Skip to content

object_properties_load() bypasses readonly property checks #19765

Closed
Closed
object_properties_load() bypasses readonly property checks#19765
Assignees
TimWolla
Labels
BugCategory: EngineStatus: Verified

Description

@TimWolla
TimWolla
opened on Sep 8, 2025

Description

The following code:

<?php

$r = new \Random\Randomizer(new \Random\Engine\PcgOneseq128XslRr64());
$r->__unserialize([['engine' => new \Random\Engine\Xoshiro256StarStar()]]);
var_dump($r->engine::class);

Resulted in this output:

string(32) "Random\Engine\Xoshiro256StarStar"

But I expected this output instead:

Error: Cannot modify readonly property Random\Randomizer::$engine

PHP Version

git master (probably any version)

Operating System

No response

Activity

  1. TimWolla
    added
    Bug
    Status: Needs Triage
    on Sep 8, 2025

  2. TimWolla commented on Sep 8, 2025

    @TimWolla
    TimWolla
    on Sep 8, 2025
    MemberAuthor

    This is quite similar to #9186.

  3. ndossche commented on Sep 8, 2025

    @ndossche
    ndossche
    on Sep 8, 2025
    Member

    It bypasses all sorts of things: #9708

  4. ndossche
    added
    Category: Engine
    Status: Verified
    and removed
    Status: Needs Triage
    on Sep 8, 2025
  5. TimWolla
    self-assigned this
    on Sep 8, 2025

  6. iluuu1994 commented on Sep 8, 2025

    @iluuu1994
    iluuu1994
    on Sep 8, 2025
    Member

    It bypasses all sorts of things: #9708

    Oof, that's not great. It seems we're missing at least type checks/coercion and exception handling (abort when the destructor fails).

    Reference handling is somewhat odd, in that references are copied to the property, except if the reference has RC=1, then they are unwrapped. This leads to some odd behavior (https://3v4l.org/ojCPY), which depends on other references to the reference existing. This makes some sense, in that references are supposed to be transparent, but still seems odd. Reference operations are usually very explicit.

    Anyway, given references are copied, this also means we'll need to coerce the value inside the reference, so this has some observable side-effects.

  7. TimWolla
    added a commit that references this issue on Sep 9, 2025

    zend_API: Do not overwrite `readonly` properties in `object_propertie…

    215ebbb
  8. TimWolla
    closed this as completedin 215ebbbon Sep 9, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

BugCategory: EngineStatus: Verified

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions