mirror of
https://github.com/php/php-src.git
synced 2026-10-29 02:07:35 +08:00
eafcd68369
* zend_API: Verify property types in `object_properties_load()` Fixes php/php-src#9708. * zend_API: Fix various issues in `object_properties_load()` Fixes Fixes php/php-src#9707. Co-authored-by: Tim Düsterhus <tim@tideways-gmbh.com> * NEWS * random: Remove now-obsolete manual `$engine` type check in `Randomizer::__unserialize()` * zend_API: Make `object_properties_load()` use `strict_types=1` This is consistent with regular unserialization, which also performs strict type checking. Co-authored-by: Gina Peter Banyard <girgias@php.net> * Block creation of readonly reference properties Co-authored-by: Arnaud Le Blanc <365207+arnaud-lb@users.noreply.github.com> --------- Co-authored-by: Nora Dossche <7771979+ndossche@users.noreply.github.com> Co-authored-by: Gina Peter Banyard <girgias@php.net> Co-authored-by: Arnaud Le Blanc <365207+arnaud-lb@users.noreply.github.com>
22 lines
461 B
PHP
22 lines
461 B
PHP
--TEST--
|
|
GH-9708: object_properties_load() bypasses typed property checks
|
|
--FILE--
|
|
<?php
|
|
|
|
class Foo extends ArrayObject {
|
|
public int $a = 5;
|
|
public string $b = "10";
|
|
}
|
|
|
|
try {
|
|
// a = "10", b = 5
|
|
unserialize('O:3:"Foo":4:{i:0;i:0;i:1;a:0:{}i:2;a:2:{s:1:"a";s:2:"10";s:1:"b";i:5;}i:3;N;}');
|
|
} catch (Throwable $e) {
|
|
echo $e::class, ': ', $e->getMessage(), "\n";
|
|
}
|
|
|
|
|
|
?>
|
|
--EXPECT--
|
|
TypeError: Cannot assign string to property Foo::$a of type int
|