Sec Bug->Bug #74758 [Opn]: \Closure::call allows full access to private properties
| From: | stas@php.net | Date: | Wed, 14 Jun 2017 19:16:25 +0000 |
| Subject: | Sec Bug->Bug #74758 [Opn]: \Closure::call allows full access to private properties | ||
| References: | 1 | Groups: | php.bugs |
| Request: | Send a blank email to php-bugs+get-209535@lists.php.net to get a copy of this message | ||
Edit report at https://bugs.php.net/bug.php?id=74758&edit=1
ID: 74758
Updated by: stas@php.net
Reported by: martijn at openbsd dot org
Summary: \Closure::call allows full access to private
properties
Status: Open
-Type: Security
+Type: Bug
Package: Class/Object related
Operating System: Irrelevant
PHP Version: 7.0.20
Block user comment: N
Private report: Y
New Comment:
Not a security issue, PPP is not a security measure.
Previous Comments:
------------------------------------------------------------------------
[2017-06-14 08:53:48] martijn at openbsd dot org
Description:
------------
\Closure::call allows full access to private properties when the closure contains $this->...
Test script:
---------------
<?php
class A {
private $C = 1;
private function B() {
return "B";
}
}
$a = new A;
$b = function() {
return $this->B();
};
$c = function() {
$this->C = 2;
};
var_dump($b->call($a));
$c->call($a);
var_dump($a);
?>
Expected result:
----------------
PHP Fatal error: Uncaught Error: Call to private method A::B() from context '' in
/tmp/test.php:22
Actual result:
--------------
string(1) "B"
object(A)#1 (1) {
["C":"A":private]=>
int(2)
}
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=74758&edit=1