79535897

Date: 2025-03-26 09:20:15
Score: 0.5
Natty:
Report link

This is a very old threat but it is very useful today, and this should go as a comment to @MAChitgarha answer, but I can't write one, and I think it is important to add. For some might not be so obvious.

If you are inside a Namespace and you are trying one of his methods like:

// Dynamic method call on a dynamically-generated object
(<object>)->{<method_name>}(arguments);
(<object>)::{<method_name>}(arguments);

And you get an error message saying 'Class not found', it is because you MUST specify the Namespace. So you should do something like:

// Specify the Namespace with '\\' instead of '\':
('COOL\\NAMEPSACE\\'. $object)->{$method_name}(arguments); // non-static
// Or by using the __NAMESPACE__ constant:
(__NAMESPACE__ .'\\'. $object)->{$method_name}(arguments); // non-static

// It is the same for static object:
('COOL\\NAMEPSACE\\'. $object)::{$method_name}(arguments); // static
(__NAMESPACE__ .'\\'. $object)::{$method_name}(arguments); // static

You would usually just use:

COOL\NAMEPSACE\object->method_name(arguments); // non-static
COOL\NAMEPSACE\object::method_name(arguments); // static
// Notice the usage of '\' instead of '\\':

// Or if you are inside the Namespace you would simply skip the Namespace:
object->method_name(arguments); // non-static
object::method_name(arguments); // static
// And PHP applies the Namespace for you, but when using dynamic generated classes you MUST specify the Namespace

@Jivan gives a hint to this in his answer:

// if hello() is in the current namespace
call_user_func(__NAMESPACE__.'\\'.$myvar);

// if hello() is in another namespace
call_user_func('mynamespace\\'.$myvar);

But it might not be obvious at first sight.

All credit to original authors of the answer, I just wanted to point out the detail.

Reasons:
  • Long answer (-1):
  • Has code block (-0.5):
  • User mentioned (1): @answer
  • Low reputation (1):
Posted by: Cristian Dan Fechete