This is correct: getDefaultValue() cannot produce object, as it goes against the basic invariant of roave/better-reflection not loading any of the code being analyzed.

@janedbal it can be “fixed” in https://github.com/ondrejmirtes/BetterReflection

Certainly, but the basic invariant here is "don't load code", so that will certainly not happen here.

Also for the fork, loading runtime code could even be categorized as a security issue, from my point of view: instead of loading the code, load the AST for it instead.

If it cannot be fixed, which I understand, could it at least throw better exception in such cases?

@JanTvrdik what's the current exception you get? We generally have quite specific exception types.

Is it this one, perhaps?

https://github.com/Roave/BetterReflection/blob/ce6a9a27c746fbd45d5a6603ba24e7d4a1f3b0f7/src/NodeCompiler/CompileNodeToValue.php#LL132C35-L132C35

Another alternative that comes to mind is having BetterReflection operating in "unsafe mode": something like new Reflector($yesIReallyWantToExposeMyselfToRCEAttacksWhileInspectingForeignCodebases = true)

Maybe worth updating Compatibility page with this issue? ReflectionAttribute is missing there completely.

@Ocramius It's actually https://github.com/Roave/BetterReflection/blob/6.11.x/src/NodeCompiler/CompileNodeToValue.php#L250, because the "enum case fetch" is represented as ClassConstFetch in AST. So instead of "constant not found" error I would expect "enum values are unsupported" error.

@janedbal please do send a patch :-)

@JanTvrdik is it possible to have a test with a better message expectation, perhaps? That would certainly improve the DX a lot :)