src: deprecated bracket offsets throw on unsupported types

The deprecation notice encoded string offsets but stringified objects
after the encode guard, so a Stringable offset's text reached 'notify'
output raw. Now getRawValue() unwraps Smart* offsets so they display
like plain keys, and any other object or array throws before the
notice prints - they were never valid offsets, the lookup itself only
takes int|string.

Author: daveedis

src/Deprecations.php

@@ -564,7 +564,13 @@ public static function triggerArrayAccessDeprecation(mixed $key, string $operati
     {
         // SECURITY: the key can be user input (e.g. $arr[$_GET['sort']]) and 'notify' mode echoes
         // the message into the page, so encode it. $key is display-only from here on; the actual
-        // data access already happened with the original key.
+        // data access already happened with the original key. Unwrap Smart* offsets so they
+        // display like plain keys; everything else (Stringables, arrays) was never a valid
+        // offset, so throw before any of it can reach the page.
+        $key = self::getRawValue($key); // throws on unsupported objects
+        if (!is_scalar($key) && $key !== null) {
+            throw new InvalidArgumentException("Unsupported array offset type: " . get_debug_type($key));
+        }
         if (is_string($key)) {
             $key = self::htmlEncode($key);
         }

tests/Unit/ReadAccessTest.php

@@ -389,6 +389,47 @@ public function testOffsetGetMissingKeyWarnsAfterTheDeprecationNotice(string $cl
         $this->assertCount(1, $deprecations);
     }
 
+    #[DataProvider('modeProvider')]
+    public function testOffsetGetRejectsUnsupportedOffsetTypesBeforeAnyOutput(string $class): void
+    {
+        // The notice echoes the offset in 'notify' mode, so unsupported types
+        // (whose text the library doesn't control) must throw before printing
+        $sa         = $class::new(['name' => 'Bob']);
+        $stringable = new class {
+            public function __toString(): string
+            {
+                return '<img src=x onerror=alert(1)>';
+            }
+        };
+
+        foreach ([$stringable, ['name']] as $badOffset) {
+            [$caught, $output] = $this->captureOutput(function () use ($sa, $badOffset) {
+                try {
+                    return [$sa[$badOffset], null];
+                } catch (InvalidArgumentException $e) {
+                    return [null, $e];
+                }
+            });
+            [, $e] = $caught;
+            $this->assertInstanceOf(InvalidArgumentException::class, $e);
+            $this->assertStringContainsString('Unsupported', $e->getMessage());
+            $this->assertStringNotContainsString('onerror', $e->getMessage());
+            $this->assertSame('', $output, 'nothing printed before the throw');
+        }
+
+        // SmartNull's own ArrayAccess methods dispatch through the same rules
+        [$caught, $output] = $this->captureOutput(function () use ($sa, $stringable) {
+            try {
+                return [$sa->missing[$stringable], null];
+            } catch (InvalidArgumentException $e) {
+                return [null, $e];
+            }
+        });
+        [, $e] = $caught;
+        $this->assertInstanceOf(InvalidArgumentException::class, $e);
+        $this->assertStringNotContainsString('onerror', $output, 'missing-key warning may print, but never the offset text');
+    }
+
     //endregion
     //region __isset / offsetExists
 

tests/Unit/WriteAccessTest.php

@@ -247,6 +247,46 @@ public function testUnsetArraySyntaxRemovesKeyAndNotifiesDeprecation(string $cla
         $this->assertCount(1, $deprecations);
     }
 
+    #[DataProvider('modeProvider')]
+    public function testOffsetSetAndUnsetRejectUnsupportedOffsetTypesBeforeAnyOutput(string $class): void
+    {
+        // The notice echoes the offset in 'notify' mode, so unsupported types
+        // (whose text the library doesn't control) must throw before printing
+        $sa         = $class::new(['name' => 'Bob']);
+        $stringable = new class {
+            public function __toString(): string
+            {
+                return '<img src=x onerror=alert(1)>';
+            }
+        };
+
+        [$e, $output] = $this->captureOutput(function () use ($sa, $stringable) {
+            try {
+                $sa[$stringable] = 'x';
+            } catch (InvalidArgumentException $e) {
+                return $e;
+            }
+            return null;
+        });
+        $this->assertInstanceOf(InvalidArgumentException::class, $e, 'set must throw');
+        $this->assertStringNotContainsString('onerror', $e->getMessage());
+        $this->assertSame('', $output, 'nothing printed before the set throw');
+
+        [$e, $output] = $this->captureOutput(function () use ($sa, $stringable) {
+            try {
+                unset($sa[$stringable]);
+            } catch (InvalidArgumentException $e) {
+                return $e;
+            }
+            return null;
+        });
+        $this->assertInstanceOf(InvalidArgumentException::class, $e, 'unset must throw');
+        $this->assertStringNotContainsString('onerror', $e->getMessage());
+        $this->assertSame('', $output, 'nothing printed before the unset throw');
+
+        $this->assertSame(['name' => 'Bob'], $sa->toArray(), 'collection unchanged');
+    }
+
     //endregion
     //region Position metadata on late writes