Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:103759
MIME-Version: 1.0
References: <CANA3Det3Cn2LAzcFPmVpP+ApgdtwDYrcnwuys8Gdo6CzRxLqBg@mail.gmail.com>
 <CADyq6sKt8XxXOoqFYTjphBQ7Fgg7SFmZdexaDFq2-AfxX-zURg@mail.gmail.com> <CANA3DevZK4F2_Vk3PD8aDdMzS1t=L6x4C7xL88Y1AY8p8A2P2w@mail.gmail.com>
In-Reply-To: <CANA3DevZK4F2_Vk3PD8aDdMzS1t=L6x4C7xL88Y1AY8p8A2P2w@mail.gmail.com>
Date: Fri, 18 Jan 2019 01:53:03 +0100
Message-ID: <CADyq6sL2LyguyXawskdCE9XyQmtTq7vRqN+sZ6eDrrh6Rvdb1g@mail.gmail.com>
To: Marcos Passos <marcospassos.com@gmail.com>
Cc: internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="000000000000ab25a5057fb0ef10"
Subject: Re: [PHP-DEV] Unserializes, inheritance and allows_classes
From: ocramius@gmail.com (Marco Pivetta)

--000000000000ab25a5057fb0ef10
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Fri, Jan 18, 2019 at 1:50 AM Marcos Passos <marcospassos.com@gmail.com>
wrote:

> Hi Marco,
>
> Also: nothing denies an attacker from defining a subtype to your class,
>> then passing a malicious instance to your application.
>
>
> Fact, but it also reveals a fragility in the solution in the sense that
> one has to opt between flexible design or security.
>
> Em qui, 17 de jan de 2019 =C3=A0s 22:24, Marco Pivetta <ocramius@gmail.co=
m>
> escreveu:
>
>>
>> On Fri, Jan 18, 2019 at 12:49 AM Marcos Passos <
>> marcospassos.com@gmail.com> wrote:
>>
>>> Hi internals,
>>>
>>> Today I stumbled upon a limitation when implementing the unserialize
>>> method
>>> of a serializable class which depends on an abstraction also
>>> serializable.
>>> Currently, there is no way to unserialize an object specifying a parent
>>> class in the allowed_classes option:
>>>
>>> class SerializableBase implements \Serializable {
>>> > }
>>> > class SerializableChild extends SerializableBase {
>>> > }
>>> > class Foo implements \Serializable {
>>> >    private $dependency;
>>> >     public function __construct(SerializableBase $dependency) {
>>> >         $this->dependency =3D $dependency;
>>> >     }
>>> >     public function serialize() : string {
>>> >          return \serialize($this->dependency);
>>> >     }
>>> >    public function unserialize($data) : void {
>>> >         $this->dependency =3D \unserialize($data, ['allowed_classes' =
=3D>
>>> > SerializableBase::class]);
>>> >    }
>>> > }
>>>
>>>
>>> Is this an intentional limitation?
>>>
>>>
>> Seems expected to me: `allowed_classes` is a whitelist, not a complex
>> filter/ruleset.
>>
>> Also: nothing denies an attacker from defining a subtype to your class,
>> then passing a malicious instance to your application.
>>
>> Marco Pivetta
>>
>> http://twitter.com/Ocramius
>>
>> http://ocramius.github.com/
>>
>>
>
Security is not a choice. The design is not fragile, it is strict and
correct.

Marco Pivetta

http://twitter.com/Ocramius

http://ocramius.github.com/

--000000000000ab25a5057fb0ef10--