Symfony version(s) affected

5.4.41 and later (5.4.42 is latest ATM):

Description

Introduced in 5.4.41, the ObjectNormalizer do not take scope of get functions properly. Protected properties will be attempt fetched but not included in the exported data anyway

How to reproduce

The following code will work on 5.4.40 and earlier. Inline comment describes what happens when it fails in 5.4.41 and later :

class SomeData
{
    protected string $data;

    public function __construct(string $data)
    {
        $this->data = $data;
    }

    protected function getSomethingProtected(): array
    {
        return "protected";
    }

    public function __get($property)
    {
        if (property_exists($this, $property)) {
            return $this->$property;
        }
        throw new \Exception("Unknown property $property"); // <------- Since v5.4.41 it will fail here because getSomethingProtected() has protected scope
    }

    public function getData(): string
    {
        return $this->data;
    }
}

        $someData = new SomeData('foobar');
        $jsonContent = $this->serializer->serialize($someData, 'json');

If I change __get() to anyway return the property somethingProtected instead of throwing an exception, it will anyway not be included in the serialized data (which is correct and inline with previous versions )

Possible Solution

Problem was introduced by #57187
The change in Normalizer/ObjectNormalizer.php in symfony/serializer@296df0c is causing the problem

Additional Context

FYI : #58012 seems to be related