php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #74758 \Closure::call allows full access to private properties
Submitted: 2017-06-14 08:53 UTC Modified: 2017-06-14 19:27 UTC
From: martijn at openbsd dot org Assigned:
Status: Not a bug Package: Class/Object related
PHP Version: 7.0.20 OS: Irrelevant
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: martijn at openbsd dot org
New email:
PHP Version: OS:

 

 [2017-06-14 08:53 UTC] martijn at openbsd dot org
Description:
------------
\Closure::call allows full access to private properties when the closure contains $this->...

Test script:
---------------
<?php
class A {
        private $C = 1;
        private function B() {
                return "B";
        }
}

$a = new A;

$b = function() {
        return $this->B();
};

$c = function() {
        $this->C = 2;
};

var_dump($b->call($a));
$c->call($a);
var_dump($a);
?>


Expected result:
----------------
PHP Fatal error:  Uncaught Error: Call to private method A::B() from context '' in /tmp/test.php:22

Actual result:
--------------
string(1) "B"
object(A)#1 (1) {
  ["C":"A":private]=>
  int(2)
}


Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2017-06-14 19:16 UTC] stas@php.net
-Type: Security +Type: Bug
 [2017-06-14 19:16 UTC] stas@php.net
Not a security issue, PPP is not a security measure.
 [2017-06-14 19:27 UTC] kelunik@php.net
-Status: Open +Status: Not a bug
 [2017-06-14 19:27 UTC] kelunik@php.net
This is expected behavior, see http://php.net/manual/en/closure.bindto.php.

> The “bound object” determines the value $this will have in the function body and the “class scope” represents a class which determines which private and protected members the anonymous function will be able to access.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Sun Oct 27 16:01:27 2024 UTC