Newsgroups: php.internals Path: news.php.net Xref: news.php.net php.internals:110857 Return-Path: Delivered-To: mailing list internals@lists.php.net Received: (qmail 39609 invoked from network); 7 Jul 2020 03:38:11 -0000 Received: from unknown (HELO php-smtp4.php.net) (45.112.84.5) by pb1.pair.com with SMTP; 7 Jul 2020 03:38:11 -0000 Received: from php-smtp4.php.net (localhost [127.0.0.1]) by php-smtp4.php.net (Postfix) with ESMTP id 7989C1804DE for ; Mon, 6 Jul 2020 19:28:45 -0700 (PDT) X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on php-smtp4.php.net X-Spam-Level: X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FREEMAIL_FROM, RCVD_IN_DNSWL_NONE,RCVD_IN_MSPIKE_H3,RCVD_IN_MSPIKE_WL,SPF_HELO_NONE, SPF_PASS autolearn=no autolearn_force=no version=3.4.2 X-Spam-ASN: AS15169 209.85.128.0/17 X-Spam-Virus: No X-Envelope-From: Received: from mail-pf1-f182.google.com (mail-pf1-f182.google.com [209.85.210.182]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (P-256) server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by php-smtp4.php.net (Postfix) with ESMTPS for ; Mon, 6 Jul 2020 19:28:45 -0700 (PDT) Received: by mail-pf1-f182.google.com with SMTP id j20so2095707pfe.5 for ; Mon, 06 Jul 2020 19:28:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:cc:references:from:message-id:date:user-agent :mime-version:in-reply-to:content-language:content-transfer-encoding; bh=LiNzdTXdvgzj2ZoFvke2istAE0SVUlR/c/qcHX8mrBU=; b=Vb8HhjdAz4cBB+P+zMK5ACm4xyJJESjQf+ee7/+iWGub5hfUdCDFQ8qv6PPu2lW+RF EnmI9ECLhOm/+WyJgJsM8cle+1PQTArRXZWReu+u3Yqx8FgePlxNmtRtjCqszxTCUhQv w7WA0r20ktRV1a7qlhMU5Q8i76gViCj2VHtLhzXxMDK1eW0g4PPEr93krX/1NyvIdRZG KBwPBdsgVUIRafs8cKRKe1jd85TOIxWsx6J0WmZTUSH2DEuh9QkVdxWv4t5qZzlVtKtT 1A5Yq2IEcOPEg5fLEy8JwFCxVCXTVC8BaDVBVAuaNaqy5MCLnedCys+tyHBB/PEuyGXv 1Qtw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:cc:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=LiNzdTXdvgzj2ZoFvke2istAE0SVUlR/c/qcHX8mrBU=; b=Axz300eddkkWCRLoUqsbntB84LXxRisL8AXbM9P2DHPAih/17Yy1GO5ZpB9KhCru5p m8JAcjPrRgG7uS+Ruq1jziNzG8H8rnkdPYear1+PJr5L7+wCQ4aZUJKETmD9679Nra0T 4jAExCw3bxpWvlWUVUhbT5cSqNBmaQp3ewsUi9nMsBCkf7LRBr9dR3l7bU+UhO+k5AaU uajJksCcTHghiqjKSJfxearOiF0Uz22oi2jHAwUUFf6PC8jSoaRt7Uge6BrRJOPaVqMQ Z7TgEQ2TRKW0W6HwC2nw5f1K5ukHSfZhpnB5Tidb74Bmafow3Szj+vgYvbOsS4jcpmm8 D7vA== X-Gm-Message-State: AOAM5300fwBzNMYyp3jASvKahFusJr3JkPgjpV+TdjDRkcRGZRqSE9vo qXJCCjZTbb+2yKJAW2DJmA== X-Google-Smtp-Source: ABdhPJxWPBum6DfS94MczxDhZ1rOSiNpzgQuuObE6FkeomVmA4USN7CjE28HGYixq0xaJHjMPx50cg== X-Received: by 2002:a62:4ec8:: with SMTP id c191mr12029517pfb.15.1594088922413; Mon, 06 Jul 2020 19:28:42 -0700 (PDT) Received: from ip-192-168-8-10.us-west-2.compute.internal (ec2-44-226-30-91.us-west-2.compute.amazonaws.com. [44.226.30.91]) by smtp.gmail.com with ESMTPSA id w9sm684219pja.39.2020.07.06.19.28.40 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Mon, 06 Jul 2020 19:28:41 -0700 (PDT) To: tyson andre , "internals@lists.php.net" Cc: Bishop Bettini References: Message-ID: Date: Mon, 6 Jul 2020 19:28:40 -0700 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit Subject: Re: Including "Disable the ability to use concrete types in PHAR metadata" in PHP 8.0? From: smalyshev@gmail.com (Stanislav Malyshev) Hi! > https://bugs.php.net/bug.php?id=76774 has been open since 2018-08-21. > > That ticket proposes the following: > >> I propose that we disable the ability to have concrete types included in the serialized metadata by >> providing an empty classlist to the unserialize call in the PHAR package. >> This will support the real cases we see in the wild of metadata usage which is only array key values. I think it's a good idea. I am a little bit worried that somebody somewhere may be using phars with object data, and it'd be nice to create some way for such people to still use these phars, but by default I think no complex objects is a good idea. -- Stas Malyshev smalyshev@gmail.com