PHP 8.2 readonly classes can have dynamic properties created by unserialize()

[TysonAndre]

Description

The following code:

<?php
readonly class C{}
var_export(unserialize('O:1:"C":1:{s:1:"x";b:1;}'));

Resulted in this output:

\C::__set_state(array(
   'x' => true,
))

But I expected this output instead:

Uncaught Error: Cannot create dynamic property C::$x

• https://wiki.php.net/rfc/readonly_classes - Cannot create dynamic property errors should probably be thrown in unserialize() to avoid creating readonly class instances with dynamic properties
• https://wiki.php.net/rfc/deprecate_dynamic_properties - unserialize() should probably emit a deprecation notice for classes without #[AllowDynamicProperties] attributes, because in php 9.0, unserialize() on the same data would become a data

PHP Version

PHP 8.2.0beta2

Operating System

No response

[iluuu1994]

Related to #9186.

[TysonAndre]

@nikic @kocsismate fyi

Checks would probably be similar to those found in zend_object_handlers

We may want a different error message for private/protected properties with embedded null bytes (if they were declared when serializing but not declared when unserializing), e.g. "\0*\0protectedPropName", "\0DeclaringClass\0privatePropName" - I don't remember a helper method to reuse to do that, but skipping past the second(last) null byte would work

static zend_always_inline const char *zend_get_unmangled_property_name(const zend_string *mangled_prop) {

			if (UNEXPECTED(zobj->ce->ce_flags & ZEND_ACC_NO_DYNAMIC_PROPERTIES)) {
				zend_forbidden_dynamic_property(zobj->ce, name);
				variable_ptr = &EG(error_zval);
				goto exit;
			}
			if (UNEXPECTED(!(zobj->ce->ce_flags & ZEND_ACC_ALLOW_DYNAMIC_PROPERTIES))) {
				if (UNEXPECTED(!zend_deprecated_dynamic_property(zobj, name))) {
					variable_ptr = &EG(error_zval);
					goto exit;
				}
			}

[TysonAndre]

To avoid Creation of dynamic property __PHP_Incomplete_Class::$dynamicProp is deprecated:

Looking at ext/standard/basic_functions.stub.php - __PHP_Incomplete_Class should also have #[AllowDynamicProperties], because unserialize() will create instances of that class and add dynamic properties to it when unserializing classes where definitions couldn't be found

[javaDeveloperKid]

Why are you pinging nikic in your PRs? Didn't he switch focus from PHP to LLMV?

[kocsismate]

I created #9354 for fixing the original, more general bug (#9186) as well as the dynamic property deprecation @TysonAndre mentioned here.

[kocsismate]

Fixed via adb45a6