DDC-1598: ProxyFactory makes assumptions on identifier getter code #2003

Open
opened 2026-01-22 13:37:16 +01:00 by admin · 0 comments
Owner

Originally created by @doctrinebot on GitHub (Jan 13, 2012).

Originally assigned to: @beberlei on GitHub.

Jira issue originally created by user @ocramius:

As of
https://github.com/doctrine/doctrine2/blob/master/lib/Doctrine/ORM/Proxy/ProxyFactory.php#L214
and
https://github.com/doctrine/doctrine2/blob/master/lib/Doctrine/ORM/Proxy/ProxyFactory.php#L237
the current ProxyFactory isn't actually checking if the identifier getter has logic in it.
Current checks aren't enough/valid.

In my opinion the check should be matching following:

(public|protected)\sfunction\sgetFieldname\s**(\s_)\s+{\s_$this\s_->Fieldname\s_;\s**}

Not really experienced with regex, but currently cannot come up with a more secure check.

Originally created by @doctrinebot on GitHub (Jan 13, 2012). Originally assigned to: @beberlei on GitHub. Jira issue originally created by user @ocramius: As of https://github.com/doctrine/doctrine2/blob/master/lib/Doctrine/ORM/Proxy/ProxyFactory.php#L214 and https://github.com/doctrine/doctrine2/blob/master/lib/Doctrine/ORM/Proxy/ProxyFactory.php#L237 the current ProxyFactory isn't actually checking if the identifier getter has logic in it. Current checks aren't enough/valid. In my opinion the check should be matching following: (public|protected)\s<ins>function\s</ins>getFieldname\s**(\s_)\s+{\s_\$this\s_->Fieldname\s_;\s**} Not really experienced with regex, but currently cannot come up with a more secure check.
admin added the Bug label 2026-01-22 13:37:16 +01:00
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: doctrine/archived-orm#2003