Skip to content

array_column should not extract non-public properties from objects#5210

Open
janedbal wants to merge 3 commits intophpstan:2.1.xfrom
janedbal:array-column-visibility
Open

array_column should not extract non-public properties from objects#5210
janedbal wants to merge 3 commits intophpstan:2.1.xfrom
janedbal:array-column-visibility

Conversation

@janedbal
Copy link
Contributor

@janedbal janedbal force-pushed the array-column-visibility branch from f8df7cc to 4252b95 Compare March 12, 2026 13:03
@janedbal janedbal marked this pull request as ready for review March 12, 2026 14:38
@phpstan-bot
Copy link
Collaborator

This pull request has been marked as ready for review.

@staabm staabm requested a review from VincentLanglet March 12, 2026 14:42
@janedbal janedbal force-pushed the array-column-visibility branch from ae0ace2 to 4252b95 Compare March 16, 2026 13:30
PHP's array_column respects calling scope visibility. This change:
- Checks scope->canReadProperty() before including a property type
- When both __isset and __get are defined, treats inaccessible
  properties as maybe-accessible (returns generic array)
- For non-final classes, accounts for child classes that could
  override visibility: protected keeps its type (invariant in PHP),
  private becomes mixed (child can redeclare with any type)
- For final classes, inaccessible properties return empty array
- Handles NeverType in index position by falling back to integer keys

Fixes phpstan/phpstan#13573
@janedbal janedbal force-pushed the array-column-visibility branch from 4252b95 to acf44c2 Compare March 16, 2026 15:30
For non-final classes, a child class can widen visibility:
- protected: type is preserved (invariant in PHP), treat as maybe
- private: child can redeclare with any type, treat as mixed

For final classes, non-accessible properties return empty array.

Add implicit final test for new expression (asFinal via NewHandler).
@Final is just a PHPDoc convention with no runtime enforcement,
so a child class can still extend and override property visibility.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants