Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:103757
MIME-Version: 1.0
References: <CANA3Det3Cn2LAzcFPmVpP+ApgdtwDYrcnwuys8Gdo6CzRxLqBg@mail.gmail.com>
In-Reply-To: <CANA3Det3Cn2LAzcFPmVpP+ApgdtwDYrcnwuys8Gdo6CzRxLqBg@mail.gmail.com>
Date: Fri, 18 Jan 2019 01:24:06 +0100
Message-ID: <CADyq6sKt8XxXOoqFYTjphBQ7Fgg7SFmZdexaDFq2-AfxX-zURg@mail.gmail.com>
To: Marcos Passos <marcospassos.com@gmail.com>
Cc: internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="0000000000002a8fd6057fb088f9"
Subject: Re: [PHP-DEV] Unserializes, inheritance and allows_classes
From: ocramius@gmail.com (Marco Pivetta)

--0000000000002a8fd6057fb088f9
Content-Type: text/plain; charset="UTF-8"

On Fri, Jan 18, 2019 at 12:49 AM Marcos Passos <marcospassos.com@gmail.com>
wrote:

> Hi internals,
>
> Today I stumbled upon a limitation when implementing the unserialize method
> of a serializable class which depends on an abstraction also serializable.
> Currently, there is no way to unserialize an object specifying a parent
> class in the allowed_classes option:
>
> class SerializableBase implements \Serializable {
> > }
> > class SerializableChild extends SerializableBase {
> > }
> > class Foo implements \Serializable {
> >    private $dependency;
> >     public function __construct(SerializableBase $dependency) {
> >         $this->dependency = $dependency;
> >     }
> >     public function serialize() : string {
> >          return \serialize($this->dependency);
> >     }
> >    public function unserialize($data) : void {
> >         $this->dependency = \unserialize($data, ['allowed_classes' =>
> > SerializableBase::class]);
> >    }
> > }
>
>
> Is this an intentional limitation?
>
>
Seems expected to me: `allowed_classes` is a whitelist, not a complex
filter/ruleset.

Also: nothing denies an attacker from defining a subtype to your class,
then passing a malicious instance to your application.

Marco Pivetta

http://twitter.com/Ocramius

http://ocramius.github.com/

--0000000000002a8fd6057fb088f9--