Bug #64007 [Asn->Csd]: There is an ability to create instance of Generator by hand

Edit report at https://bugs.php.net/bug.php?id=64007&edit=1 ID: 64007 Updated by: laruence@php.net Reported by: lisachenko dot it at gmail dot com Summary: There is an ability to create instance of Generator by hand -Status: Assigned +Status: Closed Type: Bug Package: Reflection related Operating System: Windows 7 x64 PHP Version: 5.5.0alpha2 Assigned To: nikic Block user comment: N Private report: N New Comment: Automatic comment on behalf of laruence Revision: http://git.php.net/?p=php-src.git;a=commit;h=f7b99c481d0a943d922e99ad9afa82c45193030e Log: Fixed bug #64007 (There is an ability to create instance of Generator by hand). Previous Comments: ------------------------------------------------------------------------ [2013-01-17 18:21:38] nikic@php.net @laruence: Imho new Foo($bar) and (new ReflectionClass('Foo'))->newInstance($bar) should behave the same. So if the constructor throws a fatal error then the constructor invoked through reflection should also throw a fatal error. If reflection doesn't go through get_constructor then it won't work correctly if that handler is overloaded. It just works so well right now because nearly noone overrides get_constructor. ------------------------------------------------------------------------ [2013-01-17 10:40:17] laruence@php.net @nikic, after a digging, I think it's better to make a private constructor for generators. here is the reason: refelction_class->newInstance used to throw exception while the constructor is non-public.. if change to get_constructor, boom~ FATAL ERROR. ------------------------------------------------------------------------ [2013-01-17 10:07:24] laruence@php.net agree, I will make a patch ------------------------------------------------------------------------ [2013-01-16 12:50:56] nikic@php.net Looks like a bug in Reflection. It should get the constructor through the get_constructor handler, not from the class property. ------------------------------------------------------------------------ [2013-01-16 12:37:13] lisachenko dot it at gmail dot com Description: ------------ Generator is an internal class, so there shouldn't be an ability to create it by hand. However, the Generator class doesn't have a private constructor and instance of it can be created via ReflectionClass. Solution: add a private constructor for this class to prevent instantiation (like for Closure class). Test script: --------------- $reflection = new ReflectionClass('Generator'); $generator = $reflection->newInstance(); var_dump($generator); Expected result: ---------------- Expected ReflectionException that restricts an object instantiation. Fatal error: Uncaught exception 'ReflectionException' with message 'Access to non-public constructor of class Generator' Actual result: -------------- Generator object created: object(Generator)#2 (0) { } ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=64007&edit=1