SimpleIdentity: reading an undeclared property throws (BC break)

Until now __get() returned null for an unknown key and, because it returns
by reference, silently created that key in the data (and thus in the storage).
It now throws MemberAccessException, like any other Nette object.

This also ends the by-ref write pattern $identity->cart[] = $item on a key
that has not been set yet.

Author: dg

src/Security/SimpleIdentity.php

@@ -7,7 +7,8 @@
 
 namespace Nette\Security;
 
-use function ctype_digit, in_array, is_string, iterator_to_array;
+use Nette;
+use function array_key_exists, ctype_digit, in_array, is_string, iterator_to_array;
 
 
 /**
@@ -112,8 +113,11 @@ public function &__get(string $key): mixed
 			$res = $this->{'get' . ucfirst($key)}();
 			return $res;
 
-		} else {
+		} elseif (array_key_exists($key, $this->data)) {
 			return $this->data[$key];
+
+		} else {
+			Nette\Utils\ObjectHelpers::strictGet(static::class, $key);
 		}
 	}
 

tests/Security/SimpleIdentity.phpt

@@ -32,3 +32,16 @@ test('', function () {
 	$id = new SimpleIdentity('12345678901234567890');
 	Assert::same('12345678901234567890', $id->getId());
 });
+
+
+test('reading an undeclared data key throws and does not pollute data', function () {
+	$id = new SimpleIdentity(12, 'admin', ['name' => 'John', 'note' => null]);
+	Assert::null($id->note); // existing null value is readable
+
+	Assert::exception(
+		fn() => $id->undeclared,
+		Nette\MemberAccessException::class,
+		'Cannot read an undeclared property Nette\Security\SimpleIdentity::$undeclared.',
+	);
+	Assert::same(['name' => 'John', 'note' => null], $id->getData());
+});