Set For Attributes Get

ID

php.set_for_attributes_get

Severity

low

Remediation Complexity

trivial

Remediation Risk

low

Remediation Effort

low

Resource

Reliability

Language

Php

Tags

best-practice, reliability

Description

Reports a class that declares the property-overloading magic method set without the matching get.

Rationale

A class that intercepts writes to virtual properties through set but offers no get exposes a write-only object: the data written can never be read back through normal property access. That asymmetry is almost always an oversight and leads to silent data loss. The converse — a get without set — is not reported: a read-only magic accessor is a common, intentional design (read-only value objects, immutable DTOs, configuration and proxy objects), and there is no reliable way to distinguish an intended read-only object from one merely missing its writer.

<?php
class OnlySetter
{
    private array $data = [];

    public function __set($name, $value) // FLAW — __set declared without __get
    {
        $this->data[$name] = $value;
    }
}

class ReadOnlyProxy
{
    private array $data = [];

    public function __get($name)         // OK — read-only magic accessor is intentional
    {
        return $this->data[$name] ?? null;
    }
}

Remediation

Add a get so the overloaded properties can be read back, or remove set if the object is meant to be immutable.

References