Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:100222
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmx.de designates 212.227.15.18 as permitted sender)
To: Nikita Popov <nikita.ppv@gmail.com>,
 Stanislav Malyshev <smalyshev@gmail.com>
Cc: PHP internals <internals@lists.php.net>
References: <CAF+90c9-irX2gCu_858nQwQ-ARshwbV_8mtNAN-UMBgSvXVp0w@mail.gmail.com>
 <f59a0ba5-228b-88ed-bb99-d296684726c1@gmail.com>
 <CAF+90c_RUYwFgXK6rYvspvm1w+MUaeimRVzMJzHyWVj_t3oYXA@mail.gmail.com>
 <CAF+90c-PumhFT0spXrLfEDZ-R3pY+HRAnuX+2m_aOu=RJ6qOJQ@mail.gmail.com>
Message-ID: <33a61a5b-11a5-690e-d98c-86b101376be5@gmx.de>
Date: Tue, 15 Aug 2017 23:56:44 +0200
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101
 Thunderbird/52.2.1
MIME-Version: 1.0
In-Reply-To: <CAF+90c-PumhFT0spXrLfEDZ-R3pY+HRAnuX+2m_aOu=RJ6qOJQ@mail.gmail.com>
Content-Type: text/plain; charset=utf-8
Content-Language: de-DE
Content-Transfer-Encoding: 8bit
Subject: Re: [PHP-DEV] Unserialize security policy
From: cmbecker69@gmx.de ("Christoph M. Becker")

On 11.08.2017 at 12:55, Nikita Popov wrote:

> I think it might also be useful to make a distinction based on
> allowed_classes here. I think there is a reasonable expectation that if
> allowed_classes is empty (and as such any object injection vectors are
> excluded), unserialize() should be safe. The vast majority of unserialize()
> bugs are variants on the theme of __wakeup() and
> Serializable::unserialize(). But there are also bugs that apply with
> allowed_classes=>[], for example https://bugs.php.net/bug.php?id=75054.

What about references?  Consider, for instance, the following code:

    <?php

    $_POST['untrusted_input'] = 'a:1:{i:0;a:1:{i:0;R:2;}}';

    function flatten($array)
    {
        if (is_array($array)) {
            $result = [];
            foreach ($array as $element) {
                $result = array_merge($result, flatten($element));
            }
            return $result;
        }
        return [$array];
    }

    $unserializedInput = unserialize($_POST['untrusted_input'], []);
    flatten($unserializedInput);

Of course, the `flatten()` function is naive, but it is fine for any
"normal" input.  However, this very code has a DOS issue.  Do we really
want to say that it is the developers responsibility to check for
infinite recursion for code that uses the result of `unserialize(…, [])`
in this way?

It appears to me that `unserialize()` cannot ever be safe, unless class
instantiation *and* references can be excluded.  (Neither of these
"features" are available in JSON or (supposed to be) in WDDX, by the
way.)  While the former is possible, the latter is not (yet), so in my
humble opinion we should not try to claim that `unserialize(…, [])` is
safe, at least unless there is a mechanism to disallow unserializing of
references, too.

-- 
Christoph M. Becker