Skip to content

compat: add #[AllowDynamicProperties] to ezcBaseStruct and ezcBaseOptions for PHP 8.2+#17

Open
se7enxweb wants to merge 1 commit into
zetacomponents:masterfrom
se7enxweb:security/fix-dynamic-properties
Open

compat: add #[AllowDynamicProperties] to ezcBaseStruct and ezcBaseOptions for PHP 8.2+#17
se7enxweb wants to merge 1 commit into
zetacomponents:masterfrom
se7enxweb:security/fix-dynamic-properties

Conversation

@se7enxweb
Copy link
Copy Markdown

Reported-by: CJW Network security audit 2026-03-01

Problem

PHP 8.2 deprecated dynamic (undeclared) properties; PHP 9 removes them. ezcBaseStruct and ezcBaseOptions rely on dynamic property assignment via magic __set()/__get() but do not declare properties explicitly. Without the #[AllowDynamicProperties] attribute, PHP 8.2+ emits deprecation notices on every property access on these base classes (and any subclass that stores data in undeclared properties), and PHP 9 will raise ErrorException.

Changes

  • src/struct.php: Add #[AllowDynamicProperties] before class ezcBaseStruct
  • src/options.php: Add #[AllowDynamicProperties] before abstract class ezcBaseOptions

The attribute is available since PHP 8.2 and silently ignored by older versions.

…ions

PHP 8.2 deprecated dynamic (undeclared) properties and PHP 9 will remove
them. Many eZ Components structs rely on dynamic property assignment
because ezcBaseStruct and ezcBaseOptions use magic __set()/__get() but
do not declare the properties explicitly.

Without this attribute, PHP 8.2+ emits deprecation notices and PHP 9+
raises ErrorException for every property access on these base classes,
breaking large portions of the component suite.

#[AllowDynamicProperties] is the correct BC shim:
- Available since PHP 8.2
- Ignored by PHP < 8.2 (parsed as a no-op on older versions)
- Signals that the class intentionally uses dynamic properties

Affected classes:
- ezcBaseStruct   (src/struct.php)
- ezcBaseOptions  (src/options.php)

Reported-by: CJW Network security audit 2026-03-01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant