Closes #388

[bytestream]

No description provided.

[bytestream]

Also closes #378

[barryvdh]

wouldn't this be breaking, when passing normal objects?

[coveralls]

Coverage increased (+0.8%) to 55.237% when pulling e247747 on bytestream:#388 into b50247f on rcrowe:master.

[bytestream]

Should only be breaking if you're using a sandbox policy? But I would argue it's a bug fix and previous functionality was not intended.

[barryvdh]

But this prevents all array access fields from being accessed in a Sandbox? Or am I misunderstanding it? I understand we should prevent the app variable (eg check Container contract?), but why all ArrayAccess items?

[bytestream]

The sandbox policy should prevent access to anything that's not explicitly listed in the policy. I don't see why objects that implement ArrayAccess should bypass the policy with the exception of Contract / Model instances.

Looking at twig, the only side effect of this change (for those who do not use a sandbox) is that the isset() check on ArrayAccess objects is removed:
https://github.com/twigphp/Twig/blob/3.x/src/Extension/CoreExtension.php#L1370

[bytestream]

Do you mind tagging? 🤞 and if you want any help with the repo, particularly closing a lot of old issues / PR then I'm happy to help :)

[barryvdh]

Tagged 0.12
Yeah we should probably get support for 3.x in order, including getting the tests fixed (so #395 and #394)

[barryvdh]

This lead to problems with Symfony forms. Reverting this.

[bytestream]

Looking at twig, the only side effect of this change (for those who do not use a sandbox) is that the isset() check on ArrayAccess objects is removed:
https://github.com/twigphp/Twig/blob/3.x/src/Extension/CoreExtension.php#L1370

Twig's sandbox requires you to add the magic __isset() method to your classes in order to allow the sandbox' security policy to check if the method or property you are calling on your class is allowed.

I think it just needs to call isset(), but only if that method exists...

[bytestream]

@barryvdh why do we use return $object->$item instead of return $object[$item]

I don't think there would be a problem if we add isset() and use $object[$item].

The problem seems to be we're checking for ArrayAccess (offsetGet, offsetExists) but as the code uses $object->$item it's actually using __get, __isset

I'll resubmit a PR...