magic methods: HTML-encode caller-supplied names in error messages

__get(), __call(), and __callStatic() interpolated the property or method name
into their error text raw. Dynamic names can carry request data
($col = $_GET['sort']; $row->title->$col), and error handlers often echo
messages into pages, so an unknown name like <script>...</script> reached the
handler as a live tag. All three now encode the name first, same as orThrow()
and orDie(); real names contain nothing to encode, so legitimate errors read
the same as before.

Author: daveedis

CHANGELOG.md

@@ -129,6 +129,10 @@ These still work, they're just no longer featured in the docs - no changes requi
   `&` in the Location header. A `SmartNull` argument counts as null
   (`new()` previously stored `""`, so `isNull()` reported a missing field as
   present)
+- The "Undefined property" and "Call to undefined method" error messages
+  HTML-encode the caller-supplied name, matching `orThrow()` and `orDie()` -
+  dynamic names can carry request data (`$row->title->$_GET['sort']`), and
+  error handlers often echo messages into pages
 - `pregReplace()` returns null when the value causes a PCRE runtime failure
   (backtrack, recursion, or JIT stack limits on long values), so `->or()`
   fallbacks fire - previously only bad UTF-8 returned null and everything else

src/SmartString.php

@@ -1136,6 +1136,10 @@ public function getIterator(): Iterator
      */
     public function __get(string $property): SmartString
     {
+        // SECURITY: encode the caller-supplied name - error handlers often echo messages into pages (see orThrow).
+        // Real method names encode to themselves, so the method_exists branch below is unaffected.
+        $property = htmlspecialchars($property, self::HTML_ENCODE_FLAGS, 'UTF-8');
+
         // throw unknown property warning
         // PHP Default Error: Warning: Undefined property: stdClass::$property in /path/to/template.php on line 28
         if (method_exists($this, $property)) {
@@ -1231,6 +1235,7 @@ public function __call($method, $args): string|int|bool|null|float|SmartString
 
         // throw unknown method Error
         // PHP Default Error: Fatal error: Uncaught Error: Call to undefined method SmartString::method() in /path/to/template.php:17
+        $method     = htmlspecialchars($method, self::HTML_ENCODE_FLAGS, 'UTF-8'); // SECURITY: encode the caller-supplied name - exception handlers often echo messages into pages (see orThrow)
         $suggestion ??= "see the SmartString docs for available methods.";
         $class      = self::stripNamespace(self::class);
         $error      = "Call to undefined method $class->$method(), $suggestion\n" . self::occurredInFile();
@@ -1258,6 +1263,7 @@ public static function __callStatic($method, $args): mixed
 
         // throw unknown method Error
         // PHP Default Error: Fatal error: Uncaught Error: Call to undefined method SmartString::method() in /path/to/template.php:17
+        $method    = htmlspecialchars($method, self::HTML_ENCODE_FLAGS, 'UTF-8'); // SECURITY: encode the caller-supplied name - exception handlers often echo messages into pages (see orThrow)
         $baseClass = self::stripNamespace(self::class);
         $error     = "Call to undefined method $baseClass::$method(), see the SmartString docs for available methods.\n";
         $error     .= self::occurredInFile();

tests/Unit/MagicMethodsTest.php

@@ -46,6 +46,19 @@ public function testGetWarnsOnUnknownProperty(): void
         $this->assertSmartString(null, $result);
     }
 
+    public function testGetEncodesAttackerSuppliedPropertyName(): void
+    {
+        // SECURITY: dynamic property names can carry request data
+        // ($col = $_GET['sort']; $row->title->$col) and error handlers often
+        // echo messages into pages, so the name must arrive encoded
+        $property = '<script>alert(1)</script>';
+        $result   = $this->expectUserWarning(
+            fn() => SmartString::new('x')->$property,
+            "Undefined property: SmartString->&lt;script&gt;alert(1)&lt;/script&gt;\n"
+        );
+        $this->assertSmartString(null, $result);
+    }
+
     public function testGetInterpolatesAsEmptyStringAfterWarning(): void
     {
         // "$str->htmlEncode" in a string triggers __get, which returns
@@ -205,6 +218,17 @@ public function testUnknownMethodNameWithPercentReportsCleanly(): void
         );
     }
 
+    public function testUnknownMethodEncodesAttackerSuppliedName(): void
+    {
+        // SECURITY: same rule as __get() - exception handlers often echo
+        // messages into pages, so the name must arrive encoded
+        $method = '<script>alert(1)</script>';
+        $this->assertUndefinedMethodError(
+            "Call to undefined method SmartString->&lt;script&gt;alert(1)&lt;/script&gt;(), see the SmartString docs for available methods.\n",
+            fn() => SmartString::new('x')->$method()
+        );
+    }
+
     //endregion
     //region __callStatic()
 
@@ -235,6 +259,17 @@ public function testUnknownStaticMethodPointsToDocs(): void
         );
     }
 
+    public function testUnknownStaticMethodEncodesAttackerSuppliedName(): void
+    {
+        // SECURITY: same rule as __get() - exception handlers often echo
+        // messages into pages, so the name must arrive encoded
+        $method = '<script>alert(1)</script>';
+        $this->assertUndefinedMethodError(
+            "Call to undefined method SmartString::&lt;script&gt;alert(1)&lt;/script&gt;(), see the SmartString docs for available methods.\n",
+            fn() => SmartString::$method()
+        );
+    }
+
     //endregion
     //region __debugInfo()