual result:
--------------
100
data2==>2
data3==>3
data==>100
data4==>400

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2009-07-31 23:51 UTC] jani@php.net
Modifying returned array should not affect this. So expected output 
should be of course:

1
data2==>2
data3==>3
data==>1
data4==>4

 [2009-08-01 00:48 UTC] svn@php.net
Automatic comment from SVN on behalf of jani
Revision: http://svn.php.net/viewvc/?view=revision&revision=286605
Log: - Fixed bug #49074 (private class static fields can be modified by using reflection)
 [2009-08-01 00:50 UTC] jani@php.net
This bug has been fixed in SVN.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.


 [2009-08-01 01:01 UTC] svn@php.net
Automatic comment from SVN on behalf of jani
Revision: http://svn.php.net/viewvc/?view=revision&revision=286606
Log: - Added test for bug #49074
 [2009-08-01 21:10 UTC] felipe@php.net
Complementing the fix:

ReflectionClass::getStaticProperties() was changed to do not return the private properties from parent class; behavior already adopted in ReflectionClass::getDefaultProperties() and ReflectionClass::getProperties(). (PHP >= 5.2.11)
 [2009-08-02 02:49 UTC] 1000235409 at smail dot shnu dot edu dot cn
BUT I THINK THAT PHP SHOULD PROVIDE THE PROPERTIES DEFINED IN ITS PARENT CLASSES. And should be modifiable by using Reflection.
IF NOT, this can also be done by creating a reflection related object of its parent class.
FOR I WAS IMMPLEMENTING a serializing, including serializing the static properties for php. If it can not get private static properties, I must re-write my code again.
I JUST WANT TO FIX THE BUG brought by the '&'.
I WISH PHP CAN HAS A FULLY-supported RTTI.
 [2013-03-15 14:35 UTC] nikic@php.net
-Status: Open +Status: Closed -Assigned To: +Assigned To: nikic
 [2013-03-15 14:35 UTC] nikic@php.net
Closing as this seems to have been fixed.
 
PHP Copyright © 2001-2014 The PHP Group
All rights reserved.
Last updated: Thu Apr 17 12:01:59 2014 UTC