Re: Exposing object handles to userland

2015-08-02 20:03 GMT+02:00 Rowan Collins <rowan.collins@gmail.com>: > On 02/08/2015 18:41, Bob Weinand wrote: > >> Some suspicious use of spl_object_hash() out there... >>> > >>> >>>> >> >>>> >>>> https://github.com/symfony/symfony/blob/master/src/Symfony/Component/VarDumper/Cloner/VarCloner.php�� >>>> ��;���$P�� >>>> >>> > >>> >Not sure what this one does... but calculations with spl_object_hash() >>> >look very suspicious. >>> >> Actually, it's doing the right thing… calculating the value the object id >> is xor'ed with (as we know that consecutively defined objects have >> consecutive ids). >> It's relying on the implementation of spl_object_hash() and will even >> continue to work when we remove that part of randomness as that value it's >> xor'ed with is then nothing else than 0. >> > > The right thing for what purpose? Why does it need that ID, rather than > the value that spl_object_hash() gave in the first place? Just to be > prettier to the user? > For the purpose of providing an id that humans can read and compare, to easily spot if two objects are identical or not. Try comparing two spl_object_hashes and you'll understand the need... The id as displayed by e.g. var_dump is not an implementation detail that leaks through it. It's really an important feature of the output. I learned that while implementing VarDumper (see link above), by user requests. Regards, Nicolas