Allow Disabling Class Methods via disable_methods in php.ini

[chopins]

Description

Whether it is necessary to have a php.ini configuration directive to disable class methods, similar to the disable_functions and disable_classes directives, by adding a new disable_methods=ClassName1::MethodName,ClassName2::MethodName2?

The following is an example of disabling a class method (ReflectionMethod::getStaticVariables()) via the FFI extension:

$mtptr = \FFI::addr($ffi->reflection_method_ptr->function_table);
$ffi->zend_hash_str_del($mtptr, "getstaticvariables", strlen('getstaticvariables'));

[NattyNarwhal]

Keep in mind disable_classes was removed.

[LamentXU123]

I am in favor of this feature request. However, this need to go through a RFC process.

[chopins]

Keep in mind disable_classes was removed.

In fact, class methods are similar to functions in that they have no side effects, yet they are fundamentally different from the class itself.

My proposal to block class methods is mainly aimed at blocking certain methods of the Reflection classes. For example, in very constrained environments, we need to prevent sensitive data stored in static variables of functions and methods, as well as sensitive variables bound via use in anonymous functions, from being easily retrieved. Blocking some Reflection class methods would be quite effective in such cases, as it at least establishes a simple black box at the php code level.

[Girgias]

I'm very much against. What is even the purpose of this proposal? Why would you need to disable methods of internal classes?

Especially as this is going to run into LSP violations real fast.

So frankly no, and also this would need to go through the RFC process.

I'm going to close this issue, as the issue tracker is not the correct avenue for feature requests.

[LamentXU123]

Also, you can just disable the ffi extension in the ini settings if you want to disable the ffi classes.

However, I do think disabling class method might be useful. But as the same reason why disable_classes is removed, the idea itself is buggy and violates some basic assumptions of the Zend engine. So it might be hard to implement.