Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:121976
Message-ID: <007ca2a5-53af-4abf-8877-7f51699bafba@gmail.com>
Date: Sat, 9 Dec 2023 17:34:39 +0100
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Content-Language: en-US
To: internals@lists.php.net
References: <CAGgaK7+w_zdp30Pi5nJ-y+GPEkfc2xHfFUW+DwdpNtY8iPjMHg@mail.gmail.com>
 <20add1b7-24ed-42be-ae84-99ef81480fa2@gmail.com>
 <f8a10415-6fc2-4083-9ac9-89044a7ca30e@app.fastmail.com>
In-Reply-To: <f8a10415-6fc2-4083-9ac9-89044a7ca30e@app.fastmail.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] [RFC][Discussion] NotSerializable attribute
From: dossche.niels@gmail.com (Niels Dossche)

On 12/9/23 17:28, Larry Garfield wrote:
> On Sat, Dec 9, 2023, at 10:17 AM, Niels Dossche wrote:
>> Hi Max
>>
>> On 12/9/23 13:30, Max Semenik wrote:
>>> Hi, I'd like to propose a new attribute, #[NotSerializable]. This
>>> functionality is already available for internal classes - userspace should
>>> benefit from it, too.
>>>
>>> The RFC: https://wiki.php.net/rfc/not_serializable
>>> Proposed implementation: https://github.com/php/php-src/pull/12788
>>>
>>> Please let me know what you think.
>>>
>>
>> Thanks for this proposal, it is a sensible addition in my opinion.
>>
>> I do have a question/remark though.
>> The example you wrote in your RFC (with MyClass implementing __sleep 
>> and __awake) is not equivalent to adding #[NotSerializable].
>> This is because if you create a child class of MyClass:
>>
>> ```
>> class MyClassChild extends MyClass
>> {
>>     public function __sleep(): array
>>     {
>>         return ...; // real implementation instead of throwing
>>     }
>>
>>     public function __wakeup(): void
>>     {
>> 	... // real implementation instead of throwing
>>     }
>> }
>> ```
>>
>> Then this subclass MyClassChild will actually be serializable.
>> If you instead put #[NotSerializable] on the parent class MyClass, then 
>> the child class won't be serializable even if you implement the 
>> serialization methods in the child.
>> Is this intentional? If yes, this should probably be clarified in the 
>> text.
> 
> Attributes do not inherit automatically, so it's the opposite.  A child that is not marked #[NotSerializable] would be serializable.  (Whether that's good or not is a separate question.)
> 

I know attributes aren't inherited, but the ZEND_ACC flag that this uses _is_ inherited.
Try this out yourself:

```
<?php
#[NotSerializable]
class MyClass {}
class Foo extends MyClass {}
$foo = new Foo();
$serialized = serialize($foo);
```

Results in Fatal error: Uncaught Exception: Serialization of 'Foo' is not allowed

> 
> --Larry Garfield
>