Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:118434
MIME-Version: 1.0
Date: Tue, 16 Aug 2022 12:33:24 -0400
Message-ID: <CAOfKkdSbByKtrP=hnjmhtmLHiU+V-46wx2ojrQEt8EVtOP8ZtQ@mail.gmail.com>
To: Sergey Panteleev <sergey@php.net>, PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="0000000000004db0be05e65e4fb9"
Subject: Strict properties and unserialization
From: pierrick@php.net (Pierrick Charron)

--0000000000004db0be05e65e4fb9
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi internals,

We (Sergey and I) would like to introduce you to a problem [1] that was
reported by Tim D=C3=BCsterhus and others about the Strict Properties RFC [=
2]
that was implemented in PHP8.2.
The RFC missed a part about how PHP should handle unserialization of
objects with undefined properties.

Example :

class Foo {}
$foo =3D unserialize('O:3:"Foo":1:{s:3:"bar";i:42;}');

In this case PHP will not trigger any deprecation warnings but it probably
should. It was something that was not thought about while writing the RFC
(at least the RFC doesn't mention anything about this).

PHP8.2beta3 will be announced this Thursday, and the next scheduled version
is supposed to be RC1. So we are pretty late in the pre-release cycle. We
have multiple options :

First we could just do nothing in PHP8.2 about this and leave it like that
and only fix it in PHP8.3. This is probably the way we should do it if we
want to stick to the initial PHP8.2 release cycle calendar.
The second option would be to fix this in PHP8.2 before RC1. We don't have
any idea on how big the patch is and it may influence the final decision.
If patching it for 8.2 is the best way to do, we may want to add another
Beta (Beta4) and delay the RC1 release by 2 weeks.

We would like to hear your thoughts about this issue.

Regards
Sergey and Pierrick

[1] https://github.com/php/php-src021-11-26./issues/9186
<https://github.com/php/php-src/issues/9186>
[2] https://wiki.php.net/rfc/deprecate_dynamic_properties

--0000000000004db0be05e65e4fb9--