Bug #65352 [NEW]: Method Closure::bind() can access private property of object

From: seyferseed at mail dot ru Operating system: Linux PHP version: 5.4.17 Package: Class/Object related Bug Type: Bug Bug description:Method Closure::bind() can access private property of object Description: ------------ Method Closure::bind() can access private property of object. And modify it by reference. It is a violation of encapsulation. See script for example. http://3v4l.org/JE0eX Test script: --------------- <?php class Foo { private $bar = 'baz'; } $reader = function & ($object, $property) { $value = & Closure::bind(function & () use ($property) { return $this->$property; }, $object, $object)->__invoke(); return $value; }; $foo = new Foo(); $bar = & $reader($foo, 'bar'); $bar = 'tab'; var_dump($foo); Expected result: ---------------- Fatal error: Cannot access private property Foo::$bar in /in/JE0eX on line 8 Actual result: -------------- Output for 5.4.0 - 5.5.1 object(Foo)#2 (1) { ["bar":"Foo":private]=> &string(3) "tab" } -- Edit bug report at https://bugs.php.net/bug.php?id=65352&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=65352&r=trysnapshot54 Try a snapshot (PHP 5.3): https://bugs.php.net/fix.php?id=65352&r=trysnapshot53 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=65352&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=65352&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=65352&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=65352&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=65352&r=needscript Try newer version: https://bugs.php.net/fix.php?id=65352&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=65352&r=support Expected behavior: https://bugs.php.net/fix.php?id=65352&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=65352&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=65352&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=65352&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=65352&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=65352&r=dst IIS Stability: https://bugs.php.net/fix.php?id=65352&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=65352&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=65352&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=65352&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=65352&r=mysqlcfg