Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:111134
To: Nikita Popov <nikita.ppv@gmail.com>
CC: PHP Internals List <internals@lists.php.net>
Thread-Topic: [PHP-DEV] [VOTE] Don't automatically unserialize Phar metadata
 outside getMetadata()
Thread-Index: AQHWX2NU3679vUvWnEezAEU+ozOr2KkTrM+AgAAsyiU=
Date: Wed, 22 Jul 2020 17:25:00 +0000
Message-ID:
 <DM6PR07MB661884105C6A9AA80E952253F9790@DM6PR07MB6618.namprd07.prod.outlook.com>
References:
 <DM6PR07MB66182B9F1879B64DA95FCFA6F9780@DM6PR07MB6618.namprd07.prod.outlook.com>,<CAF+90c9TSRSu=xkdsqfwzwXj6g=Z1tL_XOvijWV=62VYzqG4-Q@mail.gmail.com>
In-Reply-To:
 <CAF+90c9TSRSu=xkdsqfwzwXj6g=Z1tL_XOvijWV=62VYzqG4-Q@mail.gmail.com>
Accept-Language: en-CA, en-US
Content-Language: en-CA
x-ms-exchange-messagesentrepresentingtype: 1
x-tmn: [G/KbDkuHPkHNCAa9SQe4hAZ+9nn4jGdl]
x-ms-publictraffictype: Email
x-incomingheadercount: 45
x-eopattributedmessage: 0
x-ms-office365-filtering-correlation-id: 199e93f7-8694-427a-50c1-08d82e6429cb
x-ms-traffictypediagnostic: MW2NAM12HT035:
x-microsoft-antispam: BCL:0;
x-microsoft-antispam-message-info:
 pmuBpxhMHjXdDVae7sGFTAXQhIYles0bfZnlohWDV6Yut2Ob1Jq2b5I2ziejme2s6Fvrb4S0B3MDZ3UqFy2FKhR4zRPB85Cx7m/Bln79SjSC0MRbJ26DJoNapjFY/d4QPS4K8pNTHLWgeMZfMSKCDLOahpzr/pfWKnwBx7iEaKnCj5LgZtq4lzmEj1eojUBbn+52LYksvd0PGKqW6q8XKCt71QNtKvWbDCJwmNSwQrI+cl8IjP39twQSScKlBo+l
x-forefront-antispam-report:
 CIP:255.255.255.255;CTRY:;LANG:en;SCL:0;SRV:;IPV:NLI;SFV:NSPM;H:DM6PR07MB6618.namprd07.prod.outlook.com;PTR:;CAT:NONE;SFTY:;SFS:;DIR:OUT;SFP:1901;
x-ms-exchange-antispam-messagedata:
 Mo4+o1a561dVJ1yai43jsOCGgjLgobMo2+6SCM4TENBFsTa7UFFyHFUaldf5Qoag0It6T8SGAXM0JNQPZj++WmUdqJak+VJQEEh9U5+/kzZ5I80SM3/IkhHYp/fG+4t2GPW2WMUnU8ISPE7wWPF4EQ==
x-ms-exchange-transport-forked: True
Content-Type: text/plain; charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: hotmail.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-AuthSource: MW2NAM12FT057.eop-nam12.prod.protection.outlook.com
X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000
X-MS-Exchange-CrossTenant-Network-Message-Id: 199e93f7-8694-427a-50c1-08d82e6429cb
X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000
X-MS-Exchange-CrossTenant-originalarrivaltime: 22 Jul 2020 17:25:00.5243
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Internet
X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MW2NAM12HT035
Subject: Re: [PHP-DEV] [VOTE] Don't automatically unserialize Phar metadata
 outside getMetadata()
From: tysonandre775@hotmail.com (tyson andre)

Hi internals,=0A=
=0A=
> As a minor suggestion:=0A=
> =0A=
> > Additionally, add an $allowed_classes parameter to both getMetadata() i=
mplementations, defaulting to the current behavior of allowing any classes =
(true). This will be passed to the call to unserialize() performed internal=
ly. =0A=
> =0A=
> Rather than adding an $allowed_classes parameter, I'd add a general $unse=
rialize_options parameter that just gets passed through to unserialize. E.g=
. we also have a "max_depth" option, which also seems potentially useful. T=
his will ensure that any new limitations we implement for unserialize() wil=
l also be available in this context.=0A=
=0A=
I amended https://wiki.php.net/rfc/phar_stop_autoloading_metadata and chang=
ed from version 0.3 to 0.4,=0A=
with the behavior I plan to implement. I'll aim to have the implementation =
updated by Friday.=0A=
=0A=
> 0.4: Change from getMetadata($allowed_classes =3D =85) to getMetadata(arr=
ay $unserialize_options =3D []) in this document.=0A=
> I forgot about max_depth being added in php 8.0 and the usefulness of bei=
ng able to support future options added to unserialize()=0A=
> without changing the signature of getMetadata.=0A=
> Elaborate on implementation details $unserialize_options would lead to wh=
en setMetaData is called before=0A=
> $pharFileOrEntry->getMetadata(['allowed_classes' =3D> $classes])=0A=
=0A=
Any other comments/concerns?=0A=