[php-src] Issue #9325: PHP 8.2 `readonly` classes can have dynamic properties created by unserialize()

From: Date: Sat, 13 Aug 2022 11:38:50 +0000
Subject: [php-src] Issue #9325: PHP 8.2 `readonly` classes can have dynamic properties created by unserialize()
Groups: php.bugs 
Request: Send a blank email to php-bugs+get-242210@lists.php.net to get a copy of this message
Issue: https://github.com/php/php-src/issues/9325 Author: TysonAndre ### Description The following code: ```php <?php readonly class C{} var_export(unserialize('O:1:"C":1:{s:1:"x";b:1;}')); ``` Resulted in this output: ``` \C::__set_state(array( 'x' => true, )) ``` But I expected this output instead: ``` Uncaught Error: Cannot create dynamic property C::$x ``` - https://wiki.php.net/rfc/readonly_classes - Cannot create dynamic property errors should probably be thrown in unserialize() to avoid creating readonly class instances with dynamic properties - https://wiki.php.net/rfc/deprecate_dynamic_properties - unserialize() should probably emit a deprecation notice for classes without #[AllowDynamicProperties] attributes, because in php 9.0, unserialize() on the same data would become a data ### PHP Version PHP 8.2.0beta2 ### Operating System _No response_

« previous php.bugs (#242210) next »