[php-src] Issue #9325: PHP 8.2 `readonly` classes can have dynamic properties created by unserialize()
| From: | TysonAndre | Date: | Sat, 13 Aug 2022 11:38:50 +0000 |
| Subject: | [php-src] Issue #9325: PHP 8.2 `readonly` classes can have dynamic properties created by unserialize() | ||
| Groups: | php.bugs | ||
| Request: | Send a blank email to php-bugs+get-242210@lists.php.net to get a copy of this message | ||
Issue: https://github.com/php/php-src/issues/9325
Author: TysonAndre
### Description
The following code:
```php
<?php
readonly class C{}
var_export(unserialize('O:1:"C":1:{s:1:"x";b:1;}'));
```
Resulted in this output:
```
\C::__set_state(array(
'x' => true,
))
```
But I expected this output instead:
```
Uncaught Error: Cannot create dynamic property C::$x
```
- https://wiki.php.net/rfc/readonly_classes
-
Cannot create dynamic property errors should probably be thrown in unserialize() to
avoid creating readonly class instances with dynamic properties
- https://wiki.php.net/rfc/deprecate_dynamic_properties
- unserialize() should probably emit a deprecation notice for classes without
#[AllowDynamicProperties] attributes, because in php 9.0, unserialize() on the same
data would become a data
### PHP Version
PHP 8.2.0beta2
### Operating System
_No response_