Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:100223
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmx.de designates 212.227.15.18 as permitted sender)
To: Nikita Popov <nikita.ppv@gmail.com>,
 Stanislav Malyshev <smalyshev@gmail.com>
Cc: PHP internals <internals@lists.php.net>
References: <CAF+90c9-irX2gCu_858nQwQ-ARshwbV_8mtNAN-UMBgSvXVp0w@mail.gmail.com>
 <f59a0ba5-228b-88ed-bb99-d296684726c1@gmail.com>
 <CAF+90c_RUYwFgXK6rYvspvm1w+MUaeimRVzMJzHyWVj_t3oYXA@mail.gmail.com>
 <CAF+90c-PumhFT0spXrLfEDZ-R3pY+HRAnuX+2m_aOu=RJ6qOJQ@mail.gmail.com>
 <33a61a5b-11a5-690e-d98c-86b101376be5@gmx.de>
Message-ID: <8fc0f719-b464-9eaf-f27d-3183c8200ddd@gmx.de>
Date: Wed, 16 Aug 2017 00:32:15 +0200
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101
 Thunderbird/52.2.1
MIME-Version: 1.0
In-Reply-To: <33a61a5b-11a5-690e-d98c-86b101376be5@gmx.de>
Content-Type: text/plain; charset=utf-8
Content-Language: de-DE
Content-Transfer-Encoding: 8bit
Subject: Re: [PHP-DEV] Unserialize security policy
From: cmbecker69@gmx.de ("Christoph M. Becker")

On 15.08.2017 at 23:56, Christoph M. Becker wrote:

> What about references?  Consider, for instance, the following code:
> 
>     <?php
> 
>     $_POST['untrusted_input'] = 'a:1:{i:0;a:1:{i:0;R:2;}}';
> 
>     function flatten($array)
>     {
>         if (is_array($array)) {
>             $result = [];
>             foreach ($array as $element) {
>                 $result = array_merge($result, flatten($element));
>             }
>             return $result;
>         }
>         return [$array];
>     }
> 
>     $unserializedInput = unserialize($_POST['untrusted_input'], []);
>     flatten($unserializedInput);
> 
> Of course, the `flatten()` function is naive, but it is fine for any
> "normal" input.  However, this very code has a DOS issue.  Do we really
> want to say that it is the developers responsibility to check for
> infinite recursion for code that uses the result of `unserialize(…, [])`
> in this way?
> 
> It appears to me that `unserialize()` cannot ever be safe, unless class
> instantiation *and* references can be excluded.  (Neither of these
> "features" are available in JSON or (supposed to be) in WDDX, by the
> way.)  While the former is possible, the latter is not (yet), so in my
> humble opinion we should not try to claim that `unserialize(…, [])` is
> safe, at least unless there is a mechanism to disallow unserializing of
> references, too.

My apologies for not having read the documentation!  Actually, I meant

  unserialize(…, ['allowed_classes' => false])

instead of

  unserialize(…, [])

-- 
Christoph M. Becker