Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:103760
MIME-Version: 1.0
References: <CANA3Det3Cn2LAzcFPmVpP+ApgdtwDYrcnwuys8Gdo6CzRxLqBg@mail.gmail.com>
 <CADyq6sKt8XxXOoqFYTjphBQ7Fgg7SFmZdexaDFq2-AfxX-zURg@mail.gmail.com>
 <CANA3DevZK4F2_Vk3PD8aDdMzS1t=L6x4C7xL88Y1AY8p8A2P2w@mail.gmail.com> <CADyq6sL2LyguyXawskdCE9XyQmtTq7vRqN+sZ6eDrrh6Rvdb1g@mail.gmail.com>
In-Reply-To: <CADyq6sL2LyguyXawskdCE9XyQmtTq7vRqN+sZ6eDrrh6Rvdb1g@mail.gmail.com>
Date: Thu, 17 Jan 2019 23:00:48 -0200
Message-ID: <CANA3DeuYoxbnjm4BsgvmTQnDx2isqbbfHOFTe7R8-DqHmiFU=A@mail.gmail.com>
To: Marco Pivetta <ocramius@gmail.com>
Cc: internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="00000000000046ce43057fb10ba4"
Subject: Re: [PHP-DEV] Unserializes, inheritance and allows_classes
From: marcospassos.com@gmail.com (Marcos Passos)

--00000000000046ce43057fb10ba4
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

How would you fix this example, then? Perhaps we should add more examples
in the docs.

Em qui, 17 de jan de 2019 =C3=A0s 22:53, Marco Pivetta <ocramius@gmail.com>
escreveu:

> On Fri, Jan 18, 2019 at 1:50 AM Marcos Passos <marcospassos.com@gmail.com=
>
> wrote:
>
>> Hi Marco,
>>
>> Also: nothing denies an attacker from defining a subtype to your class,
>>> then passing a malicious instance to your application.
>>
>>
>> Fact, but it also reveals a fragility in the solution in the sense that
>> one has to opt between flexible design or security.
>>
>> Em qui, 17 de jan de 2019 =C3=A0s 22:24, Marco Pivetta <ocramius@gmail.c=
om>
>> escreveu:
>>
>>>
>>> On Fri, Jan 18, 2019 at 12:49 AM Marcos Passos <
>>> marcospassos.com@gmail.com> wrote:
>>>
>>>> Hi internals,
>>>>
>>>> Today I stumbled upon a limitation when implementing the unserialize
>>>> method
>>>> of a serializable class which depends on an abstraction also
>>>> serializable.
>>>> Currently, there is no way to unserialize an object specifying a paren=
t
>>>> class in the allowed_classes option:
>>>>
>>>> class SerializableBase implements \Serializable {
>>>> > }
>>>> > class SerializableChild extends SerializableBase {
>>>> > }
>>>> > class Foo implements \Serializable {
>>>> >    private $dependency;
>>>> >     public function __construct(SerializableBase $dependency) {
>>>> >         $this->dependency =3D $dependency;
>>>> >     }
>>>> >     public function serialize() : string {
>>>> >          return \serialize($this->dependency);
>>>> >     }
>>>> >    public function unserialize($data) : void {
>>>> >         $this->dependency =3D \unserialize($data, ['allowed_classes'=
 =3D>
>>>> > SerializableBase::class]);
>>>> >    }
>>>> > }
>>>>
>>>>
>>>> Is this an intentional limitation?
>>>>
>>>>
>>> Seems expected to me: `allowed_classes` is a whitelist, not a complex
>>> filter/ruleset.
>>>
>>> Also: nothing denies an attacker from defining a subtype to your class,
>>> then passing a malicious instance to your application.
>>>
>>> Marco Pivetta
>>>
>>> http://twitter.com/Ocramius
>>>
>>> http://ocramius.github.com/
>>>
>>>
>>
> Security is not a choice. The design is not fragile, it is strict and
> correct.
>
> Marco Pivetta
>
> http://twitter.com/Ocramius
>
> http://ocramius.github.com/
>
>

--00000000000046ce43057fb10ba4--