Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:85873
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.192.171 as permitted sender)
Message-ID: <55342A50.9030100@gmail.com>
Date: Sun, 19 Apr 2015 15:21:04 -0700
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:31.0) Gecko/20100101 Thunderbird/31.6.0
MIME-Version: 1.0
To: Julien Pauli <jpauli@php.net>, Andrew Faulds <ajf@ajf.me>, 
 PHP Internals <internals@lists.php.net>
References: <CAMUwpuTZK=zqHcWG21DA5fUSODuq6njyx9+RUtQR0gQu02a5AQ@mail.gmail.com>
In-Reply-To: <CAMUwpuTZK=zqHcWG21DA5fUSODuq6njyx9+RUtQR0gQu02a5AQ@mail.gmail.com>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] Closure::call() to access private data, really ?
From: smalyshev@gmail.com (Stanislav Malyshev)

Hi!

> Just a simple use case showing how dangerous that is :
> 
> <?php
> $p = function($p) { $this->$p = new Stdclass; };
> $p->call($e = new Exception, 'trace');
> throw $e;

Yes, this is not good, and this is the consequence of allowing to rebind
closures. I'm not sure though how to fix it except for banning closures
from assuming scope of internal classes. If you assigned the scope of
Exception to it, it should have access to Exception - that's how the
scope works.

> For User classes, this could lead to information leaks or bad behaviors,

I'm not sure what you mean by "information leaks", but the behavior is
on whoever wrote that code. People can write bad code, we can't disallow
this. We can restrict things that would really break (like segfault) but
I'm not sure what else we can do here. If you have the scope of the
class, that implies access to the private members of the class. So we
either have to not let the closure have the scope, or invent some
additional term of scope' that is not like real scope. I don't think
it'd be good.

-- 
Stas Malyshev
smalyshev@gmail.com