Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:103885
MIME-Version: 1.0
References: <CAF+90c-GfwWSJ+LUUYrb6gpZRrwP=XX=hWFD9DL-3xQhBOgp+A@mail.gmail.com>
 <CAOWwgpm3Ne74swRBhvEXO=rqps_GrAYMKbQzKxzjNHSttkekFA@mail.gmail.com>
In-Reply-To: <CAOWwgpm3Ne74swRBhvEXO=rqps_GrAYMKbQzKxzjNHSttkekFA@mail.gmail.com>
Date: Wed, 30 Jan 2019 10:27:14 +0100
Message-ID: <CAF+90c_GT2fw7ryburDNFMBOmSTxxyfjEFWFCdMdZaapoNxUug@mail.gmail.com>
To: Nicolas Grekas <nicolas.grekas+php@gmail.com>
Cc: PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="000000000000fe11860580a984a1"
Subject: Re: [RFC] New custom object serialization mechanism
From: nikita.ppv@gmail.com (Nikita Popov)

--000000000000fe11860580a984a1
Content-Type: text/plain; charset="UTF-8"

On Wed, Jan 30, 2019 at 10:20 AM Nicolas Grekas <
nicolas.grekas+php@gmail.com> wrote:

> Hi Nikita,
>
> https://wiki.php.net/rfc/custom_object_serialization
>>
>
> In the RFC, you mention that "Executing arbitrary code in the middle of
> unserialization is dangerous and has led to numerous unserialize()
> vulnerabilities in the past. For this reason __wakeup() calls are now
> delayed until the end of unserialization."
>
> How about destructors?
> Some vulnerabilities come from destructors doing things with unserialized
> state.
> Would it be possible/a good idea to *not* call any destructors unless the
> "wakeup" stage has been successful? Any exceptions thrown during
> __wakeup/__unserialize would mean the unserialized data structure should be
> destroyed without calling any destructors?
> WDYT?
>

This is already how it works. If a class has __wakeup and unserialization
fails (or call of __wakeup fails), then we will not call the destructor.
(The same would be true for __unserialize under this proposal.)

Nikita

--000000000000fe11860580a984a1--