php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #62694 Obtaining the value of inexistent dynamic properties should not be allowed
Submitted: 2012-07-30 11:35 UTC Modified: 2018-10-31 17:33 UTC
From: cataphract@php.net Assigned: cmb (profile)
Status: Closed Package: Reflection related
PHP Version: * OS: Irrelevant
Private report: No CVE-ID: None
 [2012-07-30 11:35 UTC] cataphract@php.net
Description:
------------
The reflection extension does not allow obtaining ReflectionProperty objects for non existent properties, much less fetch their non existent value. However, this can be bypassed by creating a dynamic ReflectionProperty in another object.

Test script:
---------------
<?php
class A {}

$a = new A;
$a->foo = "dynamic property";
$ro = new ReflectionObject($a);
$prop = $ro->getProperty('foo');
try {
	var_dump($prop->getValue($a));
	var_dump($prop->getValue(new A));
} catch (ReflectionException $ex) {
	echo "Caught!\n";
	try {
		var_dump($prop->getValue(new A));
	} catch (ReflectionException $ex) {
		var_dump($ex->getMessage());
	}
}

Expected result:
----------------
string(16) "dynamic property"
Caught!
string(49) "Dynamic property does not exist in given instance"

Actual result:
--------------
string(16) "dynamic property"
NULL

Patches

undef-dynamic-throw (last revision 2018-09-05 14:21 UTC by cmb@php.net)

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2012-07-30 11:50 UTC] cataphract@php.net
-Assigned To: +Assigned To: cataphract
 [2014-07-15 11:31 UTC] yohgaki@php.net
-PHP Version: master-Git-2012-07-30 (Git) +PHP Version: *
 [2014-07-15 11:31 UTC] yohgaki@php.net
Not fixed in all versions.
http://3v4l.org/PHAvK
 [2017-10-24 08:13 UTC] kalle@php.net
-Status: Assigned +Status: Open -Assigned To: cataphract +Assigned To:
 [2018-09-05 14:21 UTC] cmb@php.net
The following patch has been added/updated:

Patch Name: undef-dynamic-throw
Revision:   1536157293
URL:        https://bugs.php.net/patch-display.php?bug=62694&patch=undef-dynamic-throw&revision=1536157293
 [2018-09-05 14:22 UTC] cmb@php.net
-Status: Open +Status: Verified
 [2018-09-05 14:22 UTC] cmb@php.net
> Not fixed in all versions.

This issue does not appear to have been fixed at all.  @cataphract
claims an exception should be thrown in this case (and I agree),
but only an E_NOTICE is issued.

It seems we would have to check whether the property is actually
defined before trying to get its value (something like
undef-dynamic-throw).
 [2018-09-06 00:28 UTC] nikic@php.net
I disagree that an exception should be thrown. getValue() should behave the same as accessing the property. Accessing an undefined property generates a notice, so that's what should happen.
 [2018-10-31 17:33 UTC] cmb@php.net
-Status: Verified +Status: Closed -Assigned To: +Assigned To: cmb
 [2018-10-31 17:33 UTC] cmb@php.net
> getValue() should behave the same as accessing the property.

Okay.  As this happens for all actively supported PHP versions,
this ticket can be closed.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Thu Apr 25 12:01:31 2024 UTC