Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:117142
Message-ID: <0F27748B-A04C-402B-B77F-8343E6D280E1@gmail.com>
Content-Type: multipart/alternative;
	boundary="Apple-Mail=_5682C9D2-22F4-4535-8005-368C0592EDEB"
Mime-Version: 1.0 (Mac OS X Mail 15.0 \(3693.60.0.1.1\))
Date: Sat, 26 Feb 2022 16:35:44 +0100
In-Reply-To: <b9d3740d-7664-44ea-318d-bcb516ad5c87@woltlab.com>
Cc: PHP internals <internals@lists.php.net>
To: =?utf-8?Q?=22Tim_D=C3=BCsterhus=2C_WoltLab_GmbH=22?= <duesterhus@woltlab.com>
References: <b9d3740d-7664-44ea-318d-bcb516ad5c87@woltlab.com>
Subject: Re: [PHP-DEV] SensitiveParameterValue serialization behavior
From: claude.pache@gmail.com (Claude Pache)

--Apple-Mail=_5682C9D2-22F4-4535-8005-368C0592EDEB
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=utf-8



>=20
> 1. Disallow both serialization and unserialization.
>=20
> This will make the serialization issue very obvious, but will require =
adjustments to exception handlers that serialize the stack traces.

Hi,

Note that exception handlers that serialise stack traces without taking =
into account that the operation may fail, are already broken as of =
today, because common unserialisable objects, such as Closure instances =
(anonymous functions), may appear in stack traces.

https://3v4l.org/tv1s1 <https://3v4l.org/tv1s1>

https://3v4l.org/PGKnl <https://3v4l.org/PGKnl>

Making SensitiveParameterValue fail on serialisation won=E2=80=99t break =
those handlers, but make their existing brokenness apparent in more =
cases (which is a good thing).

=E2=80=94Claude


--Apple-Mail=_5682C9D2-22F4-4535-8005-368C0592EDEB--