[PropertyInfo] restrict access to PhpStanExtractor based on visibility

nikophil · nikophil · commit fc8e374e6d21 · 2024-01-02T18:30:03.000+01:00
diff --git a/src/Symfony/Component/PropertyInfo/CHANGELOG.md b/src/Symfony/Component/PropertyInfo/CHANGELOG.md
@@ -5,6 +5,7 @@ CHANGELOG
 ---
 
  * Introduce `PropertyDocBlockExtractorInterface` to extract a property's doc block
+ * Restrict access to `PhpStanExtractor` based on visibility
 
 6.4
 ---
diff --git a/src/Symfony/Component/PropertyInfo/Extractor/PhpStanExtractor.php b/src/Symfony/Component/PropertyInfo/Extractor/PhpStanExtractor.php
@@ -47,13 +47,14 @@ final class PhpStanExtractor implements PropertyTypeExtractorInterface, Construc
     private array $mutatorPrefixes;
     private array $accessorPrefixes;
     private array $arrayMutatorPrefixes;
+    private bool $allowPrivateAccess;
 
     /**
      * @param list<string>|null $mutatorPrefixes
      * @param list<string>|null $accessorPrefixes
      * @param list<string>|null $arrayMutatorPrefixes
      */
-    public function __construct(array $mutatorPrefixes = null, array $accessorPrefixes = null, array $arrayMutatorPrefixes = null)
+    public function __construct(array $mutatorPrefixes = null, array $accessorPrefixes = null, array $arrayMutatorPrefixes = null, bool $allowPrivateAccess = true)
     {
         if (!class_exists(ContextFactory::class)) {
             throw new \LogicException(sprintf('Unable to use the "%s" class as the "phpdocumentor/type-resolver" package is not installed. Try running composer require "phpdocumentor/type-resolver".', __CLASS__));
@@ -67,6 +68,7 @@ public function __construct(array $mutatorPrefixes = null, array $accessorPrefix
         $this->mutatorPrefixes = $mutatorPrefixes ?? ReflectionExtractor::$defaultMutatorPrefixes;
         $this->accessorPrefixes = $accessorPrefixes ?? ReflectionExtractor::$defaultAccessorPrefixes;
         $this->arrayMutatorPrefixes = $arrayMutatorPrefixes ?? ReflectionExtractor::$defaultArrayMutatorPrefixes;
+        $this->allowPrivateAccess = $allowPrivateAccess;
 
         $this->phpDocParser = new PhpDocParser(new TypeParser(new ConstExprParser()), new ConstExprParser());
         $this->lexer = new Lexer();
@@ -232,6 +234,10 @@ private function getDocBlockFromProperty(string $class, string $property): ?arra
             return null;
         }
 
+        if (!$this->canAccessMemberBasedOnItsVisibility($reflectionProperty)) {
+            return null;
+        }
+
         // Type can be inside property docblock as `@var`
         $rawDocNode = $reflectionProperty->getDocComment();
         $phpDocNode = $rawDocNode ? $this->getPhpDocNode($rawDocNode) : null;
@@ -274,8 +280,11 @@ private function getDocBlockFromMethod(string $class, string $ucFirstProperty, i
                 }
 
                 if (
-                    (self::ACCESSOR === $type && 0 === $reflectionMethod->getNumberOfRequiredParameters())
-                    || (self::MUTATOR === $type && $reflectionMethod->getNumberOfParameters() >= 1)
+                    $this->canAccessMemberBasedOnItsVisibility($reflectionMethod)
+                    && (
+                        (self::ACCESSOR === $type && 0 === $reflectionMethod->getNumberOfRequiredParameters())
+                        || (self::MUTATOR === $type && $reflectionMethod->getNumberOfParameters() >= 1)
+                    )
                 ) {
                     break;
                 }
@@ -305,4 +314,9 @@ private function getPhpDocNode(string $rawDocNode): PhpDocNode
 
         return $phpDocNode;
     }
+
+    public function canAccessMemberBasedOnItsVisibility(\ReflectionProperty|\ReflectionMethod $member): bool
+    {
+        return $member->isPublic() || $this->allowPrivateAccess;
+    }
 }
diff --git a/src/Symfony/Component/PropertyInfo/Tests/Extractor/PhpStanExtractorTest.php b/src/Symfony/Component/PropertyInfo/Tests/Extractor/PhpStanExtractorTest.php
@@ -17,6 +17,7 @@
 use Symfony\Component\PropertyInfo\Tests\Fixtures\ConstructorDummyWithoutDocBlock;
 use Symfony\Component\PropertyInfo\Tests\Fixtures\DefaultValue;
 use Symfony\Component\PropertyInfo\Tests\Fixtures\Dummy;
+use Symfony\Component\PropertyInfo\Tests\Fixtures\DummyPropertyAndGetterWithDifferentTypes;
 use Symfony\Component\PropertyInfo\Tests\Fixtures\ParentDummy;
 use Symfony\Component\PropertyInfo\Tests\Fixtures\Php80Dummy;
 use Symfony\Component\PropertyInfo\Tests\Fixtures\Php80PromotedDummy;
@@ -475,6 +476,26 @@ public static function php80TypesProvider()
             [Php80PromotedDummy::class, 'promoted', null],
         ];
     }
+
+    public static function allowPrivateAccessProvider(): array
+    {
+        return [
+            [true, [new Type(Type::BUILTIN_TYPE_STRING)]],
+            [false, [new Type(Type::BUILTIN_TYPE_ARRAY, collection: true, collectionKeyType: new Type('int'), collectionValueType: new Type('string'))]],
+        ];
+    }
+
+    /**
+     * @dataProvider allowPrivateAccessProvider
+     */
+    public function testAllowPrivateAccess(bool $allowPrivateAccess, array $expectedTypes)
+    {
+        $extractor = new PhpStanExtractor(allowPrivateAccess: $allowPrivateAccess);
+        $this->assertEquals(
+            $expectedTypes,
+            $extractor->getTypes(DummyPropertyAndGetterWithDifferentTypes::class, 'foo')
+        );
+    }
 }
 
 class PhpStanOmittedParamTagTypeDocBlock
diff --git a/src/Symfony/Component/PropertyInfo/Tests/Fixtures/DummyPropertyAndGetterWithDifferentTypes.php b/src/Symfony/Component/PropertyInfo/Tests/Fixtures/DummyPropertyAndGetterWithDifferentTypes.php
@@ -0,0 +1,25 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Symfony\Component\PropertyInfo\Tests\Fixtures;
+
+final readonly class DummyPropertyAndGetterWithDifferentTypes
+{
+    public function __construct(
+        /**
+         * @var string
+         */
+        private string $foo
+    )
+    {
+    }
+
+    /**
+     * @return array<int, string>
+     */
+    public function getFoo(): array
+    {
+        return (array) $this->foo;
+    }
+}
