Skip to content

Detecting thenable causes unwanted side effects #160

@s-bronstein

Description

@s-bronstein

In CancellationQueue this condition:

        if (!\method_exists($cancellable, 'then') || !\method_exists($cancellable, 'cancel')) {
            return;
        }

Somehow, it does not only work if $thenable is an object. If it is a string, and the contents of the string can be resolved to a class in the global namespace, and the class has these methods it can lead to unwanted behavior.

I highly doubt it was intended to work like that, I think the intention was only to check if an object instance $cancellable has these methods.

I suggest to add check to ensure $cancellable is not a primitive before checking method_exists, like that:

        if (!is_object($cancellable) || !\method_exists($cancellable, 'then') || !\method_exists($cancellable, 'cancel')) {
            return;
        }

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions