BUG: Classes are proxied even if they are not target of AOP aspects

[bwaidelich]

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

Given some class SomeDto with a private constructor:
After a full cache flush, a proxy class is generated even though the class is not actually target of AOP.

When changing the code to trigger a partial cache refresh (in Dev Context) the proxy class is being removed

Expected Behavior

The proxy class should either always or never be created – in this case never :)

Also, the created proxy code is broken cause it contains:

parent::__construct(...$arguments);

(related issue: #3059)

Steps To Reproduce

Create a class

namespace Wwwision\AopTest;

final class SomeDto
{
    private function __construct(
        public readonly string $value,
    ) {}

    public static function fromString(string $value): self {
        return new self($value);
    }
}

and a Policy.yaml with:

privilegeTargets:
  'Neos\Flow\Security\Authorization\Privilege\Method\MethodPrivilege':
    'Wwwision.AopTest:Test':
      matcher: method(Wwwision\AopTest\SomeDto->fromString())

the same is true for

```yaml
privilegeTargets:
  'Neos\Flow\Security\Authorization\Privilege\Method\MethodPrivilege':
    'Wwwision.AopTest:Test':
      matcher: method(Wwwision\AopTest\SomeDto->nonExistingMethod())

Environment

- Flow: 9.0

Anything else?

No response

[mhsdesign]

Sorry i dont understand ...

the class is not actually target of AOP.

... but it is? Your Wwwision.AopTest:Test is aop ... im missing something here i think ^^

[bwaidelich]

It seems like static methods cannot be intercepted.
The behavior is the same if the method does not exist at all

[kitsunet]

We actually never check here \Neos\Flow\Aop\Pointcut\PointcutMethodNameFilter::matches if the method actually exists and if it's static. All the calls to the ReflectionService could go by without a problem despite the method not existing. (getMethodParameters returns empty array in that case)