Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:119748
Feedback-ID: i8414410d:Fastmail
User-Agent: Cyrus-JMAP/3.9.0-alpha0-236-g06c0f70e43-fm-20230313.001-g06c0f70e
Mime-Version: 1.0
Message-ID: <e0a3a96c-63f3-4503-bb98-d997af3d316f@app.fastmail.com>
In-Reply-To: <1B77BC20-4EA6-453B-A39B-2406A4E53436@dafert.at>
References: <f37f233b-6645-d618-0868-78cbadb649a2@bastelstu.be>
 <CABdc3WovbsYH2BTsTbeD71bSfM44C1nocXtoxQpPo=E2Fq4iLQ@mail.gmail.com>
 <1B77BC20-4EA6-453B-A39B-2406A4E53436@dafert.at>
Date: Mon, 27 Mar 2023 17:22:57 -0500
To: "php internals" <internals@lists.php.net>
Content-Type: text/plain;charset=utf-8
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] RFC [Discussion]: Make unserialize() emit a warning for trailing
 bytes
From: larry@garfieldtech.com ("Larry Garfield")

On Mon, Mar 27, 2023, at 2:12 PM, Mel Dafert wrote:
> On 27 March 2023 20:20:58 CEST, "Micha=C5=82 Marcin Brzuchalski"=20
> <michal.brzuchalski@gmail.com> wrote:
>> Personally, I'd like the unserialize to throw an exception if trailing
>>bytes are detected.
>>If not by default then with the use of the option passed to unserialize
>>function.
>
> If that's the desired direction, it makes more sense to emit a=20
> deprecation notice
> now and throw an exception starting in 9.0.
>
> Regards,
> Mel Dafert

I would also favor throwing an exception.  This is a security vector bei=
ng closed, and that should be closed *hard*.  Warnings tend to show up w=
here they're not useful (dev) and get not noticed where they are (prod).=
  Go all the way to an exception here.

I'm flexible on if that happens in 8.3 or 9.  Maybe warning now, with ex=
ception in 9?  I don't know if that's better from a BC POV, but it shoul=
d end up as an exception.

--Larry Garfield