From cfefc6f6b23e3795dbbdc9ae2fac3bb1b8b44f8d Mon Sep 17 00:00:00 2001
From: Alejandro Borrego <210245044+abp002@users.noreply.github.com>
Date: Wed, 14 Oct 2026 20:29:27 +0200
Subject: [PATCH] Fix reading an attribute through its getter initializing a
 lazy object when the property is not public

---
 CHANGELOG                       |  1 +
 src/Extension/CoreExtension.php | 15 ++++++---
 tests/TemplateTest.php          | 60 +++++++++++++++++++++++++++++++++
 3 files changed, 72 insertions(+), 4 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index e4ca7f044..c3e64396d 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,5 +1,6 @@
 # 3.31.0 (2026-XX-XX)
 
+ * Fix reading an attribute through its getter initializing a lazy object when the property is not public
  * Fix compiled float literals depending on the `serialize_precision` ini setting
  * Fix the `loop` variable being undefined when used in the sequence of a nested `for` tag
  * Reject a deprecated `Template` instance created by another environment in `Environment::resolveTemplate()`
diff --git a/src/Extension/CoreExtension.php b/src/Extension/CoreExtension.php
index 16a8105e5..71a4be2d4 100644
--- a/src/Extension/CoreExtension.php
+++ b/src/Extension/CoreExtension.php
@@ -1866,8 +1866,10 @@ final class CoreExtension extends AbstractExtension
 
             static $propertyCheckers = [];
 
-            if (isset($object->$item)
-                || (($propertyChecker = $propertyCheckers[$object::class][$item] ??= self::getPropertyChecker($object::class, $item)) && $propertyChecker($object, $item))
+            $propertyChecker = $propertyCheckers[$object::class][$item] ??= self::getPropertyChecker($object::class, $item);
+
+            if (false !== $propertyChecker
+                && (isset($object->$item) || ($propertyChecker instanceof \Closure && $propertyChecker($object, $item)))
             ) {
                 if ($isDefinedTest) {
                     return true;
@@ -2268,7 +2270,11 @@ final class CoreExtension extends AbstractExtension
         return new GetAttrExpression($args[0], $args[1], $args[2] ?? null, Template::ANY_CALL, $line);
     }
 
-    private static function getPropertyChecker(string $class, string $property): \Closure|false
+    /**
+     * @return \Closure|bool A closure checking that the property is initialized, true to only rely on isset(),
+     *                       or false when the property cannot be read from outside the object
+     */
+    private static function getPropertyChecker(string $class, string $property): \Closure|bool
     {
         static $classReflectors = [];
 
@@ -2283,7 +2289,8 @@ final class CoreExtension extends AbstractExtension
         $property = $class->getProperty($property);
 
         if (!$property->isPublic() || $property->isStatic()) {
-            return false;
+            // isset() on an inaccessible property can only be true through __isset()
+            return $class->hasMethod('__isset');
         }
 
         return static fn ($object) => $property->isInitialized($object);
diff --git a/tests/TemplateTest.php b/tests/TemplateTest.php
index f8e12324b..3c1f226df 100644
--- a/tests/TemplateTest.php
+++ b/tests/TemplateTest.php
@@ -813,6 +813,66 @@ class TemplateTest extends TestCase
             $this->assertFalse(CoreExtension::getAttribute($twig, $source, $object, 'secret', [], Template::ANY_CALL, true));
         }
     }
+
+    public function testGetAttributeOnLazyGhostWithPrivatePropertyCallsTheGetterWithoutInitializingIt(): void
+    {
+        if (\PHP_VERSION_ID < 80400) {
+            $this->markTestSkipped('Lazy objects require PHP 8.4.');
+        }
+
+        $twig = new Environment(new ArrayLoader(), ['strict_variables' => true]);
+        $source = new Source('', 'index.twig');
+
+        // like a partial Doctrine entity: only some properties are loaded
+        $reflector = new \ReflectionClass(TemplatePartiallyLoadedObject::class);
+        $object = $reflector->newLazyGhost(static function () {
+            throw new \LogicException('The lazy object should not be initialized.');
+        });
+        $reflector->getProperty('title')->setRawValueWithoutLazyInitialization($object, 'Title');
+
+        $this->assertSame('Title', CoreExtension::getAttribute($twig, $source, $object, 'title'));
+        $this->assertTrue(CoreExtension::getAttribute($twig, $source, $object, 'title', [], Template::ANY_CALL, true));
+        $this->assertTrue($reflector->isUninitializedLazyObject($object));
+    }
+
+    public function testGetAttributeOnPrivatePropertyStillUsesMagicIsset(): void
+    {
+        $twig = new Environment(new ArrayLoader(), ['strict_variables' => true]);
+        $source = new Source('', 'index.twig');
+
+        $this->assertSame('magic', CoreExtension::getAttribute($twig, $source, new TemplateMagicPrivatePropertyObject(), 'title'));
+    }
+}
+
+class TemplatePartiallyLoadedObject
+{
+    private $title;
+    private $description;
+
+    public function getTitle()
+    {
+        return $this->title;
+    }
+
+    public function getDescription()
+    {
+        return $this->description;
+    }
+}
+
+class TemplateMagicPrivatePropertyObject
+{
+    private $title = 'private';
+
+    public function __isset($name): bool
+    {
+        return 'title' === $name;
+    }
+
+    public function __get($name)
+    {
+        return 'title' === $name ? 'magic' : null;
+    }
 }
 
 class TemplateAttributeResolution