From: theilig at box dot com
Operating system: centos7 OSX 18.7.0
PHP version: 7.3.12
Package: Reflection related
Bug Type: Bug
Bug description:When Reflection triggers class load, property visibility is incorrect
Description:
------------
If a class tries to use reflection to read a property of a second class,
and that second class has a property or a const that is initialized by a
const reference to a third class, The scope for visibility of properties
is incorrect, The third class will not be able to access it's own
private static properties, but instead will have access to private
static properties of a different class! See the example code for more
info.
OtherClass::$test isn't as private as it thinks!
Fatal error: Uncaught Error: Cannot access private property
PrivateStatic::$privateStaticVarArray in
/Users/theilig/code/PhpBug/PrivateStatic.php on line 9
Error: Cannot access private property
PrivateStatic::$privateStaticVarArray in
/Users/theilig/code/PhpBug/PrivateStatic.php on line 9
Call Stack:
0.0004 395896 1. {main}()
/Users/theilig/code/PhpBug/ThirdClass.php:0
0.0010 398848 2. ReflectionProperty->getValue()
/Users/theilig/code/PhpBug/ThirdClass.php:9
0.0010 398968 3. spl_autoload_call()
/Users/theilig/code/PhpBug/ThirdClass.php:9
0.0010 399008 4.
{closure:/Users/theilig/code/PhpBug/ThirdClass.php:2-4}()
/Users/theilig/code/PhpBug/ThirdClass.php:9
0.0011 402480 5.
include('/Users/theilig/code/PhpBug/PrivateStatic.php')
/Users/theilig/code/PhpBug/ThirdClass.php:3
0.0011 402480 6. PrivateStatic::init()
/Users/theilig/code/PhpBug/PrivateStatic.php:12
You can see from the stack that the current function is
PrivateStatic::init() which should be able to access private static
variables in the PrivateStatic class, but instead was able to read
OtherClass::$test which is private.
The code works correctly if either
1) The third class (PrivateStatic in the example) is forcefully loaded
before the reflection call "class_exists('PrivateStatic');
or
2) The field in the second class is public, and is referenced directly
rather than via Reflection.
What I've seen via xdebug is that in php 7.1.29
$reflectionClass = new ReflectionClass('OtherClass');
will trigger the loading of PrivateStatic (and everything works
correctly)
However in php 7.3.12
$reflectionClass = new ReflectionClass('OtherClass');
will only load OtherClass, and PrivateStatic isn't loaded until
$value = $reflectionProperty->getValue();
When the getValue call triggers the loading of PrivateStatic (and the
running of the top level call to PrivateStatic::init() ) then it appears
to be picking up the scope of OtherClass
Test script:
---------------
https://github.com/theilig/PhpBug
% php ThirdClass.php
Expected result:
----------------
Expected result is:
PHP Fatal error: Uncaught Error: Cannot access private property
OtherClass::$test in /Users/theilig/code/PhpBug/PrivateStatic.php:9
Actual result:
--------------
OtherClass::$testisn't as private as it thinks!
PHP Fatal error: Uncaught Error: Cannot access private property
PrivateStatic::$privateStaticVarArray in
/Users/theilig/code/PhpBug/PrivateStatic.php:10
--
Edit bug report at https://bugs.php.net/bug.php?id=78921&edit=1
--
Fix committed: https://bugs.php.net/fix.php?id=78921&r=fixed
Fixed in release: https://bugs.php.net/fix.php?id=78921&r=alreadyfixed
Need backtrace: https://bugs.php.net/fix.php?id=78921&r=needtrace
Need Reproduce Script: https://bugs.php.net/fix.php?id=78921&r=needscript
Try newer version: https://bugs.php.net/fix.php?id=78921&r=oldversion
Not developer issue: https://bugs.php.net/fix.php?id=78921&r=support
Expected behavior: https://bugs.php.net/fix.php?id=78921&r=notwrong
Not enough info: https://bugs.php.net/fix.php?id=78921&r=notenoughinfo
Submitted twice: https://bugs.php.net/fix.php?id=78921&r=submittedtwice
register_globals: https://bugs.php.net/fix.php?id=78921&r=globals
PHP version support discontinued: https://bugs.php.net/fix.php?id=78921&r=phptooold
Daylight Savings: https://bugs.php.net/fix.php?id=78921&r=dst
IIS Stability: https://bugs.php.net/fix.php?id=78921&r=isapi
Install GNU Sed: https://bugs.php.net/fix.php?id=78921&r=gnused
Floating point limitations: https://bugs.php.net/fix.php?id=78921&r=float
No Zend Extensions: https://bugs.php.net/fix.php?id=78921&r=nozend
MySQL Configuration Error: https://bugs.php.net/fix.php?id=78921&r=mysqlcfg